Can you email guests who booked a table? Soft opt-in, consent and the new PECR fines

January is quiet, the booking system holds four thousand email addresses, and the January offer is written (if it is not, our January marketing guide has a plan). The question is which of those guests you are allowed to send it to.

In the UK, you can send a marketing email to a guest who booked a table only if they agreed to receive it, or if you can rely on the "soft opt-in". The soft opt-in needs all of these: you collected the email yourself, while the guest was buying or negotiating to buy; you only market your own similar products; you offered a simple opt-out when you collected it; and every email offers one again. Guests who booked through another company's platform do not qualify. Since 5 February 2026, breaking these rules can cost up to £17.5 million or 4% of worldwide turnover, whichever is higher.

This guide covers guests who booked or ordered without joining a loyalty scheme. For messages to members, see our loyalty programme guide.

Last checked: 5 November 2026.

Can I send marketing emails to guests who booked a table?

Yes, to some of them. Marketing emails and texts to individuals are governed by regulation 22 of the Privacy and Electronic Communications Regulations (PECR), alongside UK GDPR. You need one of two things for each guest:

The soft opt-in conditions, from the ICO's electronic mail marketing guidance:

1. "You obtained the recipient's contact details" yourself, not from a third party.
2. You did so "while selling or negotiating to sell a product or service".
3. "You are only marketing your similar products and services": your menus, events, gift vouchers, a new site. Not a partner's wine club.
4. You "provided the recipient with an opportunity to refuse or opt out" when you collected the details.
5. You "give the recipient an opportunity to refuse or opt out in every subsequent communication".

Condition 4 is where most restaurants fall down. The ICO says an opt-out box "hidden within your privacy policy" is not enough, and neither is one that appears only in a confirmation email. It must be offered when the guest gives you the address: a box on the booking form, or a question from the person taking a phone booking.

Does a table booking count for the soft opt-in?

Very probably, and the ICO's own examples are about restaurants. Its electronic mail guidance gives three that matter here:

• Condition 1, met. "A restaurant collects mobile phone numbers from customers when they book a table on their website. By collecting the contact details themselves, the restaurant satisfies this first part of the soft opt-in."
• No choice offered, so no marketing. A customer phones to book, gives a mobile number for the confirmation, and a few days later gets a text about a special food event without ever being asked. The ICO lists this as bad practice: with no choice at booking, there is no consent and condition 4 fails.
• The fix. The same phone booking, but staff ask whether the guest would like marketing texts, the guest agrees, and the date and time are recorded. The ICO lists this as good practice.

Condition 2, "negotiating to sell", is the one the ICO does not settle for bookings. It says a person "doesn't need to actually buy anything" but must actively express an interest in buying, such as requesting a quote or a free trial; browsing a website is not enough. A table booking commits the guest to a time and often a deposit, a firmer step than a quote. Our reading is that a direct booking meets condition 2, but that is a judgement, not a ruling. Take advice if your list is large.

How common cases sort:

What about bookings from Google, booking apps and delivery platforms?

The soft opt-in is not available when someone else collected the details: the ICO's guidance says they must come from the person directly, not through a third party. For these guests you need consent, and consent collected by a third party only counts if it named your restaurant and the channel. The ICO also says that "you should not use consent for direct marketing that was given via a third party more than six months ago" in general (ICO, plan direct marketing).

The practical fix is to ask again yourself. When a third-party guest arrives, staff can offer the same opt-in your own booking form uses. Once they say yes to you, the consent is yours.

Work email addresses. An office party organiser booking with a company email is a "corporate subscriber". According to the ICO, corporate subscribers can receive marketing emails without consent or a soft opt-in. Sole traders and ordinary partnerships still count as individuals, and UK GDPR still applies to a named person's work email. Identify yourself and offer an opt-out in every email either way.

Are booking confirmations and reminders marketing?

