A rejected A2P 10DLC campaign is frustrating because the message you get back is short and the fix is rarely obvious. The good news is that the same dozen reasons account for almost every rejection, and each one has a specific, mechanical fix. This guide goes through them one at a time, with the error codes Twilio uses (other platforms describe the same problems in their own words), what the reviewer is actually looking for, and what to change before you resubmit.
Two things to know before you start. First, every submission is reviewed by a human at a carrier aggregator and costs a review fee, so resubmitting with half the problems fixed just buys another rejection. Second, reviewers can only see what is public: if your opt-in happens behind a login, on paper or on the phone, you have to show it to them with a hosted screenshot or document. Most rejections come down to one of those two facts.
Invalid or insufficient opt-in (error 30896)
This is the most common rejection and the vaguest. The reviewer could not confirm, from what you submitted, how people consent to receive your messages. Twilio’s documentation for error 30896 lists the usual causes: the message flow description does not say who opts in, where or how; you use more than one opt-in method but described only one; the website form is not public and no screenshot was provided; the privacy policy is missing the no-sharing statement, the frequency or the rates disclosure; you mentioned a keyword but did not provide the keyword and its confirmation message; or the description suggests consent is shared between brands or was not collected for this specific campaign.
The fix. Rewrite the message flow so that a stranger could reproduce the opt-in. Name the URL of the form. Say that the SMS consent checkbox is separate, unchecked and not required to submit. Quote the exact consent text next to it. Name the privacy policy and terms links on the form. If people can also text a keyword, give the keyword, the number and the confirmation reply they receive. If any opt-in is offline or gated, host a screenshot at a public URL and reference it. The call-to-action and message flow generator writes this description from your details and covers every item on that list.
The opt-in flow cannot be verified
A close relative of 30896: the reviewer went to the URL and could not find the form, or found a form with no SMS checkbox, or hit a login page. Codes in the 30909 and 30921 range usually mean this. Reviewers do not create accounts, fill in quote forms or call your office.
The fix. Put the form on a public page, or add a public page that shows it, and link that page in the campaign. For flows inside an app or a customer portal, take a screenshot that shows the phone field, the unchecked box, the full disclosure and the links, upload it somewhere public and mention the link in the message flow. For paper forms, a photo or PDF of the form works the same way.
Consent is pre-checked, required or bundled with the terms
Codes around 30913, 30923, 30925 and 30931. The reviewer found the checkbox but it was already ticked, or the form would not submit without it, or the only checkbox was “I agree to the terms and conditions” with SMS consent buried in the terms. None of these count as consent under the CTIA principles carriers enforce.
The fix. A dedicated SMS checkbox, unchecked by default, optional, with the disclosure as its label. If you send marketing messages, add a second checkbox for marketing so that transactional consent and marketing consent are separate. The opt-in checkbox and form builder produces the HTML with those rules enforced in the code.
The disclosure is missing elements
Code 30924 and similar. The checkbox exists but the text next to it does not name the business, the message types, the frequency, “Msg & data rates may apply”, or how to reply STOP and HELP. Sometimes the text is fine but it is hidden in a tooltip or behind a “read more” link, which the reviewer treats as missing.
The fix. Replace the label with a complete disclosure, visible in full at the moment of consent. The opt-in language generator assembles the seven elements in the order reviewers expect, in about 70 words.
Privacy policy missing, gated or non-compliant
Code 30932, often paired with brand codes. The reviewer followed the privacy policy link and found nothing, a broken page, a login wall, or a policy that allows phone numbers to be shared with third parties for marketing. The specific sentence reviewers look for says that no mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and that text messaging opt-in data and consent are excluded from any sharing described elsewhere in the policy.
The fix. Publish a privacy policy at a public URL on the same domain as the form, link it from the footer and from the disclosure, and add an SMS section that contains the no-sharing statement, the message types, the frequency, the rates line and STOP and HELP. The 10DLC privacy policy generator produces a full policy with that section, or just the SMS clause to paste into an existing policy.
