An explicit SMS opt-in carve-out belongs in the policy either way

JSONMarkdown

The requirementstatement

The policy must carry an explicit sentence excluding SMS opt-in data and consent from any sharing, whether or not it discloses sharing elsewhere.

Severityseverity
BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
When it bitesphase
Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject
privacy policy carve-out sentence
Where it liveslayer
Policy pagesPOLICY_PAGE
How Ekas settles itdetectability
AI · formAI_FORM
A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
What the fix involvesfailureClass
Fix the policyTERMINAL_POLICY
The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
Who requires itauthorities
InfobipBirdTelnyxAerialinkAWS
When it appliesapplicabilityText
Applies to every 10DLC registration.

Why this rule existsrationale

Reviewers grep for this sentence, so a policy that is silent about sharing gets no credit for its silence — the absence of a bad clause is not the presence of the promise. Telnyx publishes the exact wording, which is a strong hint that what is being checked is the formulation rather than the sentiment, and paraphrases that soften it routinely fail.

How to fix itremediation

Paste the published carve-out sentence immediately after whatever the policy says about sharing — or, in a policy that discloses none, at the end of the data-collection section. Done when the words "text messaging originator opt-in data and consent" appear in the document.

A compliant exampleexample

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Common mistakespitfalls

  • Placing the sentence in a section of its own, far from the sharing disclosure, weakens it: the point is that it visibly overrides the categories immediately above it.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

ProviderCodeResubmit
Bandwidth/DCA852Yes

Notesnotes

Absorbs POL-075, which states the same requirement for a policy that discloses no sharing at all. The sentence to add is identical in both cases, which is why they are one obligation.

Rules you will hit next

Other policy pages rules at the same severity. A registration is judged as a whole, not rule by rule.

POL-001A privacy policy URL is required on the campaignBlockingBLOCKINGPOL-002A terms and conditions URL is required on the campaignBlockingBLOCKINGPOL-003An uploaded policy document must fit the provider file constraintsBlockingBLOCKINGPOL-005The terms and conditions attestation must be setBlockingBLOCKINGPOL-010Both policy URLs must resolve and return content anonymouslyBlockingBLOCKINGPOL-015The policy host must serve a valid certificate of its ownBlockingBLOCKING

All policy pages rules

POL-074 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.

Reading the rules is the easy part.

Ekas runs every rule that gates approval, 823 of these 915, against your registration before it reaches the carrier. It reads your site, your policy pages and your opt-in the way a reviewer would, and hands you the fix, not just the verdict.

Talk to UsHow 10DLC works