# POL-122 — The policy must list the categories of personal information collected

> The privacy policy must list the categories of personal information collected, using the statutory category names.

- **Rule ID:** POL-122
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-122/

## Why this rule exists

California requires the statutory names rather than a plain-English list, and the same section answers Twilio's demand to know what customer data is collected — so it is one of the few CCPA elements that carries direct 10DLC weight. It is also the section that most often contradicts the messaging clause, because "identifiers" includes the phone number.

## How to fix it

List the statutory categories that apply and give an example of each in plain words alongside. Done when a reader sees both the legal category and what it means for them.

## Example of a compliant value

```text
Identifiers — including your name, email address and mobile phone number.
```

## Common mistakes

- This list feeds the sold-or-shared table two sections later. Whatever appears here must be excluded there for messaging data, or POL-066 fires on the contradiction.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio (gen1) | `30908` | yes |