{
  "id": "OPS-221",
  "slug": "ops-221",
  "title": "The retention period must clear the longest window that applies",
  "statement": "The stated retention period for consent and opt-out records must be the maximum of every applicable window, not the first one the brand found.",
  "rationale": "Five separate floors sit under this, set by five different bodies: the telemarketing rule's five years, the four-year TCPA limitation period, the five-year internal do-not-call floor, the short-code handbook's opt-in-until-six-months-after-opt-out, and any longer state rule — Virginia sets ten years for suppression records. They are not alternatives. A brand that reads one source and retains for the period it names is under-retained against the others, and finds out when a claim arrives in year four against records deleted in year two.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "campaign.message_flow + privacy policy",
  "severity": "HIGH",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "FTC",
    "FCC",
    "CTIA",
    "state law"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Set one retention period for consent and opt-out records at the longest window that reaches you, and state that period rather than a rule reference. Five years clears the telemarketing rule, the TCPA limitation period and the short-code floor together; check whether a state you message into is longer. Done when the stated number is a single figure you can defend against every source above.",
  "example": "We retain consent and opt-out records for five years from the last message sent in reliance on that consent.",
  "pitfalls": [
    "Citing an authority instead of a number (\"we retain records as required by law\") leaves the period undefined, and an undefined period is administered by whichever system deletes first."
  ],
  "notes": "Absorbs OPS-222 (four-year TCPA), OPS-059 (the five-year internal do-not-call floor), OPS-224 (short-code opt-in and opt-out floors), OPS-225 (the resolution rule itself), and the state rows OPS-060 and OPS-226. They are inputs to one resolver, and implementing any one alone under-retains — which is why they are one rule rather than six. Only the retention half of OPS-059 and OPS-060 is settled here; honouring a suppression record is runtime behaviour and is not claimed. The state check needs a jurisdiction we do not hold, so the criteria ask the model to report it as a residual rather than settle it.",
  "catalogIds": [
    "OPS-059",
    "OPS-060",
    "OPS-222",
    "OPS-224",
    "OPS-225",
    "OPS-226"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/operational/ops-221/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-221.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}