Skip to content
ToolsOrbit

Module 08 · SMS & 10DLC

A2P 10DLC Website Compliance Checker

Walk through the 15 things campaign reviewers check on your website, answer yes, no or not sure, and get a readiness score with a fix list you can copy.

Module 08 · COMPLIANCE CHECK

01 · Website basics

  • 01The website is live, public (no login or "coming soon" page) and loads over HTTPS.

    Why carriers care and how to fix it

    Why: Reviewers open the URL on the brand record. A password wall, parked page or insecure connection cannot be reviewed and is rejected.

    Fix: Publish the site, install an SSL certificate and make sure the home page loads without logging in.

  • 02The site clearly describes what the business does, and it matches the campaign use case.

    Why carriers care and how to fix it

    Why: A campaign for appointment reminders from a site that sells something unrelated looks like a mismatch or a front.

    Fix: Add an about or services page that describes the products or services the messages will be about.

  • 03The business name and contact details (address, email or phone) are visible on the site.

    Why carriers care and how to fix it

    Why: Reviewers compare the site with the brand registration. A site with no identity cannot be matched to the brand.

    Fix: Put the legal or trading name and a contact section in the footer or on a contact page.

02 · Form & consent

  • 04The opt-in form (or keyword call to action) is on a public page a reviewer can open, or you have a hosted screenshot of it.

    Why carriers care and how to fix it

    Why: The most common rejection is an opt-in flow the reviewer cannot see. Gated, in-app or paper flows need a screenshot or document link.

    Fix: Link the form page in the campaign, or upload a screenshot of the form to a public URL and reference it in the message flow description. Write the message flow description

  • 05SMS consent is a separate checkbox, unchecked by default, not bundled with the terms and conditions.

    Why carriers care and how to fix it

    Why: Pre-checked or bundled consent is not valid consent under carrier rules, and campaigns are rejected for it.

    Fix: Add a dedicated SMS consent checkbox below the phone field and leave it unchecked. Build a compliant form

  • 06The text next to the checkbox names the business, the message types, the frequency, "Msg & data rates may apply" and how to reply STOP and HELP.

    Why carriers care and how to fix it

    Why: The disclosure is what the person agreed to. Missing elements are the second most common rejection reason.

    Fix: Replace the checkbox label with a complete disclosure. Generate the opt-in language

  • Why carriers care and how to fix it

    Why: Consent that is required to buy, book or get a quote is not freely given, and marketing campaigns are rejected for it.

    Fix: Remove the required attribute from the checkbox and add "Consent is not a condition of purchase" to the disclosure.

  • Why carriers care and how to fix it

    Why: Reviewers follow those links from the form. If they are missing, the opt-in flow is incomplete.

    Fix: Add "See our Privacy Policy and Terms" links inside or directly under the disclosure.

03 · Privacy policy

  • 09A privacy policy is published on the same domain as the form and linked from the site footer.

    Why carriers care and how to fix it

    Why: A missing, broken or login-gated privacy policy is a rejection on its own.

    Fix: Publish the policy at a public URL on your domain and link it from every page. Generate a 10DLC privacy policy

  • 10The policy states that mobile information will not be shared with third parties or affiliates for marketing, and that opt-in data and consent are excluded from any sharing.

    Why carriers care and how to fix it

    Why: Reviewers look for this exact statement. A policy that allows sharing phone numbers for marketing is rejected.

    Fix: Add the two-sentence no-sharing statement to the SMS section of the policy. Get the exact sentence

  • 11The policy has an SMS section that covers message types, frequency, "Msg & data rates may apply" and STOP and HELP.

    Why carriers care and how to fix it

    Why: Error 30896 (opt-in error) lists a privacy policy without frequency and rates language as a direct cause.

    Fix: Add a short "SMS and text messaging" section with those four elements.

04 · Terms

  • 12SMS terms and conditions (or terms of service with an SMS section) are published and linked from the form.

    Why carriers care and how to fix it

    Why: Carriers expect published program terms that explain frequency, cost, opt-out and carrier liability.

    Fix: Publish an SMS terms page and link it next to the privacy policy. Generate SMS terms

  • 13The terms cover the program description, frequency, rates, STOP, HELP and a carrier liability disclaimer.

    Why carriers care and how to fix it

    Why: Incomplete terms are flagged during vetting and again if a complaint is investigated later.

