Privacy policy must state mobile opt-in data is not shared or sold

JSONMarkdown

The requirementstatement

The privacy policy must explicitly state that mobile information and SMS consent are not shared or sold to third parties or affiliates for marketing.

Severityseverity
BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
When it bitesphase
Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject
privacy policy body
Where it liveslayer
Policy pagesPOLICY_PAGE
How Ekas settles itdetectability
AI · crawlCRAWL
Needs your live site or policy page fetched and read. Ekas crawls it the way a reviewer would.
What the fix involvesfailureClass
Fix the policyTERMINAL_POLICY
The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
Who requires itauthorities
TCRTwilioT-MobileBandwidthAWSTelnyx
When it appliesapplicabilityText
Applies to every 10DLC registration.

Why this rule existsrationale

This is the single most frequently cited cause of 10DLC rejection in the entire corpus. Carriers require it because SMS consent is non-transferable: the clause is the written promise that the number you collected will not become someone else's marketing list. Note it is a carrier and TCR requirement, not a CTIA one — CTIA never asks for this sentence, so guidance attributing it there is wrong and leads people to skip it.

How to fix itremediation

Add an explicit mobile-data clause to the privacy policy. Paste the language below verbatim — reviewers look for this specific formulation, and paraphrases that soften "will not be shared" routinely fail.

A compliant exampleexample

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

ProviderCodeResubmit
Twiliogen130908Yes
Twiliogen230932Yes

Rules you will hit next

6 other rules read privacy policy body. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.

POL-063A policy that says mobile opt-in data is shared is refused outrightBlockingBLOCKINGPOL-078A political brand is held to the same data-sharing banBlockingBLOCKINGPOL-079A charity policy must bar anyone but the charity from using subscriber dataBlockingBLOCKINGPOL-109A cart-reminder programme must say how abandonment is detectedBlockingBLOCKINGPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGHPOL-061The non-sharing prohibition must hold even with consumer consentHighHIGH

All policy pages rules

POL-050 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.

Reading the rules is the easy part.

Ekas runs every rule that gates approval, 823 of these 915, against your registration before it reaches the carrier. It reads your site, your policy pages and your opt-in the way a reviewer would, and hands you the fix, not just the verdict.

Talk to UsHow 10DLC works