# POL-001 — A privacy policy URL is required on the campaign

> Every campaign registration must carry a non-empty privacy policy URL.

- **Rule ID:** POL-001
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `campaign.privacyPolicyUrl`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** TCR, Twilio, Bandwidth, AWS, Telnyx, Sinch, Plivo, Bird
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-001/

## Why this rule exists

The policy is the document a consumer is entitled to read before handing over a number, so a registration without one is asking carriers to approve a programme nobody can inspect. Twilio codes the missing field separately from a failed policy review precisely because the usual cause is mechanical — integration code written before the field became mandatory simply never sends it, and every campaign that integration creates fails the same way.

## How to fix it

Set the privacy policy URL on the campaign to the https address of the published policy page. Done when the field holds a URL you can open in a private window and read.

## Example of a compliant value

```text
privacy_policy_url: https://acmecoffee.com/privacy
```

## Common mistakes

- If campaigns are created through an API integration, the empty field is in your code rather than on the form — check the request body before re-filing, or the next campaign fails identically.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio (gen2) | `30933` | yes |
| Twilio (gen1) | `30908` | yes |