Restaurant Email Marketing in the UK, Done Legally

Picture an ordinary list that grew without a plan. There are 600 addresses in a spreadsheet someone started in 2021. A booking tool holds another batch, exported once and never refreshed. A newsletter tool has a third, with a free plan that quietly became a paid one when the count passed a threshold. Some guests appear in all three. A few asked to be removed from one and are still on the others. Nobody can say, for a given address, when the guest agreed to hear from you or in what words they were asked.

That is the position in which a Friday-night offer gets sent. If it goes to a guest who never agreed, and who is not covered by the narrow exception for existing customers, the restaurant has broken the Privacy and Electronic Communications Regulations (PECR). The penalty ceiling for that kind of breach changed on 5 February 2026. Under the legislation as it now reads, a breach of regulation 22 can attract a fine of up to £17.5 million or 4% of an undertaking's worldwide turnover, whichever is higher. The earlier PECR ceiling was much lower.

Here is what the evidence does and does not show. In this research, no case was found in which the regulator fined a restaurant, pub or other hospitality business for email or text marketing. The fines that have been published are against volume senders: Allay Claims Ltd (£120,000) and ZMLUK Limited (£105,000), announced on 20 January 2026, and KRA Consultancy Ltd (£300,000), announced on 23 June 2026. The closest food business is HelloFresh, fined £140,000 in January 2024 for a campaign of 79 million emails and 1 million texts. None of them is a restaurant, and the conduct behind most of them pre-dates the new ceiling. What they do show is the regulator's method: it asks whether the sender can prove consent or the soft opt-in, and it looks at what happens after someone says stop.

The cost of not emailing is quieter but real. Zonal, in research with CGA by NIQ published on 30 April 2026 and drawn from over 5,000 British hospitality guests, found that 34% of guests are likely to switch to a different restaurant brand if they spot something better, against 29% for pubs and 30% for bars. Among people who dine out weekly, 41% say they are very or somewhat likely to choose a different venue, 17 percentage points higher than the 24% of those who go out less often. These are stated intentions, not measured lapses, and this research found no dated UK source that counts how many guests a typical independent actually loses. But the direction is plain: your most frequent guests are the ones most open to going elsewhere, and they are the ones you have the most contact details for.

So the owner has two problems at once. The list is too tangled to email safely, and it is too valuable to leave unused. The rest of this guide takes them in order: where a lawful list comes from, what the rules require, what separate tools really cost as the list grows, what to send, and how to set it all up so the guest record, the consent record and the campaign sit in one place.

A restaurant has an advantage most retailers lack. Guests hand over their details at the moment they are buying from you. They book a table, place an order, send an enquiry about a private event, or sign up on your site for news. Each of those is a contact collected directly, by you, with a purchase or a prospective purchase attached. That matters because the law treats those moments differently from an address you found, bought or borrowed.

There are four honest sources.

• Bookings. The guest gives a name, an email and usually a phone number so you can confirm the table.
• Direct orders. Collection and delivery orders placed on your own site carry the same details.
• Enquiries. A private-dining or event enquiry is a clear case of someone negotiating for a service.
• Sign-up forms. A newsletter box on your site is a guest actively asking to hear from you.

One source that looks tempting is not on the list. An address scraped from a Google review, an Instagram comment or a bought file gives you no basis to send marketing. The regulator's own guidance says there is no such thing as a third-party marketing list that is compliant with the soft opt-in. If you have been offered one, the article on why a third-party list does not make you soft opt-in compliant explains the trap.

The practical question is where those four sources land. If the booking tool holds bookings, the website form tool holds enquiries, the till holds orders and a fourth tool sends the email, then you are the integration. Every export is a snapshot that starts ageing the moment you make it. An opt-out recorded in the email tool does not travel back to the booking tool, and a booking made yesterday is not on the list you uploaded last month.

One guest record fixes this by design. The booking, the order and the sign-up all write to the same profile, so the consent state is a property of the guest rather than of whichever tool they happened to pass through. In TableSpark, a guest profile is built the moment someone books a table, sends an enquiry or joins your mailing list, with no import step. The restaurant booking system feeds that same record, and the Guests page shows each profile's bookings, enquiries and subscription state together.

