# POL-066 — CCPA sold/shared disclosure must exclude phone numbers and SMS consent

> Where the policy carries a CCPA "categories of personal information sold or shared" table, it must explicitly exclude phone numbers and SMS consent data.

- **Rule ID:** POL-066
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy CCPA disclosure`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** TCR, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-066/

## Why this rule exists

Ranked #5 most-missed. A CCPA table listing "identifiers" as sold or shared directly contradicts the non-sharing promise, because a phone number is an identifier. Businesses complying carefully with California law thereby create a 10DLC rejection, and the fix is a carve-out rather than a removal.

## How to fix it

Add an explicit exclusion beneath the CCPA table so the two disclosures do not contradict each other.

## Example of a compliant value

```text
All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
```