# POL-134 — The policy must enumerate the CCPA consumer rights

> The privacy policy must enumerate the CCPA and CPRA consumer rights.

- **Rule ID:** POL-134
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-134/

## Why this rule exists

The rights section is what turns a policy from a description into something a consumer can act on, and California requires the specific list rather than a summary. For a messaging programme it also carries the deletion right, which is the one people exercise after they unsubscribe and find they are still on file.

## How to fix it

List all six rights explicitly. Done when each appears by name rather than being implied by a general statement.

## Example of a compliant value

```text
You have the right to know what we hold, to delete it, to correct it, to opt out of its sale or sharing, to limit our use of sensitive information, and not to be treated differently for exercising any of these.
```