# WEB-054 — A brand with a website must publish its policies as web pages, not as PDFs

> Where the brand has a website, the privacy policy and terms URLs must serve an HTML page rather than a PDF or other downloadable file.

- **Rule ID:** WEB-054
- **Layer:** Website (`WEBSITE`)
- **Checks:** `Content-Type of privacyPolicyUrl and termsOfServiceUrl`
- **Severity:** MEDIUM — Usually survives review, but lowers your trust score or invites manual review.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** TCR, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/website/web-054/

## Why this rule exists

Vetters read policy pages with a text fetcher, and a PDF frequently comes back as an empty body — so a complete, correct policy is scored as a missing one. It also breaks the consumer path the rules exist to protect: a phone that downloads a file instead of showing a page is a dead end at exactly the moment someone is deciding whether to consent.

## How to fix it

Publish the policy as an HTML page on the brand domain and submit that URL; keep the PDF as an extra download if you want one. Done when the policy URL returns text/html.

## Example of a compliant value

```text
privacy_policy_url: https://acmecoffee.com/privacy (text/html), not https://acmecoffee.com/files/privacy.pdf
```

## Common mistakes

- Uploading a PDF is the sanctioned route for a brand with NO website — this rule only fires when a site exists, and swapping a working page for a file to satisfy a provider that accepts uploads makes things worse.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Twilio | `7102` | yes |

## Notes

Absorbs POL-019, the same warning stated from the policy-page side. The catalog marks the underlying source unverified — inferred from Twilio 7102 rather than published as a rule — so it is graded MEDIUM and worded as an expectation rather than a refusal.