Visit Website →
← Back to blog

GDPR SMS Consent for Waitlists and Queues: A Practical Guide

October 25, 2026
GDPR SMS Consent for Waitlists and Queues: A Practical Guide

To text someone under GDPR, you need a lawful reason and honest disclosure. For marketing texts, that reason is almost always specific, freely given consent. A "your table is ready" message is different from a promotion, and keeping the two apart is the single most useful thing you can do. This guide covers how to collect SMS consent at a waitlist or queue, what to record, when the existing-customer exception applies, and what to do when someone asks you to delete their number. It is written for operators of restaurants, clinics, barbershops, food trucks and events, including US businesses whose guests include people in the EU or UK.

Ezseat
Let Guests Follow the Queue Online
Ezseat lets guests join a queue through a web browser, helping operators manage customer flow without relying on SMS updates.
Visit Ezseat

TL;DR

  • Valid consent is freely given, specific, informed and unambiguous. It needs an active step, such as an unticked box. Pre-ticked boxes and "by joining you agree to everything" do not count.
  • Keep two things separate: a service text about the person's place in line, and marketing texts. Never make promotional consent a condition of joining the queue.
  • Log the proof: the wording shown, a timestamp, the IP address and the form version, plus a quick way to delete data everywhere it lives.
  • GDPR is not the only rule. US numbers fall under the TCPA, and UK numbers under PECR alongside UK GDPR.
  • The most defensible setup for a waitlist is a browser-based queue where the guest watches their position on a web page, and SMS is optional.

Table of Contents

Does GDPR apply to a US business?

It can. GDPR protects people in the EU, and it can reach businesses outside Europe that offer services to them or monitor their behavior. Your Europe, the EU's official business portal, sets out the consent rules in plain language. A pizzeria in Ohio with no EU customers is not the target. A festival, a tourist-heavy restaurant or a clinic serving international patients may well be handling EU or UK numbers.

You may also serve people in several places at once, so three regimes matter:

Where the recipient isMain rules for textingWhat to take from it
EUGDPR plus the ePrivacy Directive and national lawsConsent for marketing, with national variations
UKUK GDPR plus PECRMarketing texts need specific consent, with a narrow exception for existing customers
USTCPA and FCC rules, plus state lawsMarketing texts sent with automated technology generally need prior express written consent

The practical answer is to build one consent flow that meets the strictest standard, rather than one per country. The rest of this guide describes that flow. If you operate in a specific country, check its national rules with a local privacy lawyer or data protection officer. Several EU states add their own details on top of the shared framework.

GDPR consent has four properties. It is freely given, specific, informed and unambiguous. In practice that means an active, positive action from the person. Guidance on UK SMS marketing gives the standard examples: ticking an unchecked box or pressing a confirmation button counts, while pre-ticked boxes and consent bundled into general terms do not.

The European Data Protection Board's guidelines on consent add a useful nuance: explicit consent does not always require a signed statement. A clear action in a digital form can do the job. You do not need a paper signature at the host stand.

A wording that works

Put a short, plain sentence next to an unticked box, directly above the join button:

"Text me when my table is ready. Message and data rates may apply. Reply STOP to end."

For marketing, use a second, separate box:

"Send me occasional offers from [Business name] by text. I can opt out at any time."

Then link your privacy notice right beside the button. Say who you are, why you want the number, how long you keep it and how to withdraw. Give the person real choice: a guest who skips the marketing box must still be able to join the queue.

Do not bundle

If you collect consent for several purposes, each needs its own opt-in. Klaviyo's guidance on UK GDPR and PECR stresses that people should be able to opt into one channel without being forced into others. A guest might want a text about their table, never an email, and never a promotion. Your form should allow exactly that.

Why "legitimate interest" is a weak shortcut

Some operators try to rely on legitimate interest for promotional texts to avoid the friction of asking. For direct marketing by SMS, that rarely holds up in Europe, because the separate electronic marketing rules ask for consent in their own right. Klaviyo's overview of GDPR and SMS in Europe lists the EU GDPR and the ePrivacy Directive with national laws as the key rules. Asking clearly is simpler and safer.

Service texts versus marketing texts

This is where waitlists get easier than newsletters. A guest who joins your queue wants one thing: to know when it is their turn. A message that does only that is a service message tied to the request they just made. A message that says "come back Friday for half-price dessert" is marketing.

