# POL-137 — Other state-law addenda are needed where thresholds are met

> Where the business meets the applicability threshold of another US state privacy statute, the policy must carry that state's addendum.

- **Rule ID:** POL-137
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy state addenda`
- **Severity:** LOW — Best practice. Worth fixing, rarely fatal on its own.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** External record we cannot query — reported as a warning to verify
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** State law
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-137/

## Why this rule exists

A dozen states now have their own thresholds based on resident counts and revenue, and crossing one is invisible from inside the business — nobody gets a letter. The addenda are close enough to each other that adding them is cheap, and the cost of missing one falls on a consumer whose rights simply do not appear in the document.

## How to fix it

Count residents by state against each statute's threshold once a year, and add the addendum for any state you have crossed. Done when the document covers every regime the business is actually in.

## Check this yourself

**Have you counted residents by state and revenue against each state privacy statute's threshold in the last year?**

1. Pull the numbers: consumers by state, and annual revenue.
2. Compare against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds.
3. Add the addendum for any state you have crossed. They are close enough to each other that adding them is cheap.

*What wrong looks like:* Crossing a threshold is invisible from inside the business — nobody gets a letter. The cost falls on a consumer whose rights simply do not appear in the document.

## Notes

Deciding this needs a count of consumers by state and a revenue figure, neither of which the registration carries and neither of which we can look up. The user has to check their own numbers against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds; the catalog records the 10DLC relevance as none, so this is a legal exposure rather than a registration risk.