A Do-Not-Sell link must not appear to reopen the SMS carve-out
The requirementstatement
Where the brand publishes a "Do Not Sell or Share My Personal Information" link, the policy must make clear that the SMS exclusion applies regardless.
- Severityseverity
- HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- privacy policy body + Do-Not-Sell link
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Fix the policyTERMINAL_POLICY
- The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
- Who requires itauthorities
- CCPATwilio
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
The link is an admission that the business sells or shares something, and a reviewer who finds it reads the messaging carve-out as one of the things a consumer must opt out of rather than as a promise already made. Businesses publishing it are complying carefully with California law, which is what makes this trap so unfair: the more diligent the CCPA work, the more likely the 10DLC rejection.
How to fix itremediation
State next to the Do-Not-Sell disclosure that messaging opt-in data is never sold or shared and is therefore outside the request entirely. Done when a reader can see the exclusion holds without submitting anything.
A compliant exampleexample
We honour Do Not Sell or Share requests for the categories listed above. Text messaging opt-in data and consent are never sold or shared in any case, so no request is needed for them.
Provider rejection codescodes
The code you get back when this rule is what failed, and whether that provider lets you resubmit.
| Provider | Code | Resubmit |
|---|---|---|
| Bandwidth | 7103 | Yes |
Notesnotes
Conditional on the brand publishing the link, which no applicability dimension expresses; the criteria pass immediately where no such link exists. The catalog records the rule as a research judgement grounded in CCPA §7011 and Twilio 30932 rather than as published vendor wording.
Rules you will hit next
Other policy pages rules at the same severity. A registration is judged as a whole, not rule by rule.
POL-021Policy URLs must not redirectHighHIGHPOL-023A social profile is not a policy pageHighHIGHPOL-025Exactly one privacy policy must be discoverableHighHIGHPOL-026The policy on the site and the policy attached to the registration must agreeHighHIGHPOL-030Both documents must be linked from the site footer on every pageHighHIGHPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGH
POL-067 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.