This section covers email to individual subscribers, which includes most diners. Corporate subscribers, such as a company booking a team dinner from a work address, are treated differently: the regulator's guidance says you can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in. Even then, you must not hide your identity and you must give a valid address for people to opt out. This guide did not verify how a sole trader is classed, so treat a small business address cautiously.

Regulation 22(2) of PECR says a person must not send unsolicited direct marketing by electronic mail "unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender." The consent has to be real. The regulator's guidance says you must not use pre-ticked opt-in boxes, silence or inactivity as evidence of consent, and that consent is unlikely to be valid if agreeing to marketing is a condition of buying. UK GDPR points the same way: Article 7(4) tells you to take utmost account of whether a service is made conditional on consent that is not needed for it, so a booking form must let the guest book without ticking.

Good consent has five features.

1. A separate box or choice, unticked, rather than a line buried in terms.
2. Your restaurant named, and email named as the channel.
3. A record of who agreed, when and how. The guidance asks you to keep exactly that, and its restaurant example shows a verbal consent on a phone booking logged with the time and date.
4. Easy withdrawal. Article 7(3) says it must be as easy to withdraw as to give consent.
5. No transfer. The guidance says consent is not transferrable; it is specific to marketing from you to that address.

Regulation 22(3) lets you email without fresh consent when three conditions are all met: you obtained the recipient's contact details in the course of the sale or negotiations for the sale of a product or service; the marketing is for your own similar products and services only; and the recipient was given a simple way to refuse, free of charge, when the details were first collected and again in every later message.

The regulator uses a restaurant to illustrate the first limb: "A restaurant collects mobile phone numbers from customers when they book a table on their website. By collecting the contact details themselves, the restaurant satisfies this first part of the soft opt-in." Its counter-example is a restaurant that buys a list from a third party who calls it "soft opt-in compliant"; the exception does not apply because the restaurant did not obtain the details directly.

Three readings of those words matter to an owner.

• A guest does not have to buy. The guidance says it is enough that negotiations for the sale took place, which means the guest actively expressed interest in your products or services. An enquiry about a private dinner counts. Someone merely browsing your menu page does not.
• "Similar" means yours. The exception covers your own food, drink, events and offers. The guidance says you must not use it to send messages about other organisations or their products and services, so a partner's wine club mailing is out.
• The opt-out has to be offered twice. Once when the details are collected, and again on every email. The guidance also says an opt-out box hidden within a privacy policy is not a simple way to refuse.

If one condition fails, you are back to consent. For a longer treatment of the booking case, this guide to booking-email marketing consent walks through the wording.

Regulation 23 says you must not send direct marketing by email where the sender's identity has been disguised or concealed, or where a valid address to which the recipient may send a request that the emails stop has not been provided. That applies to individual and corporate subscribers alike.

A booking confirmation or a reminder that only confirms the table is part of the service. An email that promotes an offer, an event or a new menu is marketing, even if it is attached to a booking. The ICO's guidance gives a bad example: a restaurant sends a booking confirmation and a few days later sends a text advertising a food event without ever asking for consent. In its January 2026 announcement, the regulator also rejected a company's description of promotional texts as "service updates", calling them "direct marketing communications designed to prompt action". Keep the two kinds of message visibly separate, in content and in design.

If someone opts out, the guidance says you must stop sending unsolicited electronic mail marketing under the soft opt-in. Under data protection law people have an absolute right to object to direct marketing, and if they object you must stop using their personal information for it. The guidance tells you to add their details to a "do not contact" or suppression list. An unsubscribe click normally applies to email only, so a separate decision is needed if you also text.

Open tracking has its own rule: the guidance says tracking pixels fall under PECR's separate rules on storage and access technologies, so check what your tool tells the guest.

The Data (Use and Access) Act 2025 transfers the functions of the Information Commissioner to a body called the Information Commission, and that section came into force on 30 September 2026. The ICO's web pages read for this guide still use the "ICO" name. The penalty ceiling described above applies to sends made on or after 5 February 2026; an earlier breach is dealt with under the old rules.

