{
  "id": "POL-018",
  "slug": "pol-018",
  "title": "Policy pages must be machine-crawlable",
  "statement": "The policy pages must be fetchable by an automated vetter — no robots.txt disallow, no noindex, no JS-only render, no geofence.",
  "rationale": "Vetting fetches your policy with a headless client, not a browser. A page that renders only after JavaScript, or that robots.txt forbids, is indistinguishable from a page that does not exist — so a perfectly compliant policy fails because the reviewer's crawler saw nothing.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy URL + terms URL",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_POLICY",
  "authorities": [
    "TCR",
    "Twilio",
    "Bandwidth"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Serve the policy as server-rendered HTML, remove any robots.txt disallow or noindex on those paths, and confirm the page returns content with JavaScript disabled and from a US IP address.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-018/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-018.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}