GDPR and WhatsApp marketing: the UK rules for restaurants and takeaways

You can send marketing on WhatsApp in the UK, but only to people who agreed to it or who fall under the "soft opt-in". Two sets of rules apply. PECR (the Privacy and Electronic Communications Regulations) decides whether you may send an electronic marketing message. UK GDPR covers how you collect, use and keep customers' phone numbers. WhatsApp adds its own rule: people must opt in to hear from your business by name.

Order updates such as "your food is ready" aren't marketing. Offers, new-dish news and "we miss you" messages are.

Collect opt-ins where customers already order.

Create your free ordering page

Which rules apply to which WhatsApp message?

Tip: don't slip an offer into an order update. The ICO says a service message that includes advertising or marketing material becomes direct marketing, and WhatsApp may also charge it at the marketing rate. See marketing vs utility messages.

PECR: does it cover WhatsApp?

PECR's marketing rules cover "electronic mail", and the ICO reads that broadly. Its detailed guidance lists email and texts, picture and video messages, voicemail, in-app messages and direct messages on social media, and its short guide adds "any similar message that is stored electronically". The ICO doesn't name WhatsApp, but a WhatsApp message to a customer fits that description, so treat WhatsApp marketing like text message marketing.

Under PECR, you can only send marketing messages to individual customers if one of these is true:

1. They gave consent: they actively agreed to marketing from you.
2. The soft opt-in applies: an existing customer, under the conditions below.

These rules protect individual subscribers, which the ICO says includes sole traders and ordinary partnerships. You can send marketing to corporate subscribers (limited companies, LLPs, Scottish partnerships), for example a corporate catering client's office, without consent or a soft opt-in. Whoever you message, you must not hide who you are, and you must give a valid contact address for opt-outs. UK GDPR still applies if you message a named person at a company.

What counts as consent

• The customer actively agreed, for example by ticking a box or replying "YES".
• It was specific: clear that it's for offers from your business, sent by WhatsApp.
• No pre-ticked boxes, and no "by ordering you agree to our marketing" line. The ICO gives that exact wording as an example of what doesn't work.
• You can show when and how they agreed.

The soft opt-in (for existing customers)

You can message an existing customer without fresh consent if all of these apply:

• You collected their number yourself while selling to them or "negotiating" a sale. Placing an order counts. So does asking for a catering quote or for details of what you offer. A general question that isn't about buying (say, whether you're opening another branch) doesn't.
• The offer is for your own similar products, meaning your food and drink.
• You gave them a simple way to say no at the moment you took their number, for example an opt-out box at checkout. Adding an opt-out later, in the order confirmation, is too late: the ICO uses a takeaway pizza order as its example of exactly this mistake.
• Every message includes a free way to opt out (apart from the normal cost of sending a reply).

The soft opt-in doesn't cover:

• numbers from a bought, borrowed or shared list (the ICO says there is no such thing as a "soft opt-in compliant" third-party list)
• people who only followed your Channel or asked a question that wasn't about buying from you
• another business in your group, such as a sister restaurant that's a separate company

Every marketing message must

• say who it's from, clearly
• give an easy, free way to opt out, such as "Reply STOP to stop offers"
• stop once someone opts out, and keep a do-not-message list

UK GDPR: looking after customers' numbers

A customer's phone number, name and order history are personal data. UK GDPR asks you to:

• Have a lawful basis. For order updates, it's usually the contract (they ordered). For marketing, the ICO says your basis is likely to be consent if you rely on PECR consent, and legitimate interests if you use the soft opt-in (do a short legitimate interests assessment and keep it).
• Tell people. Your privacy notice should say you use WhatsApp to send order updates and, if they agree, offers. Mention that messages pass through WhatsApp (Meta) and your software provider. See do I need a privacy policy to take orders on WhatsApp?
• Collect only what you need. A number and a name is enough. Don't ask for birthdays unless you'll use them.
• Keep it safe. Use a business phone, not a staff member's personal mobile. Remove ex-staff from linked devices and dashboards.
• Don't keep it forever. Decide how long you keep lapsed customers' details, write that period down, and delete them when it ends.
• Respect rights. Anyone can ask for a copy of their data or ask you to delete it. The right to object to direct marketing is absolute: if they say stop, you stop.

