{
  "id": "POL-116",
  "slug": "pol-116",
  "title": "A written internal do-not-call policy must exist",
  "statement": "The business must maintain a written internal do-not-call policy and make it available on demand.",
  "rationale": "The FCC requires the written policy from anyone doing telemarketing-adjacent outreach, and \"available on demand\" means a consumer or a regulator can ask for it — so its absence surfaces at the worst possible moment. It is an internal document rather than a published one, which is why businesses that have every public policy in order still do not have this one.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "internal do-not-call policy document",
  "severity": "HIGH",
  "detectability": [
    "HUMAN"
  ],
  "failureClass": "TERMINAL_EVIDENCE",
  "authorities": [
    "FCC"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Write the internal policy — who maintains the list, how a request is recorded, how long entries are kept, how staff are trained — and be able to send it to anyone who asks. Done when a copy exists and someone owns it.",
  "notes": "Nothing in the registration reveals whether this document exists. The user has to confirm they hold one, and to know who would produce it if a consumer or the FCC asked. Where it is published on the site, a crawl can find it; where it is not, only the business knows.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Does a written internal do-not-call policy exist, and do you know who would produce it if a consumer or the FCC asked?",
    "howToCheck": [
      "Find the document. It is internal rather than published, which is why businesses with every public policy in order still do not have this one.",
      "Confirm it covers who maintains the list, how a request is recorded, how long entries are kept, and how staff are trained.",
      "Name the person who owns it."
    ],
    "failureLooksLike": "\"Available on demand\" means the absence surfaces at the worst possible moment — when a consumer or a regulator has already asked for it."
  },
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-116/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-116.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}