The retention period must clear the longest window that applies

The requirementstatement

The stated retention period for consent and opt-out records must be the maximum of every applicable window, not the first one the brand found.

Severityseverity: HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: campaign.message_flow + privacy policy
Where it liveslayer: OperationalOPERATIONAL
How Ekas settles itdetectability: AI · formAI_FORM; A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
What the fix involvesfailureClass: Fix the fieldRETRY_FIELD; A better value in the form fixes it. Ekas can rewrite it and re-check.
Who requires itauthorities: FTCFCCCTIAstate law
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

Five separate floors sit under this, set by five different bodies: the telemarketing rule's five years, the four-year TCPA limitation period, the five-year internal do-not-call floor, the short-code handbook's opt-in-until-six-months-after-opt-out, and any longer state rule — Virginia sets ten years for suppression records. They are not alternatives. A brand that reads one source and retains for the period it names is under-retained against the others, and finds out when a claim arrives in year four against records deleted in year two.

How to fix itremediation

Set one retention period for consent and opt-out records at the longest window that reaches you, and state that period rather than a rule reference. Five years clears the telemarketing rule, the TCPA limitation period and the short-code floor together; check whether a state you message into is longer. Done when the stated number is a single figure you can defend against every source above.

A compliant exampleexample

We retain consent and opt-out records for five years from the last message sent in reliance on that consent.

Common mistakespitfalls

Citing an authority instead of a number ("we retain records as required by law") leaves the period undefined, and an undefined period is administered by whichever system deletes first.

Notesnotes

Absorbs OPS-222 (four-year TCPA), OPS-059 (the five-year internal do-not-call floor), OPS-224 (short-code opt-in and opt-out floors), OPS-225 (the resolution rule itself), and the state rows OPS-060 and OPS-226. They are inputs to one resolver, and implementing any one alone under-retains — which is why they are one rule rather than six. Only the retention half of OPS-059 and OPS-060 is settled here; honouring a suppression record is runtime behaviour and is not claimed. The state check needs a jurisdiction we do not hold, so the criteria ask the model to report it as a residual rather than settle it.

Rules you will hit next

6 other rules read campaign.message_flow + privacy policy. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.

OPS-056Opt-out records must keep the words the consumer actually sentBlockingBLOCKING OPS-085The programme must scrub deactivated numbers before sendingBlockingBLOCKING OPS-210Telemarketing consent must retain the request, its purpose and the answerBlockingBLOCKING OPS-236An IVR opt-in must log the prompt, the keypress, the time and the callBlockingBLOCKING OPS-261Only the charity may use the numbers a charity collectsBlockingBLOCKING OPS-199Consent records must capture all seven required fieldsHighHIGH

All operational rules

OPS-221 is one of 139 operational rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.