10DLC rejection reasons · Critical
Privacy policy missing or does not mention SMS
Your website needs a privacy policy that explicitly says mobile opt-in data is not sold or shared. Missing that clause gets campaigns rejected.
Not sure this is your reason? Paste your rejection into the free lookup →
Rejection said “Privacy policy does not mention SMS or is missing the required data-sharing language”? Decode that exact wording →
Haven't submitted yet? Start your registration, the guided pre-submission flow →
Reviewers visit your website and look for a privacy policy that specifically addresses SMS. A general privacy policy is not enough. It has to state that mobile information collected through your opt-in is not sold or shared with third parties for marketing purposes. This has become one of the most enforced requirements, and a policy that never mentions SMS is a frequent rejection.
The clause should say what data you collect through the opt-in, confirm that mobile opt-in data is not shared or sold for marketing, and link back from your opt-in flow. If the privacy policy is not published on the live website, or the opt-in form does not link to it, the reviewer cannot verify it and the campaign fails.
To fix it, add an SMS-specific clause to your published privacy policy and link it from your opt-in, then resubmit. Cleared to Send generates a compliant SMS privacy clause you can drop into your policy.
The fix
Publish a privacy policy on the website that explicitly states SMS opt-in data is not shared/sold, and link it from the opt-in flow.
Paste your rejection and rebuild the package →Rejected on a specific provider?
Same reason, walked through for your provider's dashboard.
Common questions
What does a 10DLC SMS privacy clause need to say?
That mobile information collected through SMS opt-in is not sold or shared with third parties for marketing purposes, alongside your normal privacy disclosures. It must be published on your live site and linked from the opt-in.
Can I just use my existing privacy policy?
Only if it explicitly addresses SMS. A general privacy policy that never mentions text messaging or mobile opt-in data does not satisfy the requirement and will be rejected.