No SMS terms, or terms that leave things out
Reviewers expect published program terms as well as a privacy policy. A rejection here cites missing terms or terms that do not cover frequency, cost, opt-out, help or the carrier liability disclaimer (“carriers are not liable for delayed or undelivered messages”).
The fix. Publish an SMS terms page and link it next to the privacy policy. The SMS terms and conditions generator writes the ten standard sections from the same inputs as the privacy policy, so the two agree.
Brand and website mismatch
Codes 30919 to 30922. The website on the brand registration is down, under construction, insecure (http://), a bare landing page with a form and nothing else, or describes a different business from the one registered. Reviewers want a real site that identifies the business and matches the campaign’s use case.
The fix. Make sure the site loads over HTTPS without a login, has an about or services page that describes what you do, shows the business name and contact details, and matches the products or services the messages will be about. If you registered under a legal name that never appears on the site, add it to the footer or the contact page.
Legal name, DBA, EIN or sole proprietor mismatch
Codes 30914, 30915 and 30918. The brand registration does not match IRS records: a trading name instead of the legal name, an EIN that belongs to a different entity, an LLC registered as a sole proprietor, or an address that does not match the tax record.
The fix. Re-register the brand with the exact legal name from your EIN confirmation letter and the address on file with the IRS. If you operate under a DBA, register the legal name and put the DBA in the field provided for it. Sole proprietor registration is only for individuals without an EIN.
Sample messages that fail review
Code 30911 and the high-risk codes. The samples do not name the brand, contain no opt-out language, use a link shortener, use http:// links, are copied from a template reviewers have seen a thousand times, or describe something different from the registered use case (marketing samples on a customer-care campaign, for example).
The fix. Rewrite the samples so each starts with the brand name, at least one (ideally all) includes “Reply STOP to opt out”, links are full https:// URLs on your own domain, and the content matches the use case and the website. Three distinct, realistic samples per use case is plenty. The call-to-action generator produces samples in that form for each message type you select.
Opt-in wording does not match the samples or the use case
Codes 30909 and 30916. The consent text promises appointment reminders, the samples are promotions, and the use case says customer care. Reviewers check that the three describe the same program.
The fix. Decide what the campaign is for, then make the disclosure, the samples and the use case say the same thing. If you genuinely send both reminders and promotions, register a mixed campaign and make sure the disclosure mentions both, with a separate marketing consent.
Embedded link or phone number flags do not match
If a sample contains a link or a phone number, the campaign fields that declare embedded links and embedded phone numbers must say so. A mismatch is a quick rejection.
The fix. Set the flags to match the samples, or remove the links and numbers from the samples.
Personal email or unauthorized contact
Codes 30971 and 30972. The brand contact uses a free personal email address, or the person named is not an authorized representative.
The fix. Use an email on the business domain and an officer, owner or authorized employee as the contact.
Prohibited or restricted content
Codes 30940 to 30964. Sex, hate, alcohol, firearms and tobacco (SHAFT), cannabis and CBD, high-risk financial services, debt collection, gambling, cryptocurrency promotions and multi-level marketing. Some of these are blocked outright; others (alcohol, tobacco) are allowed only with age-gated opt-in and a specific use case.
The fix. Usually there is none for that use case. Remove the content or talk to your provider about the special campaign types that exist for regulated industries before resubmitting.
Before you resubmit: a five-minute check
Every rejection cycle costs a review fee and days of calendar time, so run through the whole list before resubmitting rather than fixing only the cited item. The A2P 10DLC website compliance checker is a 15-point guided audit of exactly what reviewers look at: website basics, the form and consent, the privacy policy, the terms and the business match. It produces a readiness score and a fix list with links to the generator for each missing piece. Submit when the score is 90 or more with nothing marked No.
If the rejection message names an error code, match it to the sections above; if it only gives a sentence, the sections are in rough order of frequency, and the first three cover most cases. Fix everything, resubmit once, and keep the registered details, the website and the messages consistent afterwards, because campaigns can be re-vetted after approval.