Privacy policy rejections: the SMS clause carriers require
Short answer
Your privacy policy must be public, name your business, explain what you collect and why, and say plainly that SMS opt-in data and consent are never shared with or sold to third parties. If the policy mentions sharing data anywhere, add Twilio's exact exclusion sentence.
What you'll see
| Where | Code | Wording |
|---|---|---|
| Twilio (10DLC) | 30908 | “Campaign vetting rejection - Compliant Privacy Policy Required” |
| Twilio (10DLC) | 30932 | “Campaign rejected: Privacy policy must disclose third-party data sharing” (raised when the policy shows opt-in data may be shared) |
| Twilio (both) | 30536 | “Privacy policy URL is missing, inaccessible, or empty” |
| Twilio (toll-free) | 30477 | “Toll Free rejection: Third-party information sharing not allowed” |
| Twilio (toll-free) | 30519 | “Toll Free rejection: Privacy policy required for personal data collection” |
| Telnyx, Bandwidth | 805 | Compliant privacy policy required: state that no mobile opt-in data is shared with third parties |
| The Campaign Registry | PRIVACY_POLICY | “No third-party sharing for marketing purposes is allowed. The privacy policy should match the brand information.” |
| Toll-free (Bandwidth, Sinch) | 1207 / 1502 / 1503 | “Privacy Policy URL is missing, inaccessible, or lacks content” / “Privacy Policy mentions sharing of personal data with third parties for marketing purposes” / “Opt-In Data Cannot Be Shared, Transferred, Rented, or Sold to Third Parties” |
Text in curly quotes is the provider's wording; the rest is our summary.
Why it happens
- No privacy policy, a broken link, or a page behind a login or cookie wall.
- A generic template that says you may share or sell information to “partners”, “affiliates” or “marketing partners”, with no exception for SMS data.
- The policy belongs to a different company (the web designer, the CRM, a franchisor) or names no business at all.
- The policy linked at the opt-in differs from the one in the registration.
- Lead-generation wording: buying, selling or distributing leads.
- For in-person or phone opt-ins at Bandwidth, the policy wasn't attached (DCA 809).
How to fix it
- Publish the policy on your own domain at a stable URL such as /privacy, titled “Privacy Policy”, naming the same business as your registration.
- Add an SMS section with Twilio's suggested sentence:
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
- If the policy mentions sharing data anywhere, add Twilio's verbatim toll-free clause:
All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
- Remove or qualify lead-selling, affiliate and “we may share with partners” language.
- Link the same policy URL in the opt-in disclosure and in the registration's privacy field.
- Check that the contact details in the policy match your brand registration.
Gets rejected
We may share your information with our partners and affiliates for marketing purposes.
Gets approved more often
SMS messaging: When you opt in to text messages, we collect your phone number and consent record to send the messages you requested. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
The HighLevel variant
HighLevel tells its customers their policy must include this exact language
: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
The subcontractor sentence is HighLevel's addition, so use it only if your platform asks for it. The policy generator has a toggle for it.
Check before you resubmit. Every rejection costs days, and often another $15 vetting fee. Paste your description, message flow, samples and policy text into the free preflight check, or generate a consistent set with the campaign builder.
Frequently asked questions
Do I need a separate SMS privacy policy?
No. A section titled 'SMS' or 'Text messaging' in your main privacy policy is enough, as long as it's on the URL you register and link at the opt-in. Twilio suggests messaging-specific policies, so a separate page also works.
My policy says we share data with service providers. Is that a problem?
Not by itself, but add the exclusion sentence: 'All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.' Twilio's toll-free guide requires it verbatim whenever the policy mentions sharing in any capacity.
Can I use a privacy policy generator?
Yes, but generic generators usually include sharing language that triggers rejections. Add the SMS section afterwards and read the whole policy for 'share', 'sell', 'affiliate' and 'partners'.
Is a privacy policy required in The Campaign Registry?
The privacy link field is optional in TCR's API, but the spec says having a compliant privacy policy is required, and Twilio has required the URL on API-created 10DLC campaigns since June 30, 2026 (error 30933).
Sources
- Twilio: A2P 10DLC Campaign Onboarding Guide (updated 2026-09-24)
- Twilio: Toll-Free Verification Onboarding Guide (updated 2026-09-24)
- Twilio error 30908 (accessed 2026-10-03)
- Twilio error 30932 (accessed 2026-10-03)
- Twilio error 30536 (accessed 2026-10-03)
- Twilio error 30477 (accessed 2026-10-03)
- Bandwidth: DCA2 vetting rejection reasons (2026-03-17)
- Bandwidth: Toll-free verification rejection reasons (modified 2026-09-15)
- The Campaign Registry: CSP API OpenAPI spec (accessed 2026-10-03)
- HighLevel: How to get your phone number A2P approved in 2026 (modified 2026-07-30)
- Twilio changelog: 10DLC campaigns will require privacy policy and terms URLs (published 2026-04-06)
Rules change often and providers sometimes disagree; where they do, this page says so. This is general information, not legal advice, and no one can guarantee approval. See the disclaimer.
Related problems
- Twilio 30882, 30493, 30557-30564 · TCR TERMS_AND_CONDITIONS · TF 1206, 1504-1512Terms and conditions rejected: the SMS terms checklist (Twilio 30557-30564)
- Twilio 30493, 30536, 30817 · TF 1206, 1207Toll-free verification now requires separate Privacy Policy and Terms URLs (Sep 15, 2026)
- MESSAGE_FLOW · Twilio 30909, 30896, 30917, 30924 · DCA 806MESSAGE_FLOW rejection: fix an opt-in the reviewer can't verify
- Twilio 30951, 30932, 30468, 30916 · DCA 708 · Proxy 7002Rejected for lead generation or affiliate marketing (Twilio 30951, DCA 708)
The Approval Kit adds industry template packs, opt-in and policy page templates, and an agency checklist.