The pricing pages tell a consistent story: you pay by the size of the list, and the list is what you are trying to grow. Here is how it looks for one popular provider, read on its own GBP page.

Mailchimp's Standard plan costs £15.24 a month at 0 to 500 contacts, £34.29 at 501 to 1,500, £45.72 at 1,501 to 2,500 and £76.20 at 2,501 to 5,000. The page does not say whether VAT is included. It also says overages apply if the contact or email send limit is exceeded, and it lists 6,000 sends a month on Standard. A restaurant with 2,500 contacts that emails once a week sends 2,500 × 4 = 10,000 emails a month, which is above that allowance. Crossing 2,500 contacts moves the bill from £45.72 to £76.20, which is £30.48 more a month, or £365.76 more over a year.

Other pages price differently, and those differences make a straight comparison misleading.

• Square Marketing, an email add-on to a Square account, charges £9 a month for 0 to 500 contacts, £29 for 1,001 to 2,000 and a figure in between for 501 to 1,000, and asks you to look up pricing above 2,000.
• Brevo prices by monthly email volume rather than contacts: £6 a month for Starter, quoted at 5,000 emails a month, and £13 for Standard, the tier its page lists for automation and A/B testing. Removing the Brevo logo is a £7.20 a month add-on. Its page does not state a contact cap.
• Constant Contact's UK page quotes £4, £8, £21 and £89 a month for its four plans at the 0 to 500 contacts tier, with VAT not included, and says the plan price is based on contacts and sends, with overage fees possible. Its higher tiers were not captured for this guide.
• Team-Connect sells prepaid email credits: £14.99 for 1,000, £59.99 for 5,000, £139.99 for 15,000 and £289.99 for 50,000, which its page prices at £0.015 down to £0.005 per email, and says the credits never expire.

These prices are not like-for-like, because the providers charge for different things: contacts, sends, credits, add-ons. None of the email tools above holds a booking, an order or a table. Whatever you pay them is the price of a mail drop, and the guest record is still somebody else's job.

Take a restaurant with 2,500 guests on its list. Run the numbers for two routes. In the first, the restaurant buys an email tool and a reservation system and moves guests between them. In the second, it uses one plan where the guest record and the campaigns share a database.

For the first route, take the Mailchimp Standard tier at 1,501 to 2,500 contacts: £45.72 a month, so £45.72 × 12 = £548.64 for the year. A table-booking system also has to be paid for, and simpleERB's published Plus plan is £47 a month, listed for 1,200 covers, so £47 × 12 = £564. Together that is £45.72 + £47 = £92.72 a month, or £548.64 + £564 = £1,112.64 for twelve months. That total still has no website, no direct ordering, and no CRM line, because no verified published price for a restaurant CRM was found for this guide, and none is invented here.

For the second route, TableSpark's Growth plan is £39 a month excluding VAT, so £39 × 12 = £468 for the year excluding VAT, or £390 excluding VAT on the yearly price. That includes direct reservations with deposits and reminders, the guest records, the email campaigns and the guests' app. The gap between the two routes on the figures above is £1,112.64 minus £468, which is £644.64. The other providers' pages do not all state their VAT treatment, so treat the gap as a guide, and read each page before you commit.

The numbers leave out the cost that does not appear on a pricing page: your time. Each separate tool is a place where a guest can be missing, duplicated or wrongly subscribed. You export from the booking tool, clean the file, import it, rebuild segments and repeat after every busy weekend. When a guest unsubscribes in the email tool, you must tell every other tool. The ICO's guidance expects an opt-out to be honoured, and a suppression list only works if it is the one list every tool checks.

The list is only worth the care if the emails bring people through the door. The evidence on what works is thin and mostly from outside the UK, so treat every figure below as a benchmark to check against your own results.

