Measured, 7 October to 9 November 2026

We ran the carrier check over 139 small business websites. 133 failed.

Every number on this page was read off a live website by the same scanner we point at our own. We are publishing it because the problem is discussed constantly and measured almost never, and because the figure that surprised us is not the one everybody repeats.

• 139live websites scanned
• 133failed the carrier check
• 61had none of the four pages
• 8of 74 readable policies carried all three required statements

What the check is

Before a carrier approves a phone number for business texting in the United States, a reviewer opens the website on the campaign registration and looks for four public pages: a privacy policy, terms of use, SMS terms, and a service disclaimer. They then read the privacy policy for three specific statements, and look at any form that collects a phone number. Fail any of it and the campaign comes back rejected, most often as error 30908, 30919 or 30925.

Twilio began requiring a privacy policy URL on new campaign submissions on 30 June 2026, so this is getting stricter rather than easier.

How the four pages came out

44% of these businesses have none of the four pages at all. That group is easy to explain and easy to fix. The interesting group is the other one.

The finding we did not expect

74 of the 139 sites had a privacy policy we could actually open and read. A reviewer checking those pages is looking for three statements, all three on the privacy policy itself:

1. that mobile numbers and messaging consent are not shared or sold for marketing
2. how often you will message, which can simply be that message frequency varies
3. that message and data rates may apply

So 66 businesses have a privacy policy and would still be rejected on it. They are not the ones who ignored the requirement. They are the ones who did the work, or paid somebody to, and still fail, because the three statements usually sit on an SMS terms page one click away and the reviewer never opened that page. The page they opened was the privacy policy.

That is the part worth knowing, and it is the opposite of the usual advice. Adding a privacy policy is not the fix. Putting the three statements on the privacy policy is the fix.

The forms

32 of the 139 sites had a form that collects a phone number, which is what brings error 30925 into play. 17 of those 32 had a messaging consent box separate from the general terms box. None of the boxes we found arrived pre-checked.

That last figure is worth saying out loud, because the advice everybody gives about 30925 is to uncheck the box. On this sample the pre-checked box was not the problem. The missing box was. Just under half of the forms collecting a phone number had no messaging consent at all, and a single combined "I agree to the Terms and Privacy Policy" checkbox is named in the carrier documentation as a rejection.

We ran it on ourselves

It would be a poor look to publish this without turning the scanner around, so: danedigital.org is missing 0 of the 4 pages, and its privacy policy carries all three statements. Verified by the same scan, on the same day as the last of the figures above. If that ever stops being true, the scanner will say so, because we re-run it on a schedule.

Method, and what this sample is not

• What was scanned. 139 distinct live websites, each one read over the public web with no sign-in, between 7 October and 9 November 2026. Where a site was scanned more than once, the most recent result is the one counted.
• Who they are. Small businesses in regulated trades: mortgage and lending, real estate, home services and contracting. Mostly United States, mostly small, many with fewer than ten staff.
• This is not a random national sample, and we are not going to pretend it is. These are businesses we identified while looking for people this problem affects, so they are more likely to have the problem than a business picked at random. Read the figures as a description of this group, not an estimate for every small business in America.
• What a failure means here. Only that the public pages a carrier reviewer reads were missing or incomplete on the day we looked. It is not a judgment about the business, and it is not a legal opinion. Several of these sites are excellent in every other respect.
• Nobody is named. We do not publish which sites failed, and we will not. A business that wants to know about its own site can run the scan itself, below, in about a second.
• Where the rules come from. The carrier requirements are Twilio's published documentation for errors 30908, 30919 and 30925, last updated 27 October 2026. Other providers return the same rejections under their own labels.

Run it on your own site

Same checks, your website, about a second, nothing installed and no sign-in.

Scan my website free →

You get the list of what is missing and the wording that is needed. Hand it to whoever built your site and you are done. If you would rather we built the pages and wired the consent capture into your forms, that is what we do.

We are not lawyers and this is not legal advice. It is a screening tool, the same one we run over our clients' marketing before it ships.