A2P 10DLC rejections
Your campaign came back rejected with a number on it. Here is what the reviewer actually looked at.
You registered a number so you could text your own leads, and it was refused with a code and almost no explanation. Three of those codes are about your website, and all three are fixable in an afternoon once you know which line is missing. This page explains each one in the reviewer’s terms, and checks your site against them for free.
Check your site against these codes, free
No email, no signup. We fetch your site the way a reviewer would, read your privacy policy rather than just finding it, and tell you plainly what we could not judge.
The three codes that are about your website
These are the numbers as Twilio documents them, because they publish the clearest version. Other providers return the same rejections under their own labels, so if your code looks different, match it by the description rather than the digits.
| Code | What it says | What it actually means |
|---|---|---|
| 30908 | Compliant privacy policy required | The policy is missing, unreachable, contradicted by a second policy, or does not contain three specific statements. |
| 30919 | Website lacks sufficient business or use case info | A reviewer could not tell who you are, what you do, or how anyone consents to be texted. |
| 30925 | Opt-in must be unchecked by default | Your consent box is pre-ticked, or there is no separate box for texts at all. |
None of the three is about the message you want to send. All three are about the site.
30908: the policy exists, and it still fails
This is the one that catches people who did everything right. You published a privacy policy, you linked it, it loads. It is still rejected, because the code is not asking whether a policy exists. It is asking whether the policy says three things.
- That mobile data is not shared. The policy has to state that mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. A policy that says you may share personal information with marketing partners is refused on this point alone, and a great many stock policies say exactly that.
- How often you will text. Message frequency, in the policy. “Message frequency varies” is enough. Nothing is not.
- That rates may apply. The words “message and data rates may apply”.
The trap is that the second and third are usually written on the SMS terms page, one click away, and the code names the privacy policy specifically. A reviewer opens the URL you submitted. One click away is not on the page.
We had this wrong ourselves. Our own page generator put both disclosures on the SMS terms page and not on the privacy policy, and it took reading the code properly to catch it.
30925: the consent box, which is the most common one of all
Two separate things get rejected here, and most sites do the second without realising it is a problem.
A pre-ticked box. If the consent checkbox arrives already selected, the consumer did not choose anything. It has to be unticked and the person has to tick it.
A bundled box. This is the common one. A single checkbox reading “I agree to the Terms of Service and Privacy Policy” does not capture consent to be texted, however the terms are worded. Messaging consent needs its own control, asking about messages specifically.
And the wording on it has to identify you by name and say what kind of messages they are getting. “By submitting, you agree to be contacted” attached to the submit button is implied blanket consent, and it is refused.
The test worth applying: can someone who will not agree to texts still send you an enquiry? If not, the consent is a condition of service, and that is the thing being objected to.
30919: the site itself does not say enough
A reviewer has to be able to validate your business from the site. This code covers the site being empty, under development, password protected, or simply thin: no clear business name, no contact details, no description of what you do, and no visible explanation of who gets messages and why.
It also covers the opt-in being unverifiable. If your form sits behind a login, a reviewer cannot see it, and you have to host screenshots of the full consent flow somewhere public and submit that URL instead.
Why a one-page funnel fails several of these at once
If your site was built as a funnel rather than as a website, it very likely answers every address with the same page. Ask it for a URL that cannot exist and you get the homepage, with a success code rather than a 404.
That matters here for a specific reason: it means a link to /privacy-policy loads, looks fine to you, and contains no privacy policy. You can send that URL to a carrier in good faith. A reviewer opens it, sees your homepage, and refuses under 30908.
It is also why a checker that only reads status codes will tell you all four pages are present on a site that has none of them. The scan at the top of this page fetches an address that cannot exist first, fingerprints the answer, and judges every page against that instead of trusting the code it returns.
What this looks like on real sites
On 4 November 2026 we scanned 32 working business websites: mortgage brokers advertising normally, and plumbing, roofing, HVAC and property firms around Indianapolis. They were picked because they were trading, not because anything looked wrong with them, and none is named here.
- Twenty-four answered. Every one of the twenty-four was missing at least one of the four pages a reviewer opens, and seven had none of them.
- Of those that did publish a privacy policy, most were missing all three of the statements 30908 asks for. The two most commonly absent are message frequency and “message and data rates may apply”, which are usually written on an SMS terms page instead.
- Not one site out of 24 was clean.
The eight that did not answer are worth their own line. Six take more than ten seconds to accept a connection, and one is serving a certificate that does not match its own domain, so a browser shows a warning before the page loads. Those are not compliance problems. They are worse ones.
Most of these sites had no form on the homepage, so nothing could be said about their consent boxes, and we would rather say that than count it against them.
What we do about it
$499 to build, then $99 a month. The four pages written for your trade with the three required statements in the right places, the consent capture as a separate unticked control with a dated record of who agreed to what, the identifiers your licence requires, and the advertising gate on every page and on everything you publish afterwards.
That last part is a different problem from this page but the same bill: your copy is read against your industry’s rulebook, which is 509 refused phrases across nine rulebooks, 282 of them in real estate alone, published in full.
If you would rather hand the scan to whoever built your site, that is a perfectly good outcome and the scan is free either way.
A screening tool and a build standard, not legal advice. Your compliance officer or attorney has the last word, and a carrier makes its own decision.