10DLC Site

Many privacy policies were written for cookies and email lists, not text messages. 10DLC reviewers look for specific SMS language. If the policy does not promise to keep phone numbers and texting consent private, the campaign can be sent back even when everything else is right.

What does this rejection mean?

It means the reviewer read your privacy policy, or tried to, and it did not meet messaging rules. Twilio error 30908 covers a missing policy URL, a policy that will not load, several conflicting policies, or a policy that says mobile information is shared for marketing. CTIA asks senders to display a clear policy that explains how they collect, use, and share consumer information, and to make it reachable from the opt-in call to action.

See the full requirement at privacy policy.

Why does it happen?

No policy URL was given. Twilio requires the Privacy Policy URL for new API campaign submissions after June 30, 2026 (error 30933).
The policy is not public. Twilio's business info guide says it must be public with no login.
There is more than one policy. Conflicting versions confuse reviewers (Twilio 30908).
The no-sharing clause is missing. Twilio, Telnyx, Bandwidth, Vonage, and Plivo all ask for it.
The policy allows sharing SMS data. Twilio 30932 rejects policies that let opt-in data go to third parties, affiliates, or lead generators.
It is a generic template. Telnyx says the policy must be brand-specific.
SMS basics are missing. Twilio's guide also asks the policy or linked flow to mention message frequency and that message and data rates may apply.

How do I fix it?

Keep one privacy policy on your own website and delete old copies.
Put your business name at the top.
Add a clear SMS section with the no-sharing statement.
If you share any other data with partners, say that SMS opt-in data and consent are excluded (Telnyx and Vonage suggest this).
Mention message frequency and that message and data rates may apply.
Link the policy in your footer and next to your opt-in checkbox.
Open the URL in a private browser window to confirm it loads with no login.
Paste the exact URL into your campaign's Privacy Policy field.

A clause that passes review names your business, makes the no-sharing promise for both phone numbers and texting consent, carves SMS data out of any other sharing in the policy, and mentions frequency, rates, STOP, and HELP. Small wording gaps, such as covering phone numbers but not consent, are enough for a reviewer to send it back.

Included in your Registration Kit: the finished privacy clause written for your business name and matched to your website, ready to paste, plus the exact privacy policy URL for your campaign form. Build my order →

What to check	Pass looks like
URL	Loads over https with no login
Number of policies	Exactly one
Brand name	Your business, not a template or reseller
SMS clause	No sharing or selling of numbers and consent
Links	Footer and opt-in form

How do I resubmit?

Twilio says to edit the rejected campaign rather than delete it, and that the vetting fee is charged only once per campaign. Vonage lists $15 per vetting event, Telnyx describes $15 per submission or resubmission, and Bandwidth says a $15 fee applies to rejected campaigns that need resubmission. Check your provider's current fees first. Twilio says standard campaigns can take up to several weeks to review.

What error code will I see?

Twilio code	What it points to
30908	Privacy policy missing, unavailable, conflicting, or allows sharing
30932	Policy allows sharing mobile opt-in data
30933	PrivacyPolicyUrl field missing

See the 10DLC website requirements hub for everything else.

Sources

Want to know if your current policy has the SMS clause? Compare your site with the checklist. Our sites ship with an SMS-ready privacy policy built in; see pricing.