WhatsApp Business app warning: the app reads the contacts on the phone it's installed on. Keep that phone for business contacts only.

Groups expose numbers. Members of a WhatsApp group can see each other's numbers. Don't add customers to groups without asking. Use broadcasts or a Channel instead. More: can a restaurant create a WhatsApp community?

ICO fee: the ICO says organisations, including sole traders, that use personal information need to pay a data protection fee unless they're exempt. Use the ICO's fee checker to see whether you need to pay and which tier applies.

WhatsApp's own opt-in rule

Even where UK law allows a message, WhatsApp has its own rules. Its Business Messaging Policy (last updated 23 September 2026) and Meta's opt-in guidance say:

• You may only contact people who gave you their number and opted in to messages from you.
• The opt-in must clearly say they're opting in to messages from your business, and name your business.
• The opt-in doesn't have to mention WhatsApp by name for Meta's purposes, but it must comply with local law, which in the UK means PECR and UK GDPR. Naming WhatsApp is the safer choice for PECR consent.
• Meta suggests either one opt-in that covers each kind of message you'll send (order updates, offers) or separate opt-ins per kind, plus clear instructions on how to opt out, and you must honour every opt-out.

Breaking these rules can get your number limited or banned. See why WhatsApp Business accounts get banned.

Copy-ready opt-in wording for restaurants

Swap the [brackets] for your details. Keep any consent box unticked by default.

At online checkout (consent):

On a counter card or table tent (consent):

When a customer messages you (consent):

For the soft opt-in (at checkout, when you take the number):

Footer for every offer:

Keep a record of each opt-in: the date, the wording shown and where it happened.

The stakes: fines and complaints

• The ICO can take enforcement action against businesses that send unlawful marketing, including fines.
• The Data (Use and Access) Act 2025 changed PECR and the ICO's powers. The ICO says all of its provisions affecting data protection law and PECR are now in force. Its short Guide to PECR still says it's under review because of the Act, and its detailed guidance on electronic mail marketing was updated on 28 April 2026. Check both before you change your process.
• Complaints also hurt on WhatsApp: blocks and reports lower your quality rating and can limit your sending.

Most restaurants will never face a fine. But a sloppy list will get you blocked, reported and, in time, banned.

How Menuthere helps you stay on the right side

• Order updates and offers are separate. Order updates go as utility messages; offers go as marketing broadcasts (Pro).
• STOP is automatic. Customers who reply STOP, "unsubscribe" or similar go on a blocklist and never get another broadcast. Comeback messages and basket reminders skip them too.
• Your own number, your own list. Customer data stays in your dashboard, and messages come from your business, not a shared number.
• Every offer links to your menu, so customers who opted in can order in a couple of taps.

Source: Menuthere docs, "Opt-outs and the blocklist" and "Broadcasts". WhatsApp marketing tools are on Pro (US$39 a month, billed in US dollars; your bank converts it). Menuthere is an official Meta Tech Provider: Meta bills your own WhatsApp account directly, and Menuthere adds no markup (see WhatsApp Business API pricing in the UK). See WhatsApp marketing for restaurants.

WhatsApp marketing compliance checklist

• Opt-in box at checkout, unticked, naming your business and WhatsApp
• For the soft opt-in: a "no thanks" box shown when you take the number, not afterwards
• Opt-in records kept (date, wording, source)
• No bought, borrowed or scraped numbers
• "Reply STOP" in every offer, and STOP honoured straight away
• Order updates kept free of promotions
• Privacy notice mentions WhatsApp, Meta and your software provider
• Legitimate interests assessment written down if you use the soft opt-in
• Business phone used, not staff mobiles
• No customers added to groups without asking
• Retention period set and lapsed contacts removed
• ICO data protection fee paid (unless exempt)

Build your list the right way, at the point of order.

Create your free ordering pagebook a demo (opens in a new tab)