10DLC website, privacy policy and terms requirements (with templates)

A large share of 10DLC campaign rejections have nothing to do with your messages. The reviewer opened your website, could not find a working privacy policy, SMS terms or a visible opt-in disclosure, and sent the campaign back. Fixing that usually takes an afternoon of editing pages. Leaving it unfixed costs another review cycle every time you resubmit.

This post lists what each page needs to say and gives you template language to copy. It also shows how to make your registration form match your site so the reviewer sees one consistent story. It is not legal advice. Have counsel review anything you publish, because compliance is ultimately the sender's responsibility. The templates below reflect what carrier reviewers commonly look for under CTIA guidelines.

Why reviewers check your website

A 10DLC campaign registration is a claim: "this brand collects consent this way and sends these messages." The reviewer cannot watch you collect consent. Your website is the evidence. They check three things:

1. The business is real and matches the brand. The legal name and the site belong to the same company.
2. Consent is collected properly. There is a visible place where someone opts in, with the required disclosures next to it.
3. Mobile data is protected. The privacy policy says phone numbers and opt-in data are not sold or shared for third-party marketing.

If any of the three is missing, the registration fails. Our guide to what carriers actually check covers the rest of the review. This post covers the web-page part.

The website checklist

Before you touch the policy wording, make sure the site itself passes:

• Live and on HTTPS. No "coming soon" page, no parked domain, no expired certificate.
• Brand name visible. The business name on the site matches, or clearly relates to, the legal name on the brand registration. If you trade under a DBA, show both somewhere, often in the footer.
• Contact information. At least a business email or phone number, and ideally a physical address.
• Privacy policy and terms linked from every page. Footer links are standard. The reviewer should not have to search for them.
• A visible opt-in path. That can be a web form, checkout checkbox or account signup. If consent happens offline, such as on paper at a front desk, describe it on the site or provide a screenshot or photo URL in the registration.
• Content matches the use case. A site that sells supplements while the campaign says "appointment reminders for a dental office" will get questions.

A social media page or a link-in-bio tool on its own often isn't enough. A simple one-page site with the items above usually is.

Privacy policy: the clause behind most rejections

Most privacy policies are generic templates that say something like "we may share information with partners." Reviewers read that as permission to sell phone numbers, and they reject it. You need an explicit SMS clause.

Template language:

SMS and mobile information. We collect your mobile phone number when you opt in to receive text messages from [Business Name]. We use it only to send the messages you agreed to receive and to respond to you. Mobile information, including phone numbers and SMS opt-in consent data, will not be shared with or sold to third parties or affiliates for marketing or promotional purposes. We may share information with service providers who help us deliver messages (such as our messaging platform and carriers), solely to provide the service. All other categories in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Two notes:

• Keep the "will not be shared" sentence even if the rest of your policy allows sharing. The last sentence above carves SMS data out of any broader sharing language elsewhere in the policy. That carve-out is what the reviewer is looking for.
• The policy has to be on your domain. A policy hosted on a generator's domain, or a PDF link that downloads, causes trouble. Put it at a plain URL such as yoursite.com/privacy.

SMS terms: what they must say

Your terms can be a standalone "SMS Terms" page or a clearly headed section inside your general terms of service. Either works if it is easy to find. It needs these six elements:

1. Program name and description. Who is texting and what kind of messages.
2. Message frequency. "Message frequency varies," or a specific number, such as "up to 4 messages per month."
3. "Message and data rates may apply." Use this exact wording, or close to it.
4. How to opt out. Reply STOP.
5. How to get help. Reply HELP, plus a support email or phone number.
6. A link back to the privacy policy.

Template language:

SMS Terms. By opting in, you agree to receive [account notifications / appointment reminders / promotional offers] from [Business Name] at the mobile number you provided. Message frequency varies [or: up to X messages per month]. Message and data rates may apply. Reply STOP to cancel at any time; you will receive one confirmation message and no further texts. Reply HELP for help, or contact us at [support@yourdomain.com] or [phone]. Consent is not a condition of purchase. Carriers are not liable for delayed or undelivered messages. See our Privacy Policy at [yoursite.com/privacy].

"Consent is not a condition of purchase" matters most for marketing campaigns. Include it anyway, since it costs nothing.

Your STOP and HELP replies have to match what the terms say. On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out propagates so that number can't be texted again from any campaign. Ready's HELP reply uses the business name and contact you registered, so keep those the same as your terms.

The opt-in disclosure at the point of collection

This is where most otherwise-good sites fail. The disclosure has to appear where the person enters their number, not only on a separate terms page. Our post on opt-in wording that clears registration the first time covers this in depth. Here is the core pattern.

Web form or checkout checkbox

☐ I agree to receive [type of messages] text messages from [Business Name] at the number provided. Message frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel. Consent is not a condition of purchase. [Privacy Policy] | [SMS Terms]

Rules that trip people up:

• The box must start unchecked. A pre-ticked box is not consent.
• The box must be optional. If the form can't be submitted without checking it, consent becomes a condition of the purchase or signup.
• Keep it separate from email consent. One box for email and one box for SMS.
• Name the business. "Our partners" or "affiliates" in the opt-in line will get you rejected.

Keyword opt-in (text JOIN to a number)

The disclosure appears wherever you advertise the keyword, such as a sign, flyer or Instagram post:

Text JOIN to (555) 555-0100 to get [weekly specials] from [Business Name]. Up to 4 msgs/mo. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Terms: yoursite.com/sms-terms

Your confirmation reply then repeats the essentials:

[Business Name]: You're subscribed to weekly specials. Up to 4 msgs/mo. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

That reply is 141 characters with no emoji, so it is one GSM-7 segment. Keep it that way. An emoji drops the single-segment limit to 70 characters and turns this into a 3-segment message, which also bills 3x.

Verbal or in-person consent

Write a short script, have staff use it, and record the consent in your CRM with the date and wording. Describe the process in the registration and link any written version on your site.

Make the registration match the pages

Reviewers compare your registration form against your site line by line. Mismatches cause rejections even when every page exists.

If your opt-in form sits behind a login, such as during account creation, upload a screenshot. A reviewer who can't see it will assume it doesn't exist.

Common rejections and the fix

How Ready handles the registration side

We make Ready, so here is where the product fits and where it doesn't. Ready handles brand and campaign registration in the app. The charge at submission is the first month, $25, with no setup fee. After that it is $25/mo for registration and $2 per number. Most approvals take 2 to 7 days. If you build a platform and register on behalf of your customers, each sub-account gets its own registration. Ready builds each one a hosted opt-in page with its own privacy policy, SMS terms and an unchecked consent box, which is the page we file with the carrier.

If you want carriers to see your own site as well, the rules above apply to it, and Ready stores each sign-up made on the hosted page (time, IP address and the wording shown). Our consent attestation records who sent, to how many and when, for each campaign you send and each API send that attests consent. It is not a per-contact consent record. The opt-in time, wording and page URL for each contact stay in your form tool or CRM. Our guide to documenting SMS consent covers how to keep that record.

The short version

Publish a live site that shows your brand name. Add an SMS clause to your privacy policy saying mobile data won't be shared for marketing. Publish SMS terms with all six elements. Put a full, unchecked, optional disclosure right where people enter their number. Then make every registration field match those pages exactly. Do that before you submit, and the website part of the review stops being the reason you wait another cycle.

When your pages are ready, you can create an account and start registration in the app, or read the quickstart first to see how sending works once you're approved.