# POL-126 — The policy must say whether data was sold or shared in the last 12 months

> The privacy policy must state whether personal information was sold or shared in the preceding twelve months, or affirmatively that it was not.

- **Rule ID:** POL-126
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-126/

## Why this rule exists

The statute wants a yes or a no, and the answer is read by carriers as a statement about the business model rather than as a compliance artefact. A business that says yes for its advertising data and never carves out the messaging data has contradicted its own non-sharing clause in the most explicit way available.

## How to fix it

State the answer plainly and, where it is yes, exclude messaging opt-in data from it in the same paragraph. Done when the twelve-month statement cannot be read as covering the text programme.

## Example of a compliant value

```text
In the last 12 months we have not sold or shared personal information. Text messaging opt-in data and consent are never sold or shared in any case.
```

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth | `7103` | yes |

## Notes

Must not contradict the non-sharing clause; where it does, POL-066 reports the contradiction.