# POL-131 — The policy must describe how opt-out preference signals are handled

> The privacy policy must describe how it honours browser opt-out preference signals such as Global Privacy Control.

- **Rule ID:** POL-131
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-131/

## Why this rule exists

California requires the signal to be honoured, and the disclosure is how a consumer who has set it knows whether it reached anyone. It carries no direct 10DLC weight, and it sits beside the sections that do — so the cost of adding it is a sentence and the cost of leaving it out is a gap in a document reviewers read end to end.

## How to fix it

Add a sentence stating that the signal is recognised and what it does. Done when a reader who has set GPC knows what your site does about it.

## Example of a compliant value

```text
We recognise the Global Privacy Control signal and treat it as a request to stop sharing your personal information.
```