# OPS-221 — The retention period must clear the longest window that applies

> The stated retention period for consent and opt-out records must be the maximum of every applicable window, not the first one the brand found.

- **Rule ID:** OPS-221
- **Layer:** Operational (`OPERATIONAL`)
- **Checks:** `campaign.message_flow + privacy policy`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** FTC, FCC, CTIA, state law
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/operational/ops-221/

## Why this rule exists

Five separate floors sit under this, set by five different bodies: the telemarketing rule's five years, the four-year TCPA limitation period, the five-year internal do-not-call floor, the short-code handbook's opt-in-until-six-months-after-opt-out, and any longer state rule — Virginia sets ten years for suppression records. They are not alternatives. A brand that reads one source and retains for the period it names is under-retained against the others, and finds out when a claim arrives in year four against records deleted in year two.

## How to fix it

Set one retention period for consent and opt-out records at the longest window that reaches you, and state that period rather than a rule reference. Five years clears the telemarketing rule, the TCPA limitation period and the short-code floor together; check whether a state you message into is longer. Done when the stated number is a single figure you can defend against every source above.

## Example of a compliant value

```text
We retain consent and opt-out records for five years from the last message sent in reliance on that consent.
```

## Common mistakes

- Citing an authority instead of a number ("we retain records as required by law") leaves the period undefined, and an undefined period is administered by whichever system deletes first.

## Notes

Absorbs OPS-222 (four-year TCPA), OPS-059 (the five-year internal do-not-call floor), OPS-224 (short-code opt-in and opt-out floors), OPS-225 (the resolution rule itself), and the state rows OPS-060 and OPS-226. They are inputs to one resolver, and implementing any one alone under-retains — which is why they are one rule rather than six. Only the retention half of OPS-059 and OPS-060 is settled here; honouring a suppression record is runtime behaviour and is not claimed. The state check needs a jurisdiction we do not hold, so the criteria ask the model to report it as a residual rather than settle it.