# CON-DISC-PRIVACY-LINK — A Privacy Policy link must sit at the point of consent

> A link to the Privacy Policy must be present beside the opt-in control, not only in the page footer.

- **Rule ID:** CON-DISC-PRIVACY-LINK
- **Layer:** Consent flow (`CONSENT_FLOW`)
- **Checks:** `consent surface`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page; AI vision over a consent artifact (screenshot, scan, MMS media)
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** CTIA, TCR, Twilio
- **Applies:** Applies when consent was collected by web form, checkout, account settings, third party, chat, social and email.
- **Canonical URL:** https://ekas.io/rules/10dlc/consent-flow/con-disc-privacy-link/

## Why this rule exists

The privacy policy is where the consumer learns their number will not be sold on — the single clause carriers care most about. CTIA requires all applicable privacy policies to be referenced in and accessible from the initial call to action, so distance from the opt-in is itself the violation.

## How to fix it

Add a Privacy Policy hyperlink inside or immediately beneath the consent sentence. Make sure the page it points at actually contains the SMS data clause, or you will pass this rule and fail the policy-page one.

## Example of a compliant value

```text
By checking this box you agree to Acme Coffee's <a href="/terms">Terms of Service</a> and <a href="/privacy">Privacy Policy</a>.
```