Not while they stay neutral. The ICO treats messages sent for administrative or customer service reasons, such as confirmations and reminders, as service messages, not direct marketing (ICO, identify direct marketing). Your logo in the email does not change that.

A reminder becomes marketing if it promotes something: "See you on Friday. Have you seen our Christmas menu?" In that case the marketing rules apply to that message, even though promotion is not its main purpose. Keep confirmations and reminders clean, and put offers in emails sent only to guests with consent or a valid soft opt-in. Our no-show guide covers what a good reminder says.

What are the fines for breaking PECR now?

Far higher than before. Since 5 February 2026, the Data (Use and Access) Act 2025 applies the UK GDPR penalty regime to PECR. A breach of regulation 22 (email and text marketing) carries the "higher maximum amount" in section 157 of the Data Protection Act 2018: for a business, "£17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher". Under the old regime, PECR fines were capped at £500,000.

Sources disagree on the turnover base. The statute settles it: total annual worldwide turnover, for the previous financial year.

Worked example. A three-site restaurant group turning over £6 million: 4% of turnover is £240,000, so the maximum is the higher figure, £17.5 million. The 4% limb only matters for businesses turning over more than £437.5 million. For every independent restaurant, the ceiling is £17.5 million. These are maximums; the ICO sets each penalty by the seriousness of the breach. The risk to take seriously is the size of the ceiling, not a likely fine.

Consent wording you can copy

On your booking form (an unticked box, separate from the booking terms):

[ ] Send me news, menus and offers from [Restaurant] by email.
    You can unsubscribe at any time.

Use the same box on a newsletter sign-up on your website; our restaurant website guide covers what else the site should hold.

Soft opt-in version (if you will rely on the soft opt-in instead, the guest must be able to refuse at this point):

We'll email you occasional news and offers about [Restaurant].
[ ] Tick here if you'd rather not hear from us.
You can also unsubscribe from any email.

Phone bookings (staff script):

"Can I take an email for the confirmation? ... Thank you. We send
the occasional email about new menus and events. Would you like
those, or just the booking confirmation?"
Record: YES / NO, date, staff initials.

Footer for every marketing email:

You're receiving this because you booked or bought from [Restaurant]
and agreed to hear from us. Unsubscribe in one click: [link]
[Restaurant name], [address]

The ICO says unsubscribing must be simple and free: one click or a reply, not a login or a phone call.

Checklist before you send

EMAIL MARKETING CHECKLIST (UK)

For every address on the list
[ ] Consent recorded (what, when, how, wording shown)  OR
[ ] Soft opt-in: collected by us, during a booking or sale,
    opt-out offered at the time
[ ] No third-party bookings unless consent named us (< 6 months)
[ ] Unsubscribed and "do not market" guests removed

The email
[ ] Only our own food, drink, events, vouchers or venues
[ ] Sender clearly us; unsubscribe link works in one click
[ ] Booking reminders kept free of offers

Records
[ ] Consent and opt-out records kept with dates
[ ] Suppression list kept so opt-outs are never re-added
[ ] Retention periods set (see our data retention guide)

How long to keep consent records and the suppression list is covered in our guest data retention guide. Check with an adviser for your situation.

Can TablePort handle this for you?

TablePort's Marketing Suite builds the consent checks into sending:

1. Every send passes a consent check. Campaigns and automations go only to guests who have agreed to hear from you.
2. Unsubscribe in every email. Guests control topics in a preference centre, and a guest who opts out stays opted out unless they choose to rejoin.
3. Imported lists are checked. Guests imported from a CSV file are deduplicated and checked for consent.
4. Journeys with consent checks. Automations trigger when a guest newly qualifies, with delays, exclusions, cooldowns and consent checks.

Marketing Suite is £99 a month per business, excluding VAT, with 10,000 sends a month included. The limit: it records and checks consent; it cannot decide whether a soft opt-in applies to your guests. See TablePort Marketing Suite.