Explain SMS data and its purpose
Explain how you use mobile numbers and SMS opt-in/consent data. The policy should describe your real messaging program rather than relying only on a generic personal-information clause.
A2P 10DLC privacy policy requirements
Start with a public policy that accurately explains your SMS data practices. Twilio's guidance includes mobile-data non-sharing, message frequency, and a message-and-data-rates disclosure. Use this review checklist to find gaps before submitting—not as a substitute for legal advice.
Guidance only — not legal advice or an approval guarantee. A2PCheck is independent of Twilio, The Campaign Registry, and carriers. Consult a lawyer for your specific obligations.
Review these policy elements
The mobile-data, frequency, rates, and accessibility checks below reflect the linked Twilio guidance. The service-provider, contact, and date checks help keep the policy clear and accurate; they are not an exhaustive legal checklist. Already reviewed your wording? Jump to the campaign scanner.
State the mobile-data non-sharing restriction
Twilio's guidance calls for a statement that mobile information is not shared with third parties or affiliates for marketing or promotional purposes. Check that broad partner-sharing clauses elsewhere do not contradict your SMS disclosure. Change the actual practice if necessary; do not publish a promise you cannot keep.
Include frequency and rates
Twilio's current collection guide includes message frequency and a 'message and data rates may apply' disclosure among policy expectations. State the frequency that is accurate for your program and keep it consistent with your opt-in form and terms.
Check actual service-provider use
For a clear, accurate policy, distinguish providers that process numbers to operate your messaging service from third parties using data for their own marketing. Describe only arrangements your business actually has.
Opt-out / data access rights
Describe how a user can stop messages (Reply STOP) and how they can request access or deletion of their data. Provide a contact method.
Effective date and version
Keep an honest effective or updated date and revisit the policy when your data practices change. This is useful policy maintenance, not a claim that adding a date alone satisfies provider review or privacy law.
Publicly reachable URL
Open the exact submitted policy URL in a signed-out browser. Reviewers must be able to read the policy without an account. Check that redirects, access controls, or broken links do not hide it, and link it from the opt-in surface.
Vague wording vs. an explicit SMS section
Fictional weak clause: “We may share contact information with our partners.” It does not explain SMS consent data or whether partners can use mobile numbers for their own marketing. A general clause elsewhere in the policy can also contradict an otherwise clear SMS section.
The fictional excerpt below illustrates a more specific explanation—not an approved policy, a customer document, or a complete legal template. Use it only if every statement matches your actual program and agreements; confirm the frequency and contact details rather than copying them as facts.
SMS / Text Messaging — fictional illustration When you actively opt in, Acme uses your mobile number and consent record to send you Acme promotional texts, up to four per month. Message and data rates may apply. We do not share mobile information, including SMS opt-in and consent data, with third parties or affiliates for marketing or promotional purposes. Service providers may process phone numbers only to operate and deliver our SMS service, under contractual confidentiality. Reply STOP to stop messages or HELP for help. For privacy questions, contact [email protected].
Need a broader starting document? See the existing SMS privacy policy template and have the final policy reviewed for your business and jurisdiction.
What gets flagged
- Privacy policy at a Notion / Google Doc URL behind a login.
- "We may share information with partners" with no carve-out for phone numbers.
- No mention of SMS or text messaging anywhere in the document.
- Disclosure wording that contradicts the actual messaging frequency or data-sharing practices.
- Policy auto-generated by a template that doesn't reference your actual data flow.
If your provider already cited a policy issue, use the privacy-policy rejection guide to connect its wording to a specific repair.
Before you submit the policy URL
- Open the exact privacy and terms URLs while signed out; confirm they show your actual business policies.
- Compare the policy against the real consent form, data flow, message frequency, and service-provider agreements.
- Resolve any generic sharing clause that conflicts with the SMS-specific restriction.
- Check that the opt-in page links to the policy and terms. If the consent flow is private, follow your provider's instructions for publicly hosted evidence—not private subscriber records.
- Review description, samples, consent evidence, and URLs together before resubmitting.
See the opt-in flow checklist and resubmission checklist. Basic does not read your live policy; use a signed-in Full scan for URL analysis and review current prices and trial eligibility before spending credits.
Provider guidance and sources
Checked October 23, 2026: Twilio's business-information collection guide covers policy accessibility and messaging disclosures; its registration quickstart describes the mobile-data marketing-sharing restriction. For private opt-in evidence and separate, unchecked consent controls, see Twilio error 30925. Provider guidance may change and does not replace legal advice.
Frequently asked questions
Do I need a separate SMS privacy policy or can I use my existing one?
You can update an existing policy with accurate SMS disclosures rather than publishing a second competing policy. Check mobile-data non-sharing, frequency, rates, public accessibility, and consistency with your opt-in flow. This checklist is not a complete statement of your legal obligations.
Where should the privacy policy link from?
From the same page where the user opts in to SMS (e.g., your signup form, checkout, or keyword landing page), and from your site footer. Carriers may crawl the opt-in page and expect a working privacy link.
Can the policy live on a third-party domain?
Check your provider's current instructions. The policy must be publicly readable and clearly apply to your business. A document behind a login is not publicly accessible, regardless of who hosts it.
Does the free Basic scan read my live privacy policy?
No. Basic checks campaign text but does not fetch external policy or website pages. A signed-in Full scan uses two credits and checks public URLs when supplied. A scan is guidance, not a legal review or approval guarantee; current prices and trial eligibility are on the pricing page.
Is this legal advice?
No. This page describes what carriers and TCR reviewers commonly check for in A2P 10DLC reviews. It is not legal advice. Consult a lawyer for your specific privacy obligations.
Free — no signup required
Choose the right check for your policy
Basic is free without an account and checks campaign text, but does not fetch policy pages. Signed-in Basic scans use one credit. A Full scan uses two credits and checks public policy and website URLs when supplied. Neither scan proves legal compliance or guarantees approval.