{
  "id": "POL-242",
  "slug": "pol-242",
  "title": "Never assert a fact about the business nobody has confirmed",
  "statement": "A generated document must assert no fact about the business — retention periods, encryption, sub-processors, certifications, jurisdictions — that has not been sourced or confirmed by the user.",
  "rationale": "Every invented fact in a privacy policy is a public representation the business will be held to, and the ones a generator reaches for are exactly the ones nobody checks: a thirty-day retention period, AES-256 at rest, a SOC 2 report that does not exist. The FTC treats a false privacy claim as a deceptive practice, so this is the one obligation in the layer where the consequence is an enforcement action rather than a rejection.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "generated policy factual assertions",
  "severity": "BLOCKING",
  "detectability": [
    "HUMAN"
  ],
  "failureClass": "TERMINAL_EVIDENCE",
  "authorities": [
    "FTC",
    "TCR"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Confirm each factual claim with the person who would know — retention with whoever runs the database, encryption with whoever runs the infrastructure, certifications with whoever holds the audit report — and delete the ones nobody can confirm. Done when every specific in the document traces to somebody who said it.",
  "notes": "Nothing in a registration reveals whether a claim was confirmed, which is why this cannot be settled here. The user has to read the generated document as a set of assertions about their own business and strike out everything they cannot personally source. Invented SOC 2, ISO 27001 and HIPAA claims are the specific ones the research names.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Can you name a person who confirmed each specific claim in this document — retention periods, encryption, sub-processors, certifications?",
    "howToCheck": [
      "Read the document as a list of assertions about your own business.",
      "For each specific, ask the person who would know: retention with whoever runs the database, encryption with whoever runs the infrastructure, certifications with whoever holds the audit report.",
      "Delete every claim nobody can source. Invented SOC 2, ISO 27001 and HIPAA claims are the named ones."
    ],
    "failureLooksLike": "A thirty-day retention period and AES-256 at rest arrive in the draft because they are plausible. The FTC treats a false privacy claim as a deceptive practice, so the consequence is an enforcement action rather than a rejection."
  },
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-242/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-242.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}