The cleanest approach has three parts:

  1. Tell the guest at the point of joining that you will text them about their place in line, and ask for the number only for that purpose.
  2. Keep the content transactional. Position, "your table is ready," "we are running about ten minutes behind." No upsells in the same message.
  3. Ask separately for marketing. One extra unticked box, after the guest has joined or on the confirmation screen, never blocking the join.

Whether a particular service message needs consent as its legal basis, or can rest on the contract or a legitimate interest, depends on the country and the exact message. Settle it with your privacy advisor, then write the basis into your privacy notice. The sensible default for a small operator is to ask for the number with a clear, unticked box anyway, because it also gives you proof the guest wanted the text.

In the US, the same split exists under the TCPA. Plain informational texts such as reminders typically need prior express consent rather than written consent, as long as the message has no promotional content. If you run appointments as well as queues, reducing appointment no-shows is a good example of where reminders and consent rules meet.

The existing-customer exception, and why to be wary of it

UK rules include the so-called soft opt-in. The UK regulator's guide says you can message people who bought, or negotiated to buy, a similar product or service from you, if you offered a simple way to opt out when you collected their details and in every message you send.

Three conditions trip operators up:

  • The details must come from a sale or negotiation. A name left on a walk-in waitlist, with no purchase, is not the same thing.
  • The products must be similar. A barbershop texting about a different business owned by the same person does not qualify.
  • The opt-out must be offered twice: at collection and in every later message.

The same UK guidance notes that many operators apply the exception to all existing customers, which overreaches. Relying on explicit opt-in for everyone is usually the more manageable path. It is also the only approach that works the same way in every country, since the exception is not a universal GDPR rule.

For businesses that text marketing messages to US audiences too, a deeper look at when marketing texts can go out with consent or under the existing-customer exception helps you decide which path fits your customer list.

Records: the part auditors actually ask about

The most common failure is not a bad form. It is having no proof. Plenty of owners assume a phone number in the system implies permission. FollowTheDuck's GDPR waitlist checklist lists what to keep so that you can answer a regulator or a guest who claims they never signed up: the IP address, a timestamp, the exact wording shown and the form version. A guide to GDPR email consent for waitlists gives the same list and adds that you should name your processors in a privacy notice linked from the form.

That same checklist makes a point we agree with: waitlist compliance is mostly operational discipline, not an engineering feat. Say clearly why you want the number, keep a log of when and how the person agreed, and have a fast process to delete data on request.

A simple record for each guest looks like this:

FieldExample
Consent typeQueue service text / marketing text (separate rows)
Wording shownThe exact sentence, saved as a version
Form versionv3, updated 2026-09
Timestamp2026-10-23 18:42
IP addressAs captured at submission
WithdrawalDate and channel if the guest opted out

A confirmation step helps too. A "double opt-in," where the guest enters a number and then confirms through a code or link, is not required everywhere, but it is widely recommended as the strongest proof that the person owns the number. For marketing consent it is worth the extra tap. For a live queue, where speed matters, a single clear opt-in for the service text is usually enough.

Deletion and withdrawal

People can withdraw consent at any time, and it should be as easy to withdraw as it was to give. Two practical rules:

  • Honor STOP immediately and keep a suppression record, so you do not text the same number again by accident.
  • Delete everywhere. A frequent mistake is removing someone from the active list while the number lingers in backups, analytics or a CRM. A guide to waitlist consent points out that a compliant workflow must find and delete an individual's data across every connected platform, not just the queue tool.

Map your data once. Write down where phone numbers can end up: the queue system, a spreadsheet exported at the end of a shift, a marketing platform, an accounting export. If you run a website that sets trackers or logs consent, a resource such as operational controls for GDPR on US sites can help you check the web-facing side of the same job.

We build queue software for restaurants, clinics, food trucks, barbershops and events, and we have watched the same pattern at hundreds of door stands: operators collect phone numbers because texting feels like the default, then discover that every number is a small compliance duty. Our view is simple.

First, a guest does not need to give you a number to wait in line. With a browser-based queue, the guest scans a QR code, joins on a web page and watches their position there. No app download, no account. Texting then becomes an option for people who want it, not a toll for everyone.

Second, public screens and ticket numbers take care of the rest. A screen showing "now serving 42" processes no personal data at all. Operators can run their queue from a phone or tablet, and our system offers public screens, reception kiosks and custom queue fields, so you can ask only what you genuinely use.

