The policy must describe its security safeguards at a high level
The requirementstatement
The privacy policy must describe the safeguards protecting the information, at least at a high level.
- Severityseverity
- MediumMEDIUMUsually survives review, but lowers your trust score or invites a manual look you would rather avoid.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- privacy policy body
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Fix the policyTERMINAL_POLICY
- The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
- Who requires itauthorities
- CTIAMessageDesk
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
CTIA asks senders to describe how information is protected, and the value to the consumer is a signal that somebody thought about it at all. The trap is the opposite of omission: a generated policy that invents a certification the business does not hold turns a missing sentence into a false statement, which is a much worse position.
How to fix itremediation
Describe the measures you actually have in one or two sentences, and name no standard you have not been audited against. Done when everything the section claims is true of your systems today.
A compliant exampleexample
We encrypt data in transit and at rest, and limit access to the numbers in the text programme to the staff who operate it.
Common mistakespitfalls
- Do not name a compliance standard to fill the section. POL-242 exists because invented certifications are the specific failure this section attracts.
Rules you will hit next
6 other rules read privacy policy body. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.
POL-050Privacy policy must state mobile opt-in data is not shared or soldBlockingBLOCKINGPOL-063A policy that says mobile opt-in data is shared is refused outrightBlockingBLOCKINGPOL-078A political brand is held to the same data-sharing banBlockingBLOCKINGPOL-079A charity policy must bar anyone but the charity from using subscriber dataBlockingBLOCKINGPOL-109A cart-reminder programme must say how abandonment is detectedBlockingBLOCKINGPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGH
POL-105 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.