A2P 10DLC campaign rejection

30908: your privacy policy did not pass

This is the most common rejection we see, and the most misread. It almost never means you have no privacy policy. It means the policy a reviewer reached did not contain three specific statements, or they could not reach it at all.

What the reviewer is actually doing

A person opens the PrivacyPolicyUrl you registered, or hunts for a policy on the website you gave, and reads it. They are checking three things, and all three have to be on the privacy policy itself.

1. That mobile numbers and messaging consent are not shared. Not sold, not passed to affiliates, not handed to lead generators, for marketing or promotional purposes. This is the sentence reviewers look for most directly, and a policy that says the opposite is an instant rejection.
2. How often you will message. Message frequency, stated. "Message frequency varies" is accepted wording.
3. That message and data rates may apply. In those words.

Having two and three on your SMS terms page does not count. They have to be on the privacy policy, because that is the page the reviewer opened. This is the single most common reason a site that looks complete still fails.

The other ways it fails

• No policy URL was registered at all. It is required on new submissions.
• The policy is behind a login, or on a staging site, or the URL has a typo. If a reviewer cannot open it from a cold browser, it does not exist.
• There are two policies. An old one and a new one, or one on the main site and another on a landing page, saying different things. A reviewer cannot tell which applies, so they reject.
• The policy says you do share data. Boilerplate copied from a template often includes a sharing clause written for advertising. It contradicts the statement above and is read as a direct conflict.

What to change

Put all three statements on the privacy policy. Make the policy reachable at a plain public URL on the domain you registered. Delete or redirect any second policy. Then resubmit by editing the rejected campaign rather than deleting it and starting again, so you are not charged a second vetting fee.

Source: Twilio's own documentation for error 30908, last updated 27 October 2026. Other providers return the same rejection under their own labels, so match by description rather than by number.

See which of these your own site would fail

We run the same checks a carrier review runs, on the public pages of your website, in about a second. No sign-in and nothing installed.

Scan my website free →

If you would rather hand the list to whoever built your site, that is a perfectly good outcome. If you would rather we built the pages, that is what we do.

We are not lawyers and this is not legal advice. It is a screening tool, the same one we run over our clients' marketing before it ships.