    Fix: Add any missing section. The standard disclaimer is "Carriers are not liable for delayed or undelivered messages."

05 · Business match

  • Why carriers care and how to fix it

    Why: Brand and website mismatches are a top rejection group. The reviewer checks the site, the email domain and the registration against each other.

    Fix: Register with the exact legal name from your EIN letter, and show that name (or a clearly linked DBA) on the site.

  • 15Sample messages include the brand name and opt-out language, and match the use case, the website and the opt-in disclosure.

    Why carriers care and how to fix it

    Why: Samples without a brand name or STOP language, or that describe a different program from the opt-in, are rejected.

    Fix: Rewrite the samples so each one starts with the brand name and at least one includes "Reply STOP to opt out". Generate sample messages

Readiness score

0/ 100

Answer the checks
Passed
0
To fix
0
Not sure
15

A score of 90 or more with nothing marked No usually passes carrier review on the first try. Critical checks are worth 10 points, supporting checks 5.

Fix list

A2P 10DLC website readiness: 0/100 (Answer the checks)

CHECK AND CONFIRM
1. The website is live, public (no login or "coming soon" page) and loads over HTTPS.
2. The opt-in form (or keyword call to action) is on a public page a reviewer can open, or you have a hosted screenshot of it.
3. SMS consent is a separate checkbox, unchecked by default, not bundled with the terms and conditions.
4. The text next to the checkbox names the business, the message types, the frequency, "Msg & data rates may apply" and how to reply STOP and HELP.
5. A privacy policy is published on the same domain as the form and linked from the site footer.
6. The policy states that mobile information will not be shared with third parties or affiliates for marketing, and that opt-in data and consent are excluded from any sharing.
7. SMS terms and conditions (or terms of service with an SMS section) are published and linked from the form.
8. The legal business name, address and EIN used in the brand registration match the website and official records.
9. The site clearly describes what the business does, and it matches the campaign use case.
10. The business name and contact details (address, email or phone) are visible on the site.
11. The form can be submitted without the SMS box ticked, and the disclosure says consent is not a condition of purchase.
12. The form links to the privacy policy and the SMS terms, close to the checkbox.
13. The policy has an SMS section that covers message types, frequency, "Msg & data rates may apply" and STOP and HELP.
14. The terms cover the program description, frequency, rates, STOP, HELP and a carrier liability disclaimer.
15. Sample messages include the brand name and opt-out language, and match the use case, the website and the opt-in disclosure.

Most important first. Each fix links to the generator that produces the missing piece.

Runs in your browser. Nothing you enter is uploaded.

Checklist

How to use the compliance checker

  1. 01

    Open your website in another tab and go through the five groups: website basics, form and consent, privacy policy, terms, and business match.

  2. 02

    Answer each check with Yes, No or Not sure. Expand "Why carriers care" under any check to see the reason and the fix.

  3. 03

    Watch the readiness score. Critical checks are worth 10 points and supporting checks 5, out of 115.

  4. 04

    Copy the fix list. Items marked No come first, most important at the top, each with a link to the generator that produces the missing piece.

  5. 05

    Fix everything marked No, confirm the Not sure items, and submit the campaign when the score is 90 or more with nothing marked No.

Telemetry

How it works

A browser cannot fetch and inspect another website, so this is a guided self-audit rather than a scanner. The 15 checks are the things reviewers look at when they open the URL on a brand registration and follow the links from the sign-up form. Each check has a weight that reflects how often it causes a rejection on its own.

Score = (sum of weights of checks answered Yes) / 115 x 100

Critical checks (10 points): site live over HTTPS, public opt-in form, separate unchecked checkbox, complete disclosure, public privacy policy, no-sharing statement, published terms, legal name match

Supporting checks (5 points): business description, visible contact details, consent optional, policy links on the form, SMS section in the policy, complete terms, samples match

Ready: 90 or more and nothing marked No. Almost ready: 70 to 89. Not ready: below 70.

Worked example

A dental practice has a live HTTPS site with a description and contact details, a public form with a separate unchecked checkbox and a full disclosure, a privacy policy with the no-sharing sentence, and a legal name that matches the registration. It has no SMS terms page and is not sure whether the form links to the policies.

Yes on 12 checks worth 100 points, No on terms-public (10) and terms-complete (5), Not sure on form-links-policies (5). Score 87, status "Almost ready". The fix list puts the missing terms page first with a link to the SMS terms generator, then lists the policy links check to confirm.

