A business that sells or shares must publish the Do-Not-Sell link
The requirementstatement
Where the business sells or shares personal information, the "Do Not Sell or Share My Personal Information" link must be published on the site.
- Severityseverity
- HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- site-wide Do-Not-Sell link
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · crawlCRAWL
- Needs your live site or policy page fetched and read. Ekas crawls it the way a reviewer would.
- What the fix involvesfailureClass
- Fix the websiteTERMINAL_WEBSITE
- The fix lives on your site. No amount of rewording the form clears it.
- Who requires itauthorities
- CCPA
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
California requires the link wherever the business does either, and its absence is a compliance failure in its own right. It is worth pairing with the messaging carve-out deliberately rather than by accident: publishing the link invites a reviewer to ask whether the messaging data is inside the request, which is the question POL-067 exists to answer in advance.
How to fix itremediation
Publish the link in the site footer and state next to it that messaging opt-in data is excluded from sale or sharing in any case. Done when the link is present and the exclusion is unambiguous.
Provider rejection codescodes
The code you get back when this rule is what failed, and whether that provider lets you resubmit.
| Provider | Code | Resubmit |
|---|---|---|
| Bandwidth | 7103 | Yes |
Notesnotes
Conditional on the business selling or sharing personal information, which no applicability dimension expresses; the criteria pass immediately where the policy discloses neither. Pair with POL-067 — publishing the link without the carve-out statement is the trap.
Rules you will hit next
Other policy pages rules at the same severity. A registration is judged as a whole, not rule by rule.
POL-021Policy URLs must not redirectHighHIGHPOL-023A social profile is not a policy pageHighHIGHPOL-025Exactly one privacy policy must be discoverableHighHIGHPOL-026The policy on the site and the policy attached to the registration must agreeHighHIGHPOL-030Both documents must be linked from the site footer on every pageHighHIGHPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGH
POL-136 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.