CTIA Messaging Principles require toll free number verifications to include links to your organization's Privacy Policy and Terms of Use describing how the toll free number will be used and what data will be collected.
Important Note: This article is provided for general informational purposes only and is not legal advice. Nothing in this article creates an attorney-client relationship, and it should not be relied on as a statement of what any law, regulation, or carrier policy requires of your organization. Gloo does not provide legal advice, does not review or approve your Privacy Policy or Terms of Use, and cannot ensure that your policies satisfy applicable legal, carrier, or industry standards. Carrier and industry messaging requirements change frequently, and this article may not reflect the requirements in effect when you read it. Your organization is solely responsible for its compliance with applicable law and carrier requirements and for the accuracy of the policies it publishes. Please consult an attorney licensed in your jurisdiction before drafting or revising these documents.
Why is this necessary?
Carriers review your Privacy Policy and Terms of Use as part of Toll-Free verification to help confirm that your church or organization is a legitimate sender and is transparent about how you communicate with people. They give the people you are texting a clear understanding of how their information is used and what they can expect when interacting with your church or organization.
These requirements are intended to protect people from unwanted messages and help keep texting safe and trustworthy for everyone. They do not replace the separate requirement that you have each person's consent before you text them.
What do carriers look for?
Carriers generally expect your Privacy Policy and Terms of Use to be easy to find on your website and to include a few key details:
Privacy Policy: Explain what personal information you collect, how it is used, and how it may be shared. Carriers also look for a clear statement that mobile phone numbers and SMS opt-in information will not be sold or shared with third parties for marketing or promotional purposes, and verification requests are frequently rejected when that statement is missing. Please understand that this is a substantive commitment about how your organization handles information, not a phrase to be pasted in to clear a review. Do not include it unless it is accurate. Your Privacy Policy must describe what your organization actually does with the information it collects; publishing a statement that does not match your practices can create legal exposure under consumer protection and privacy laws, separate from anything a carrier does. If your organization does share mobile or opt-in information with third parties for marketing purposes, the change that is needed is to your practices, not to the wording of your policy.
Terms of Use: Include information about your texting program, such as the types of messages people may receive, message frequency, potential message and data rates, instructions for opting out (such as replying STOP) or getting help (such as replying HELP), and how to contact your organization. These same program details generally need to appear where people sign up for your texts, not only in your Terms of Use. Your sign-up form, keyword instructions, or other call to action should identify who is sending the messages, what they are about, how often they will arrive, that message and data rates may apply, and how to stop them.
Publicly accessible links: Both documents should be available through working links on a live website that do not require a login to view. Carriers generally expect the website and the organization name shown on it to match the legal entity submitted with your verification request, and expect your Privacy Policy to be reachable from the place where people opt in to your texts.
How to create these documents
If your church or organization doesn't already have a Privacy Policy or Terms of Use, there are a few ways to create them. You can work with an attorney, adapt an online template, or use a policy generator designed to walk you through the process.
Other organizations use Termly (not affiliated with Gloo), which offers generators for both Privacy Policies and Terms of Use. You'll answer a series of questions about your organization and how you use personal information, and Termly will create policies that you can publish on your website. Termly's Terms generator also includes support for SMS-specific language.
Whichever option you choose, make sure your policies accurately reflect your organization's actual practices. A policy that does not match what your organization actually does creates legal risk even if a carrier approves your verification request. If you're unsure about your legal requirements, we recommend consulting with a qualified legal professional.
What if I still need help?
If you still need help, you can reach out to our team by clicking the chat bubble in the bottom right corner of your screen on your Gloo Workspace account. While our team cannot offer legal advice, review or draft your documents, or publish these documents for you, we can try to answer any questions you might have.