Other state-law addenda are needed where thresholds are met

The requirementstatement

Where the business meets the applicability threshold of another US state privacy statute, the policy must carry that state's addendum.

Severityseverity: LowLOWBest practice. Worth fixing, rarely fatal on its own.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: privacy policy state addenda
Where it liveslayer: Policy pagesPOLICY_PAGE
How Ekas settles itdetectability: External recordEXTERNAL_DATA; The fact that settles it lives in a register we cannot query, such as the IRS file, a postal database, or another provider’s tenant. Reported as a warning with the evidence to check, not as a pass.
What the fix involvesfailureClass: Fix the policyTERMINAL_POLICY; The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
Who requires itauthorities: State law
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

A dozen states now have their own thresholds based on resident counts and revenue, and crossing one is invisible from inside the business — nobody gets a letter. The addenda are close enough to each other that adding them is cheap, and the cost of missing one falls on a consumer whose rights simply do not appear in the document.

How to fix itremediation

Count residents by state against each statute's threshold once a year, and add the addendum for any state you have crossed. Done when the document covers every regime the business is actually in.

Check this yourselfattestation

No tool can settle this one for you. Here is the check, and what wrong looks like.

Have you counted residents by state and revenue against each state privacy statute's threshold in the last year?

1Pull the numbers: consumers by state, and annual revenue.
2Compare against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds.
3Add the addendum for any state you have crossed. They are close enough to each other that adding them is cheap.

What wrong looks like: Crossing a threshold is invisible from inside the business — nobody gets a letter. The cost falls on a consumer whose rights simply do not appear in the document.

Notesnotes

Deciding this needs a count of consumers by state and a revenue figure, neither of which the registration carries and neither of which we can look up. The user has to check their own numbers against the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and Delaware thresholds; the catalog records the 10DLC relevance as none, so this is a legal exposure rather than a registration risk.

Rules you will hit next

Other policy pages rules at the same severity. A registration is judged as a whole, not rule by rule.

POL-121The policy must say what it coversLowLOW POL-138The policy should offer an accessible alternative formatLowLOW POL-139The policy should be printableLowLOW POL-198STOP and HELP instructions must be legible — bold is not requiredLowLOW POL-203The terms should cover accounts and credentialsLowLOW POL-206A retail brand's terms should cover shipping and returnsLowLOW

All policy pages rules

POL-137 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.