SMS privacy policy and terms generator

A 10DLC campaign goes from your texting provider to The Campaign Registry and the carriers, and reviewers check your privacy policy and terms URLs during campaign review (what 10DLC is). Twilio now treats both links as required fields: its rejection codes say a PrivacyPolicyUrl and a TermsAndConditionsUrl are each “required for all new A2P 10DLC campaign submissions.”

The privacy section answers CTIA's request for a policy that “clearly describes how the Message Sender may collect, use, and share information from Consumers” (§ 5.2.1), and adds the one sentence reviewers search for: mobile opt-in data is not shared with third parties or affiliates for marketing. Twilio's onboarding guide marks that line “required by CTIA”; it echoes CTIA's rule that an opt-in “should not be transferable or assignable” (§ 5.1.2.2).

The terms follow the CTIA handbook's list for a recurring program (program name, frequency, description, customer care, opt-out, “Message and data rates may apply”) plus the two items Twilio adds: a link to the privacy policy and “Carriers are not liable for any delayed or undelivered messages.” The rest of the paperwork, with the common reasons a campaign is sent back, is in the registration checklist.

Publish each on your own domain, public and outside any login, and link both from every opt-in: CTIA asks that privacy policies be “referenced in and accessible from the initial call-to-action” (§ 5.2.1), and Twilio that the links in your registration “match the links included in your opt-in.” Twilio also suggests messaging-specific pages rather than edits to your main documents, because they are easier to keep current when requirements change. Twilio's guide also asks that the policy link point to a page titled “Privacy policy” and mention your registered brand name, so the generated section sits inside that page.

On the form, Twilio wants the checkbox for your privacy policy and terms kept apart from the messaging consent checkbox, and marketing and transactional consent on two separate checkboxes. The opt-in text itself comes from the opt-in language builder or the SMS consent form template; which texts count as marketing is covered in TCPA rules for text messages.

The STOP clause lists the seven reply words the FCC treats as a reasonable way to revoke: “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe,” honoured within a reasonable time “not to exceed ten business days”, with one confirmation text presumed fine if sent within five minutes (47 CFR § 64.1200(a)(10), (a)(12)). FCC 26-67, adopted on 2026-09-30 and not yet in effect, would let a sender designate an exclusive revocation method; until then the terms keep every reasonable method open. More in SMS opt-out keywords and TCPA rules for text messages.

Every page a clause is mapped to, with the date it was read. The CTIA handbook is version 1.9 (effective 2023-08-02), read on CTIA's own site. Twilio and Telnyx pages are the providers' own vetting guidance; other providers word theirs differently, so check yours if it rejects a line.