Consent: the part of marketing that has a legal department attached

This chapter is general information about how consent works in marketing operations, not legal advice: for your own programme, take advice from a lawyer in your jurisdiction. What follows is the operational shape that compliant restaurant messaging takes, and the record-keeping that makes it defensible.

What prior express written consent means in practice

In the United States, marketing text messages generally require prior express written consent under the TCPA. The requirements are specific and the penalties are assessed per message, which is why a modest list can produce a very large claim.

• Affirmative action by the consumer. A ticked box they ticked themselves, a keyword they texted, a form they submitted. Never pre-selected.
• Clear disclosure at the point of consent: that they will receive marketing messages, from whom, roughly how often, that message and data rates may apply, and how to stop.
• Not a condition of purchase. Stated explicitly. You may not require SMS consent to place an order or join a loyalty programme.
• Separate from other agreements. Bundling SMS consent into terms acceptance or a loyalty signup is the single most common defect.
• Retained records. Timestamp, source, the exact language displayed, and the identifier of the person consenting.

A consent record that would survive a challenge

The question in any dispute is what the customer actually saw and did. A record that cannot answer that is not much of a record.

Store the wording, versioned. "They ticked a box" is not a defence if nobody can say what the box said.

Opt-out has to work everywhere, instantly

STOP and its common variants must be honoured immediately and across every campaign, every journey and every store. The failure mode that causes real trouble is a customer who opted out of one campaign still receiving another because the suppression was applied at list level rather than at contact level.

Enforce suppression at send time against a single authoritative record, not at list-build time. Email unsubscribes have a ten-business-day window under CAN-SPAM but there is no operational reason not to honour them immediately, and every reason to.

Email rules are lighter but not absent

CAN-SPAM requires accurate header and sender information, a non-deceptive subject line, identification of the message as an advertisement, a valid physical postal address, a working opt-out mechanism, and opt-outs honoured promptly.

Other jurisdictions are stricter. GDPR and UK PECR generally require consent for marketing email to individuals and grant additional rights over data. If you have customers in those jurisdictions, the operational answer is to run the stricter standard everywhere rather than to maintain two systems.

Who is responsible in a multi-location business

Consent is generally given to a specific brand or entity, and consent collected by one franchisee does not automatically extend to another or to the franchisor. Multi-unit and franchise operators need this settled in writing before any list is combined, because merging lists across entities is one of the more common ways a compliant programme becomes non-compliant overnight.

Questions