{
  "id": "POL-134",
  "slug": "pol-134",
  "title": "The policy must enumerate the CCPA consumer rights",
  "statement": "The privacy policy must enumerate the CCPA and CPRA consumer rights.",
  "rationale": "The rights section is what turns a policy from a description into something a consumer can act on, and California requires the specific list rather than a summary. For a messaging programme it also carries the deletion right, which is the one people exercise after they unsubscribe and find they are still on file.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy body",
  "severity": "HIGH",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "CCPA"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "List all six rights explicitly. Done when each appears by name rather than being implied by a general statement.",
  "example": "You have the right to know what we hold, to delete it, to correct it, to opt out of its sale or sharing, to limit our use of sensitive information, and not to be treated differently for exercising any of these.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-134/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-134.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}