What reviewers actually look at

When a campaign is submitted, a reviewer at the messaging platform and then at a carrier aggregator opens the brand's website. They check that it is real, that it describes the business named in the registration, and that the sign-up flow described in the campaign exists and says what the campaign claims. They follow the privacy policy and terms links from the form and read specific sentences. They compare the legal name and address with the registration. The whole visit takes a few minutes, and the 15 checks here are what happens in those minutes.

The groups are ordered the way a reviewer moves through the site: the home page first, then the form, then the two linked documents, then a comparison with the registration. Answer them in that order with the site open and you will see your site as the reviewer does.

The checks that cause rejections on their own

  • A site that cannot be reviewed. Password walls, "coming soon" pages, parked domains and plain http:// are rejected without further reading.
  • An opt-in flow the reviewer cannot see. Gated, in-app and paper flows need a hosted screenshot or document. This is the most common rejection reason by a wide margin.
  • Pre-checked or bundled consent. The SMS checkbox must be separate and unchecked.
  • An incomplete disclosure. Business name, message types, frequency, rates, STOP and HELP next to the box.
  • A missing or non-compliant privacy policy. Public, on the same domain, with the no-sharing statement.
  • No published terms. Program terms with frequency, rates, STOP, HELP and carrier liability.
  • A brand that does not match the site. Legal name, address and EIN consistent across the registration, the website and official records.

Why "Not sure" counts as zero

A reviewer does not give credit for things they cannot confirm, so neither does the score. Marking a check Not sure keeps it out of the fix list but puts it in a "check and confirm" list so you remember to verify it. The score only reaches "Ready to submit" when every check is a Yes or the score is at least 90 with nothing marked No. In practice, a site with one or two Not sure answers and everything else Yes will pass; the status is deliberately strict so that you confirm before you submit, because every rejection costs a resubmission fee and days of delay.

Using the fix list

The fix list is plain text, sorted by weight, with the fix tip and a link to the ToolsOrbit generator that produces the missing piece: the checkbox builder for the form, the opt-in language generator for the disclosure, the privacy policy generator and the SMS terms generator for the documents, and the call-to-action generator for the message flow and samples. Paste it into a ticket or send it to whoever maintains the site. The Share button puts your answers in the link so a colleague can open the same checklist.

What this checker does not do

It does not fetch your site, so it cannot catch a typo in a URL or a policy that was edited after you answered. It does not cover the content rules for restricted categories (lending, debt collection, cannabis, gambling, adult content), which need specialist review regardless of how good the website is. And it does not replace reading your platform's rejection message if a campaign has already been declined: that message names the error code, and the campaign rejection guide explains each one and the fix.

Mission briefing

Frequently asked questions

Q01 Can the checker scan my website automatically?

No. Browsers cannot read other websites because of cross-origin rules, and a scanner would miss things a human sees, such as whether a disclosure is visible without scrolling. The guided audit takes about five minutes with your site open in another tab.

Q02 What score do I need before submitting a campaign?

Aim for 90 or more with nothing marked No. The seven critical checks are each worth 10 points, so a single No on one of them usually means a rejection regardless of the rest.

Q03 Is this the same as the carrier vetting process?

It covers the website part of it. Vetting also looks at the campaign description, sample messages, use case and brand details. The call-to-action generator and the privacy policy generator cover those pieces.

Q04 My opt-in is on paper or verbal. How do I pass the form checks?

Host a scan or photo of the paper form, or the verbal script, at a public URL and describe it in the message flow. Answer the form checks for that document: it needs the same separate consent box and complete disclosure.

Q05 Why does the legal name matter so much?

The reviewer compares the registration with the website, the email domain and public records. A registration under "Acme Dental LLC" for a site that only ever says "Smile Studio" looks like a mismatch, and brand mismatches are a top rejection group. Show the legal name in the footer or on the contact page, or register the DBA.

Q06 Are my answers saved?

Only in the page while it is open, and in the link if you press Share. Nothing is sent to a server.

SMS & A2P 10DLC cluster

Every SMS tool on ToolsOrbit is part of one kit for registering and running a compliant texting program. Here are the other 8 modules.

Runs in your browser. Nothing you enter is uploaded.

This tool runs entirely on your device. There is no server-side processing and no account. Last reviewed October 28, 2026. Read the disclaimer.