# POL-135 — The policy must say how to exercise those rights

> The privacy policy must give instructions for exercising consumer rights, including submission methods, verification and authorised agents.

- **Rule ID:** POL-135
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy body`
- **Severity:** HIGH — Rejected by at least one carrier or provider, and a common cause of failure at the rest.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the crawled website or policy page
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** CCPA
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-135/

## Why this rule exists

A list of rights with no route to exercise them is the commonest way a policy looks compliant and does nothing — the consumer knows what they are entitled to and not who to ask. The verification step in particular has to be described in advance, because a business that invents an identity check when a request arrives looks like it is refusing.

## How to fix it

Give the submission routes, the verification step and the agent route in the rights section itself. Done when a reader can start a request from the policy without hunting.

## Example of a compliant value

```text
To make a request, email privacy@acmecoffee.com or call 415-555-0134. We will ask for the email address or mobile number on your account to verify it is you. An authorised agent may act for you with your written permission.
```