# POL-108 — The policy must describe what the business actually does

> The practices described in the policy must match what the site and the programme actually do.

- **Rule ID:** POL-108
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body vs observed site behaviour`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CTIA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-108/

## Why this rule exists

A policy that misdescribes the business is worse than a thin one: it is a public statement that is not true, which is an FTC deception question as well as a carrier one. The machine-checkable half of it is easy — a policy that says "we do not use cookies" while an analytics tag loads on every page — and that half is usually a generated document nobody reconciled with the site.

## How to fix it

Read the policy against what the site loads and what the programme does, and correct whichever is wrong. Done when every practice the document describes is one you can point at.

## Notes

Only partly decidable: a crawl can catch a cookie claim contradicted by a tracker, and nothing we fetch can confirm a retention period or an access control. The generation-side twin is POL-250; full verification is POL-107, which is a human question.