The policy must say how to exercise those rights
The requirementstatement
The privacy policy must give instructions for exercising consumer rights, including submission methods, verification and authorised agents.
- Severityseverity
- HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- privacy policy body
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · crawlCRAWL
- Needs your live site or policy page fetched and read. Ekas crawls it the way a reviewer would.
- What the fix involvesfailureClass
- Fix the policyTERMINAL_POLICY
- The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
- Who requires itauthorities
- CCPA
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
A list of rights with no route to exercise them is the commonest way a policy looks compliant and does nothing — the consumer knows what they are entitled to and not who to ask. The verification step in particular has to be described in advance, because a business that invents an identity check when a request arrives looks like it is refusing.
How to fix itremediation
Give the submission routes, the verification step and the agent route in the rights section itself. Done when a reader can start a request from the policy without hunting.
A compliant exampleexample
To make a request, email privacy@acmecoffee.com or call 415-555-0134. We will ask for the email address or mobile number on your account to verify it is you. An authorised agent may act for you with your written permission.
Rules you will hit next
6 other rules read privacy policy body. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.
POL-050Privacy policy must state mobile opt-in data is not shared or soldBlockingBLOCKINGPOL-063A policy that says mobile opt-in data is shared is refused outrightBlockingBLOCKINGPOL-078A political brand is held to the same data-sharing banBlockingBLOCKINGPOL-079A charity policy must bar anyone but the charity from using subscriber dataBlockingBLOCKINGPOL-109A cart-reminder programme must say how abandonment is detectedBlockingBLOCKINGPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGH
POL-135 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.