{
  "id": "WEB-054",
  "slug": "web-054",
  "title": "A brand with a website must publish its policies as web pages, not as PDFs",
  "statement": "Where the brand has a website, the privacy policy and terms URLs must serve an HTML page rather than a PDF or other downloadable file.",
  "rationale": "Vetters read policy pages with a text fetcher, and a PDF frequently comes back as an empty body — so a complete, correct policy is scored as a missing one. It also breaks the consumer path the rules exist to protect: a phone that downloads a file instead of showing a page is a dead end at exactly the moment someone is deciding whether to consent.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "Content-Type of privacyPolicyUrl and termsOfServiceUrl",
  "severity": "MEDIUM",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "TCR",
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "7102",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Publish the policy as an HTML page on the brand domain and submit that URL; keep the PDF as an extra download if you want one. Done when the policy URL returns text/html.",
  "example": "privacy_policy_url: https://acmecoffee.com/privacy (text/html), not https://acmecoffee.com/files/privacy.pdf",
  "pitfalls": [
    "Uploading a PDF is the sanctioned route for a brand with NO website — this rule only fires when a site exists, and swapping a working page for a file to satisfy a provider that accepts uploads makes things worse."
  ],
  "notes": "Absorbs POL-019, the same warning stated from the policy-page side. The catalog marks the underlying source unverified — inferred from Twilio 7102 rather than published as a rule — so it is graded MEDIUM and worded as an expectation rather than a refusal.",
  "catalogIds": [
    "POL-019"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/website/web-054/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-054.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}