A brand with a website must publish its policies as web pages, not as PDFs
The requirementstatement
Where the brand has a website, the privacy policy and terms URLs must serve an HTML page rather than a PDF or other downloadable file.
- Severityseverity
- MediumMEDIUMUsually survives review, but lowers your trust score or invites a manual look you would rather avoid.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- Content-Type of privacyPolicyUrl and termsOfServiceUrl
- Where it liveslayer
- WebsiteWEBSITE
- How Ekas settles itdetectability
- DeterministicDETERMINISTIC
- Settled in code from the values you submitted. No model involved, no judgement call, same answer every time.
- What the fix involvesfailureClass
- Fix the fieldRETRY_FIELD
- A better value in the form fixes it. Ekas can rewrite it and re-check.
- Who requires itauthorities
- TCRTwilio
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
Vetters read policy pages with a text fetcher, and a PDF frequently comes back as an empty body — so a complete, correct policy is scored as a missing one. It also breaks the consumer path the rules exist to protect: a phone that downloads a file instead of showing a page is a dead end at exactly the moment someone is deciding whether to consent.
How to fix itremediation
Publish the policy as an HTML page on the brand domain and submit that URL; keep the PDF as an extra download if you want one. Done when the policy URL returns text/html.
A compliant exampleexample
privacy_policy_url: https://acmecoffee.com/privacy (text/html), not https://acmecoffee.com/files/privacy.pdf
Common mistakespitfalls
- Uploading a PDF is the sanctioned route for a brand with NO website — this rule only fires when a site exists, and swapping a working page for a file to satisfy a provider that accepts uploads makes things worse.
Provider rejection codescodes
The code you get back when this rule is what failed, and whether that provider lets you resubmit.
| Provider | Code | Resubmit |
|---|---|---|
| Twilio | 7102 | Yes |
Notesnotes
Absorbs POL-019, the same warning stated from the policy-page side. The catalog marks the underlying source unverified — inferred from Twilio 7102 rather than published as a rule — so it is graded MEDIUM and worded as an expectation rather than a refusal.
Rules you will hit next
Other website rules at the same severity. A registration is judged as a whole, not rule by rule.
WEB-004The website value must fit the provider field limitMediumMEDIUMWEB-006The website should sit on a custom domainMediumMEDIUMWEB-015Pages the registration points at must not be brokenMediumMEDIUMWEB-044The footer should carry a phone number, an email and a street addressMediumMEDIUMWEB-074Pages must not load sub-resources over HTTPMediumMEDIUMWEB-083Hosting shared with malicious neighbours is scored against the domainMediumMEDIUM
WEB-054 is one of 93 website rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.