Brevo's "Email Marketing Benchmarks 2026", dated 27 May 2026, is built on aggregated, anonymised data from over 175,000 active Brevo customers across 2025. It is global, not UK-specific. For Hospitality & Food Services it shows a 19.01% open rate, a 2.15% click-through rate and a 0.62% unsubscribe rate. It also shows a 36.69% open rate that includes Apple Mail Privacy Protection, and the page itself warns that this feature registers an "open" even if the recipient never views the message. The practical lesson is to judge a campaign by clicks, bookings and orders, not by opens.

Bloom Intelligence's "Restaurant Email Marketing Benchmarks 2026", published in September 2026, covers hundreds of restaurant locations in the US and Canada, from January 2025 to August 2026, and is a software vendor's own network data. It reports that blast emails averaged a 19.5% open rate, a 0.7% click rate and a 0.27% return-visit rate, while a new-guest welcome email returned 7.2% of recipients, an at-risk win-back 6.5%, a visit-milestone email 19.8% and a post-visit thank-you 29.9%. Take it as US and Canada data matched by the vendor's own identity system, not a UK promise. In that vendor's data, emails tied to something the guest did returned far more guests than the blast average.

Zonal's research gives the reason: 54% of consumers said they would be more likely to return to a venue when they feel personally valued by a brand during their visit. A message that knows what the guest did is a way of showing that. In practice, five emails cover most of what an independent needs.

1. A welcome email when a guest first joins, thanking them and saying what to expect.
2. A thank-you the day after a visit, which is the natural first journey.
3. A win-back note for guests who have not booked for a while.
4. A birthday or occasion note, where the guest gave the occasion when booking.
5. A quiet-night fill, sent to your regulars or VIPs when a particular Tuesday looks light.

Keep the sender recognisable, the subject honest and the unsubscribe link easy to find, and do not send a promotion under a service subject line. The 0.62% unsubscribe figure in Brevo's global table is the highest among the rows read for that page, which is a reminder that guests do unsubscribe when the volume or the relevance slips. If you are starting from nothing, the guide on how to send a restaurant email newsletter covers the first send.

That last item matters more than it looks. A sign-up box on a page that Google may not reliably read is a box nobody finds. TableSpark bundles crawlable restaurant content, titles and descriptions, canonical URLs, sitemaps, robots controls, Restaurant and LocalBusiness schema, internal links, mobile-first output and managed search-verification set-up into every plan. Indexing and ranking remain decisions for Google, so no outcome is promised, but the groundwork is done for you rather than assembled separately.

The decision is whether you want to be the integration. Once bookings, orders and sign-ups all feed guests, the cost of reconciling them starts to exceed the cost of a subscription, and the legal risk sits in the gaps between tools.

If you answered yes to two or more, the one-record route is the cheaper and safer path for an independent restaurant.

These steps follow the emails, campaigns and journeys tutorial and the know-your-guests guide, on a Growth or Full plan.

• Run the Win-back segment first. Its audience is the guests who have drifted, which are the guests most likely to be looking elsewhere.
• Use Send test to my email on every campaign, including small ones.
• Keep service wording (confirmed, reminder) in Settings, Email, and promotions in Compose, so the two never mix.
• Fourteen emails are already sent for you. Edit the wording once, so a confirmation sounds like your restaurant.

An independent restaurant should not need an email tool, a booking system, a CRM and a spreadsheet to answer one question: who has agreed to hear from us? TableSpark starts at £19 a month excluding VAT and puts the guest record, the Inbox, the CSV export and the newsletter forms on every plan. From Growth, at £39 a month excluding VAT, the same account sends email campaigns to consented segments, sends guest email from your own domain, runs journeys, and carries the direct reservations, deposits and reminders that feed the list. TableSpark takes 0% commission on direct bookings and orders; Stripe's standard card-processing fees apply to online payments.

Guest records are stored under your restaurant's TableSpark account, visible in its Inbox and guest list and exportable as CSV: your records, in your account, exportable. That is why TableSpark is the best-value and best overall choice for an independent UK restaurant that wants to email its guests lawfully without paying for four tools and reconciling them by hand. Compare the tiers on the pricing page and choose the one that matches how you book and sell.