Privacy Policy Attachment Missing

Why This Rejection Happens

This code appears when you do not have a public website URL for your Privacy Policy and instead opted to upload a document/PDF, but the file was corrupted, missing, or blank. Alternatively, you provided a link that requires a download rather than viewing in-browser.

• Uploading a blank PDF.
• The uploaded file format is not supported (e.g., .docx instead of .pdf).
• The URL provided triggers a file download instead of displaying a page.
• Forgetting to attach the file entirely in the "Optional" field.

Root Cause Analysis

Primary Triggers

• Accessibility Issue: Vetting agents need to verify the policy *content*. If they have to download a Word doc to see it, they will reject it for security reasons.
• Best Practice Violation: While uploading a policy is allowed for brands without websites, it is highly disfavored. A URL is always preferred.

Format Requirements

Step-by-Step Remediation

Host the Policy Online

Instead of re-uploading a file, fix this permanently by creating a "Privacy Policy" page on your website. Even a free Google Doc published to the web is better than a file upload.

Or, Convert to PDF

If you MUST upload a file, convert your document to PDF. Ensure the text is selectable (not an image scan). Verify the file size is under 5MB. Upload it to the "Privacy Policy" section of the campaign.

Pre-Resubmission Checklist

• I have switched to a URL link if possible.
• If uploading, the file is a PDF.
• The policy text includes the required 10DLC disclosures (Code 805).

Fix It Faster

Generate a compliant policy URL.

Need a Hosted Link?

Stop worrying about file uploads. We provide a permanent link for your policy.

What reviewers check for code 809

Code 809 is reported as "Privacy Policy Attachment Missing". Reviewers need a publicly accessible privacy policy on the brand's website that explains data collection and contains the SMS non-sharing clause, and the opt-in point must link to it. A missing policy, a policy that does not mention SMS, or an opt-in with no privacy link fails this check.

Where code 809 comes from

Code 809 is a vetting rejection reason applied during brand or campaign review and passed back to you by your CSP. It identifies the specific deficiency the reviewer found, so fixing exactly that item is the fastest route to approval. It is marked High severity: it blocks approval, but it is fully fixable by correcting the submission and resubmitting.

Minimum SMS section for the policy

Compliant version:

SMS messaging. If you opt in to texts from Harbor Key Realty, we use your number only to send the messages you requested. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out or HELP for help. We do not share or sell mobile numbers or SMS consent to third parties for marketing.

Fix and verify before resubmitting

1. Publish a privacy policy page on the brand domain and link it from the site footer.
2. Include sections on data collected, use, retention, sharing, consumer rights and contact details.
3. Add the SMS clause: no mobile information is shared with third parties or affiliates for marketing.
4. Link the policy directly from the SMS opt-in form, next to the consent text.
5. Enter the policy URL in the campaign and attach a screenshot if the opt-in is not public.
6. Resubmit with a note that references code 809 (Privacy Policy Attachment Missing) and lists each change made.

Sample resubmission note

Many CSPs let you add a note for the reviewer when you resubmit. A short, specific note shows what changed and speeds up the second review. Example for Harbor Key Realty:

Harbor Key Realty corrected the deficiency reported as code 809 (Privacy Policy Attachment Missing). Changes made: publish a privacy policy page on the brand domain and link it from the site footer; include sections on data collected, use, retention, sharing, consumer rights and contact details; add the SMS clause: no mobile information is shared with third parties or affiliates for marketing. All URLs, keywords and auto-replies were re-tested from an external network before this resubmission, and the campaign text now matches the live opt-in exactly.

Common mistakes that keep code 809 coming back

• Using a template that never mentions text messages.
• Linking the policy in the footer but not at the opt-in point.
• Publishing the policy only inside a logged-in customer portal.

Related rejection codes

• Code 805: Privacy Policy Missing or Non-compliant
• Code 851: Privacy Policy Disclosure Missing
• Code 30908: Privacy Policy Missing or Non-compliant
• Code 2131: Verbal Script Missing STOP Instructions
• Code 2128: Opt-in Form Missing HELP Instructions
• Code 2127: Verbal Script Missing STOP Instructions

Frequently asked questions about code 809

Do sole proprietors and small businesses need a full privacy policy?

Yes. Every 10DLC campaign that collects phone numbers must link a policy. It can be short, but it must exist publicly and include the SMS clause.

Does a policy generator satisfy code 809?

It can, if you edit it to include the SMS non-sharing clause and remove any marketing-partner sharing language.

Legal Disclaimer: Code 809 is a technical formatting rejection. It does not assess the content of your policy, only the method of delivery. Ensure the content itself is also compliant (See Code 805).

© 2025 MyTCRPlus. All rights reserved.