{
  "id": "POL-023",
  "slug": "pol-023",
  "title": "A social profile is not a policy page",
  "statement": "A social-media profile or post must not be submitted as the privacy policy or terms URL where the brand has a website.",
  "rationale": "A profile page is not a document: it has no stable URL for a specific text, no version, and no guarantee the platform will show the same thing to a logged-out reviewer. Businesses do it because they published their terms as a pinned post and that is the only link they have, which is exactly the situation the fix addresses.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy URL + terms URL host",
  "severity": "HIGH",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "TCR"
  ],
  "codes": [
    {
      "provider": "Bandwidth",
      "code": "1100",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Publish the policy as a page on the brand website and submit that URL. Done when the policy URL opens a document on your own domain rather than a profile on somebody else's.",
  "example": "privacy_policy_url: https://acmecoffee.com/privacy, not https://facebook.com/acmecoffee/about",
  "notes": "Single secondary source in the catalog with no carrier code behind it, so HIGH rather than BLOCKING. Fires only where a website exists — a brand with no site at all should upload the document instead, which is POL-003.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-023/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-023.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}