{
  "id": "CON-DISC-PRIVACY-LINK",
  "slug": "con-disc-privacy-link",
  "title": "A Privacy Policy link must sit at the point of consent",
  "statement": "A link to the Privacy Policy must be present beside the opt-in control, not only in the page footer.",
  "rationale": "The privacy policy is where the consumer learns their number will not be sold on — the single clause carriers care most about. CTIA requires all applicable privacy policies to be referenced in and accessible from the initial call to action, so distance from the opt-in is itself the violation.",
  "layer": "CONSENT_FLOW",
  "layerSlug": "consent-flow",
  "object": "consent surface",
  "severity": "HIGH",
  "detectability": [
    "CRAWL",
    "VISION"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "CTIA",
    "TCR",
    "Twilio"
  ],
  "applicability": {
    "consentMethods": [
      "web_form",
      "checkout",
      "account_settings",
      "third_party",
      "chat",
      "social",
      "email"
    ]
  },
  "applicabilityText": "Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.",
  "universal": false,
  "remediation": "Add a Privacy Policy hyperlink inside or immediately beneath the consent sentence. Make sure the page it points at actually contains the SMS data clause, or you will pass this rule and fail the policy-page one.",
  "example": "By checking this box you agree to Acme Coffee's <a href=\"/terms\">Terms of Service</a> and <a href=\"/privacy\">Privacy Policy</a>.",
  "catalogIds": [
    "CON-092"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/consent-flow/con-disc-privacy-link/",
  "markdown": "https://ekas.io/rules/10dlc/consent-flow/con-disc-privacy-link.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}