Two pages, two jobs
Your privacy policy says what you do with customers' information, including their phone number and their consent. Your terms say how your text program works. Reviewers want both published on your website and linked from wherever customers opt in.
What the privacy policy needs
- A section that names text messaging
- What you collect through the opt-in: phone number, a record of consent, and the messages you send
- That you use it only to send the texts customers signed up for
- That you don't sell or share mobile numbers or SMS consent with third parties for their marketing
- How to opt out (reply STOP) and how to reach you
Here is an SMS section you can adapt:
Text messaging. If you opt in to text messages from [Business Name], we collect your mobile number and a record of your consent. We use this information only to send the messages you signed up for, such as [appointment reminders and account updates]. We do not sell, rent, or share your mobile number or SMS consent with third parties or affiliates for their marketing or promotional purposes. You can opt out at any time by replying STOP. For help, reply HELP or contact us at [email or phone].
The sentence that trips people up
Most privacy templates have a section about sharing data with partners or service providers. Read on its own, that can sound like you share phone numbers with marketers, and reviewers reject it. Add a sentence that carves SMS out of every sharing clause:
The sharing described above excludes text messaging originator opt-in data and consent. This information will not be shared with any third parties.
Reviewers care that consent given to your business stays with your business. If any line elsewhere in the policy says you may share contact details with partners, lead buyers, or affiliates, the carve-out has to cover it.
What the terms need
- Your program name, like "Bright Smile Dental Reminders"
- What you send and how often. "Message frequency varies" is fine.
- "Msg & data rates may apply"
- How to get help: reply HELP, plus a phone number or email
- How to stop: reply STOP to cancel
- A link to your privacy policy
Here is a terms section you can adapt:
SMS Terms. [Program name]: By opting in, you agree to receive [appointment reminders and account updates] from [Business Name] at the number you provided. Message frequency varies. Msg & data rates may apply. Reply HELP for help or contact [email or phone]. Reply STOP to cancel at any time; you will receive one final message confirming you are unsubscribed. Consent is not a condition of purchase. See our Privacy Policy at [link].
Where they go and how reviewers check
- Publish both as normal pages on your website, reachable without a login
- Link both from your opt-in form, keyword sign, or paper form
- Put both URLs in your campaign registration
- Use the same business name your registration uses
- Remove any line about sharing phone numbers or consent with partners, lead buyers, or affiliates
This is general guidance, not legal advice. If you handle health, financial, or children's data, have someone qualified review the whole policy. Clear writes an SMS privacy clause and terms section for your business as part of your registration package.
Common questions
Do I need a separate SMS privacy policy?
No. Add an SMS section to your existing privacy policy. What matters is that it names text messaging and says you don't share mobile numbers or consent for marketing.
Do I need terms and conditions for 10DLC?
Yes. Reviewers look for public terms that cover your text program: what you send, how often, rates, HELP, and STOP. On Twilio, failing this check comes back as error 30882.
Can I use a privacy policy generator?
Yes, as a starting point. Most generators don't add SMS language, so add the SMS section and the sharing carve-out yourself, then check that nothing elsewhere in the policy contradicts them.
Where do I link my privacy policy for 10DLC?
From your opt-in, so customers can read it before they agree, and in the campaign registration itself. It has to be on your live website, reachable without logging in.