{
  "id": "POL-137",
  "slug": "pol-137",
  "title": "Other state-law addenda are needed where thresholds are met",
  "statement": "Where the business meets the applicability threshold of another US state privacy statute, the policy must carry that state's addendum.",
  "rationale": "A dozen states now have their own thresholds based on resident counts and revenue, and crossing one is invisible from inside the business — nobody gets a letter. The addenda are close enough to each other that adding them is cheap, and the cost of missing one falls on a consumer whose rights simply do not appear in the document.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy state addenda",
  "severity": "LOW",
  "detectability": [
    "EXTERNAL_DATA"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "State law"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Count residents by state against each statute's threshold once a year, and add the addendum for any state you have crossed. Done when the document covers every regime the business is actually in.",
  "notes": "Deciding this needs a count of consumers by state and a revenue figure, neither of which the registration carries and neither of which we can look up. The user has to check their own numbers against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds; the catalog records the 10DLC relevance as none, so this is a legal exposure rather than a registration risk.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Have you counted residents by state and revenue against each state privacy statute's threshold in the last year?",
    "howToCheck": [
      "Pull the numbers: consumers by state, and annual revenue.",
      "Compare against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds.",
      "Add the addendum for any state you have crossed. They are close enough to each other that adding them is cheap."
    ],
    "failureLooksLike": "Crossing a threshold is invisible from inside the business — nobody gets a letter. The cost falls on a consumer whose rights simply do not appear in the document."
  },
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-137/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-137.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}