# POL-021 — Policy URLs must not redirect

> A URL submitted for a policy page must resolve directly rather than returning a 30x redirect.

- **Rule ID:** POL-021
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy URL + terms URL`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-021/

## Why this rule exists

TCR forbids redirection on fetched URLs, so a link that bounces from http to https, or from a marketing path to a canonical one, can fail even though a human browser follows it invisibly. This is one of the least intuitive rejections because the link works perfectly when you click it.

## How to fix it

Submit the final canonical URL — the one you land on after every redirect — including https and any trailing path normalisation.

## Example of a compliant value

```text
Submit https://acmecoffee.com/privacy-policy rather than http://acmecoffee.com/privacy
```