September 4, 2026. Toll-free verification just grew two mandatory fields, and the deadline behind them is two weeks away. HighLevel's September 2 changelog states it plainly: the form now asks for a Privacy Policy URL and a Terms and Conditions URL, and "carriers will begin rejecting any new toll-free verification without both links on September 15, 2026." If you plan to stand up a toll-free number for a client this month, the blocker is no longer the messaging use case you write. It is whether the client's website has two pages that actually resolve.
What changed on the form
- Two new required fields sit on Step 3, the messaging use case, directly below the opt-in workflow images. Neither is optional, and the submission cannot be sent until both are filled.
- Steps 1 and 2 are unchanged, so business details and number selection work exactly as before.
- Already verified numbers are out of scope. HighLevel states they need no update and no re-verification. This applies to new submissions only.
- The hard date is September 15, 2026, after which a submission without both links is rejected outright rather than queried.
- The failure used to be invisible. The form previously did not ask, so a missing policy page only surfaced days later as a carrier rejection with no obvious cause.
Toll-free is finishing its move to 10DLC rules
This is the second tightening of toll-free verification inside a year, and the direction has been visible for a while. Twilio announced in June 2025 that it would start collecting Business Registration Numbers on new toll-free verifications from September 30 that year, and said the field would become mandatory in early 2026. Industry write-ups at the time described the same package landing on January 1, 2026: a business registration number, the issuing country, and an entity type, with sole proprietors facing extra vetting.
Put the two steps together and the strategy they were aimed at is finished. For years toll-free was the easy lane, the way to start sending without going through campaign registration. Registration number in January, policy links in September, and toll-free now asks for most of what A2P 10DLC campaign registration asks for. There is no low-friction lane left, only two lanes with similar paperwork.
Notice what the new requirement actually is, because it changes who fails. A privacy policy is not the deliverable. A URL is. The check is whether a link resolves to a page on the sender's own site, which is a different problem from having the document. Plenty of small businesses have a privacy policy sitting in a PDF, in a form footer, or on a funnel page that was never given a permanent address. Those clients pass a paperwork audit and fail this form.
What it means for operators
Audit the clients you have not registered yet, not the ones you have. Existing verified numbers are explicitly out of scope. The exposure is the pipeline: every client you onboarded recently, every sub-account waiting on a number, every campaign scheduled to launch in the next quarter.
Make two live URLs part of onboarding. Add privacy policy and terms pages to the intake checklist beside the logo and the domain, and publish them on the client's own domain rather than a builder subdomain. It costs an hour at kickoff and removes a rejection loop that costs days.
Submit before September 15 if the pages already exist. Both fields are live now, so a verification you can complete this week is a verification you are not resubmitting under the stricter regime.
Do not let an unverified number keep sending quietly. HighLevel shipped a change on September 4 that automatically picks a different eligible number when the one a customer called cannot send SMS, and it names unverified toll-free numbers as one of the cases it is designed to rescue. That is a useful safety net and a bad steady state, because your follow-up then arrives from a number the customer never dialed. Getting numbers properly verified is part of every GoHighLevel build we run, and it is the first thing we check before pointing a lead generation campaign at a new account.
Frequently Asked Questions
HighLevel added two required fields to the toll-free verification form: a Privacy Policy URL and a Terms and Conditions URL. Both sit on Step 3, the messaging use case, below the opt-in workflow images, and a submission cannot be sent without them. Steps 1 and 2 of the form are unchanged.
September 15, 2026. HighLevel's changelog states that from that date carriers will begin rejecting any new toll-free verification submitted without both links. The fields are already live, so a submission made before the deadline can include them today.
No. HighLevel states that existing verified numbers are out of scope and need no update or re-verification. The requirement applies to new toll-free verification submissions only, which means your exposure is the clients and sub-accounts still waiting on a number rather than the ones already sending.
A link that resolves to the message sender's own privacy policy, and a matching link for terms and conditions. The practical trap is that the requirement is a working URL rather than a document, so a policy that exists only as a PDF, inside a form footer, or on a page without a permanent address will not satisfy it. Publish both pages on the client's own domain before you submit.