Our perspective: the best consent is the one you never need — overview diagram

Third, when a guest does want an SMS or call, treat it like any other personal data: ask for it plainly, use it for the stated purpose, and delete it when the visit is over. Fewer numbers collected means fewer to protect, log and erase.

We would rather help you ask for less than help you defend more. If you want to see the tradeoffs in practice, our guides on SMS queue notifications and when to use SMS versus a call show how operators decide.

— Ezseat

A compliant waitlist flow, step by step

Here is a flow you can adapt for a restaurant door, a clinic reception or an event line:

  1. Offer a no-number option first. Let guests join with a name or party size and watch a web page or a public screen. Our guide to a QR code waitlist setup explains the entry point.
  2. Ask for a number only if the guest wants a text. One field, one unticked box, one sentence explaining the purpose.
  3. Link your privacy notice beside the button, with controller identity, retention period and how to withdraw.
  4. Keep marketing separate. A second unticked box that never blocks joining the queue.
  5. Log the evidence: wording, form version, timestamp and IP.
  6. Send only what you promised. Queue position and turn alerts, nothing promotional in the same text.
  7. Delete on a schedule. Remove numbers shortly after the visit unless the guest opted into marketing, and apply the same deletion to exports and backups.
  8. Review twice a year. Check the wording, the processors you use and your deletion log.

If the SMS cost per guest is also a concern, our breakdown of waitlist SMS costs shows why many operators move to browser waitlists and send fewer texts.

Special cases

Clinics. A patient's place in a clinic line can hint at health information. Keep messages neutral, avoid naming the reason for the visit, and take advice from your privacy professional or data protection officer about special-category data. Our phone queue management guide covers practical setups for clinics.

Events. Crowds mean many people, often from many countries. Put the consent wording on the QR landing page in the local language and keep the number optional. Delete ticket-holder numbers once the event ends.

Food trucks and barbershops. Short visits mean you rarely need a number for more than an hour. A fast deletion routine is easy and defensible. The simplest rule is to hold the number only while the guest is waiting.

Mistakes to avoid

  • Pre-ticked boxes, or "by joining you agree to everything."
  • Adding people to a marketing list because they gave a number for the queue. A pre-ticked marketing box is not consent under GDPR, as FollowTheDuck notes.
  • Collecting numbers at the door and never saying what for.
  • Exporting a spreadsheet and forgetting it on a shared drive.
  • Treating a deletion request as complete after clearing one tool.
  • Making marketing consent a condition of getting served.
  • Assuming US-style "text STOP" language is enough for EU recipients without a lawful basis and a privacy notice.

What this looks like in Ezseat

Ezseat is a web-based queue management system, so guests join from the browser and nothing needs to be downloaded. You run the queue from your phone or tablet, show ticket numbers on a public screen, and add custom fields only for what you need. SMS and call notifications are available when a guest wants them, and we do not charge per message.

Plans are published on our site: Light at $3.90 per month or $39.00 per year, and Pro at $14.90 per month or $149.00 per year. Both start with a free two-month trial, so you can test a consent-light flow on a real shift before you pay.

FAQ

Is GDPR required in the USA?

No US law copies GDPR, but GDPR can still apply to a US business that serves or monitors people in the EU. If your guests include Europeans, handle their data to that standard. For US recipients, the TCPA and state laws set their own consent rules.

Do I need consent to text someone their queue position?

A text about a service the person just asked for is different from marketing, and the legal basis can vary by country. The safest habit is to ask with a clear, unticked box and to say what the number will be used for. Confirm the legal basis for your market with a privacy lawyer or data protection officer.

Is double opt-in mandatory?

Not universally. It is widely recommended because it proves the person owns the number and leaves a clear audit trail. Use it for marketing lists, and consider a single clear opt-in for time-sensitive queue alerts.

Can I text my past customers without asking again?

In the UK, only within the narrow existing-customer exception: similar products, details collected in a sale or negotiation, and an opt-out offered at collection and in every message. Elsewhere the rules differ. Asking for fresh, explicit consent is simpler and works in more places.

Keep the exact wording shown, the form version, a timestamp and the IP address, as recommended for waitlists. Store them with the number, and keep a record of any withdrawal.

Sources