{
  "id": "POL-126",
  "slug": "pol-126",
  "title": "The policy must say whether data was sold or shared in the last 12 months",
  "statement": "The privacy policy must state whether personal information was sold or shared in the preceding twelve months, or affirmatively that it was not.",
  "rationale": "The statute wants a yes or a no, and the answer is read by carriers as a statement about the business model rather than as a compliance artefact. A business that says yes for its advertising data and never carves out the messaging data has contradicted its own non-sharing clause in the most explicit way available.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy body",
  "severity": "HIGH",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "CCPA"
  ],
  "codes": [
    {
      "provider": "Bandwidth",
      "code": "7103",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "State the answer plainly and, where it is yes, exclude messaging opt-in data from it in the same paragraph. Done when the twelve-month statement cannot be read as covering the text programme.",
  "example": "In the last 12 months we have not sold or shared personal information. Text messaging opt-in data and consent are never sold or shared in any case.",
  "notes": "Must not contradict the non-sharing clause; where it does, POL-066 reports the contradiction.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-126/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-126.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}