Why This Rejection Happens
The URL you provided for your Privacy Policy is not secure. Carriers require all compliance documentation, including privacy policies, to be hosted on an HTTPS-secured page. Your link was either `http://` or had an expired/invalid SSL certificate.
- Link submitted as `http://example.com/privacy`.
- Self-signed SSL certificate triggering a browser warning ("Not Secure").
- SSL certificate expired before the vetting agent checked the link.
- Mixed content (secure page loading insecure images/scripts).
Root Cause Analysis
Primary Triggers
- Consumer Trust: A privacy policy hosted on an insecure site contradicts the very premise of data security. Carriers view this as a red flag for data handling practices.
- Automated Scanning: Vetting bots automatically check the HTTP status code. If it doesn't return 200 OK on port 443 (HTTPS), it fails instantly.
SSL Requirements
| Component | Requirement | Check |
|---|---|---|
| Protocol | https:// | Padlock icon in browser. |
| Certificate | Valid Authority (e.g., Let's Encrypt). | No browser warnings. |
| Redirection | Force HTTP -> HTTPS. | Type http:// and see if it flips. |
Step-by-Step Remediation
Install SSL
Contact your hosting provider to enable SSL for your domain. This is often free. Ensure the certificate covers the exact subdomain (e.g., `www.` or `shop.`) used in the link.
Update TCR Link
Edit your campaign's "Privacy Policy URL" field. Change the prefix from `http` to `https`. Test the link in an Incognito window to ensure it loads without warnings.
Pre-Resubmission Checklist
- The Privacy Policy URL starts with `https://`.
- The page loads without any "Not Secure" warnings.
- I have updated the URL field in the TCR portal.
Fix It Faster
Verify your link security.
Need a Secure Link?
We host secure privacy policy pages for 10DLC compliance.
What reviewers check for code 7013
Code 7013 is reported as "Privacy Policy SSL Failed". The privacy policy URL must load over a valid HTTPS certificate. Reviewers and automated checkers treat an expired, self-signed, mismatched or missing certificate as a failed policy, because consumers following the link would see a browser security warning instead of the policy.
Where code 7013 comes from
Code 7013 is a campaign review reason code used to report a specific deficiency found during manual campaign vetting. CSPs surface it in the rejection notice alongside any other codes found in the same review, so check for companion codes before resubmitting. It is marked High severity: it blocks approval, but it is fully fixable by correcting the submission and resubmitting.
Fix and verify before resubmitting
- Test the URL in an SSL checker and confirm the certificate is valid, unexpired and issued for the exact hostname (including or excluding www).
- Renew or reissue the certificate through your host or a free provider such as Let's Encrypt, and enable auto-renewal.
- Redirect http:// to https:// and fix mixed-content warnings on the policy page.
- Confirm the full certificate chain is installed; missing intermediates fail on some validators even when browsers show a padlock.
- Update the campaign with the https:// URL and resubmit.
- Resubmit with a note that references code 7013 (Privacy Policy SSL Failed) and lists each change made.
Sample resubmission note
Many CSPs let you add a note for the reviewer when you resubmit. A short, specific note shows what changed and speeds up the second review. Example for Harbor Key Realty:
Harbor Key Realty corrected the deficiency reported as code 7013 (Privacy Policy SSL Failed). Changes made: test the URL in an SSL checker and confirm the certificate is valid, unexpired and issued for the exact hostname (including or excluding www); renew or reissue the certificate through your host or a free provider such as Let's Encrypt, and enable auto-renewal; redirect http:// to https:// and fix mixed-content warnings on the policy page. All URLs, keywords and auto-replies were re-tested from an external network before this resubmission, and the campaign text now matches the live opt-in exactly.
Common mistakes that keep code 7013 coming back
- Installing a certificate for the root domain while the policy lives on www (or the reverse).
- Letting a certificate auto-renewal fail silently between submission and review.
- Linking the http:// version of the policy in the campaign.
Related rejection codes
- Code 7105: Privacy Policy SSL Failed
- Code 2131: Verbal Script Missing STOP Instructions
- Code 2128: Opt-in Form Missing HELP Instructions
- Code 2127: Verbal Script Missing STOP Instructions
- Code 2126: Opt-in Form Missing STOP Instructions
- Code 2124: Verbal Script Missing Frequency Disclosure
Frequently asked questions about code 7013
My browser shows a padlock. Why did I still get code 7013?
Browsers fill in missing intermediate certificates from cache; validators do not. Run an external SSL test and install the full chain.
Do I need to change anything else after fixing the certificate?
Check that the opt-in page, SMS terms and website also load over valid HTTPS, since reviewers test every URL in the campaign.
Legal Disclaimer: Code 7013 is a security requirement. Encrypting legal disclosures builds consumer trust and protects data integrity.
© 2025 MyTCRPlus. All rights reserved.