# POL-067 — A Do-Not-Sell link must not appear to reopen the SMS carve-out

> Where the brand publishes a "Do Not Sell or Share My Personal Information" link, the policy must make clear that the SMS exclusion applies regardless.

- **Rule ID:** POL-067
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body + Do-Not-Sell link`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-067/

## Why this rule exists

The link is an admission that the business sells or shares something, and a reviewer who finds it reads the messaging carve-out as one of the things a consumer must opt out of rather than as a promise already made. Businesses publishing it are complying carefully with California law, which is what makes this trap so unfair: the more diligent the CCPA work, the more likely the 10DLC rejection.

## How to fix it

State next to the Do-Not-Sell disclosure that messaging opt-in data is never sold or shared and is therefore outside the request entirely. Done when a reader can see the exclusion holds without submitting anything.

## Example of a compliant value

```text
We honour Do Not Sell or Share requests for the categories listed above. Text messaging opt-in data and consent are never sold or shared in any case, so no request is needed for them.
```

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth | `7103` | yes |

## Notes

Conditional on the brand publishing the link, which no applicability dimension expresses; the criteria pass immediately where no such link exists. The catalog records the rule as a research judgement grounded in CCPA §7011 and Twilio 30932 rather than as published vendor wording.