{
  "id": "POL-107",
  "slug": "pol-107",
  "title": "The policy must be consistent with applicable privacy law",
  "statement": "The privacy policy must be consistent with the privacy law that applies to the business.",
  "rationale": "CTIA requires it, and which law applies turns on where the customers are, what is collected and how large the business is — none of which a document check can establish. The consequence of getting it wrong is a regulator rather than a carrier, so it is the one requirement in this layer where passing the registration is not the point.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy body",
  "severity": "HIGH",
  "detectability": [
    "HUMAN"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "CTIA"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Have the policy reviewed by someone who knows which statutes apply to your business, before publishing rather than after a complaint. Done when a reviewer has confirmed the applicable regimes are covered.",
  "notes": "Not machine-decidable and not something the registry should pretend to settle. The individual statutory elements this layer does check — the CCPA sections, the GDPR addendum, the COPPA sections — are a floor rather than a legal opinion, and the user has to route the document to counsel for the rest.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Has someone who knows which privacy statutes apply to this business read the policy?",
    "howToCheck": [
      "Establish which regimes are in play: where the customers are, what is collected, and how large the business is.",
      "Route the document to counsel or a qualified privacy adviser before publishing, not after a complaint.",
      "Treat the CCPA, GDPR and COPPA sections this registry checks as a floor, not a legal opinion."
    ],
    "failureLooksLike": "The document passes every automated check and misses the regime the business is actually in. The consequence here is a regulator rather than a carrier, so approval of the registration is not the point."
  },
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-107/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-107.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}