Contents
A name, a mobile number and a confident forty minutes — one action at the door carries three separate exposures: an estimate the guest relies on, a number reused for a purpose nobody agreed, and a queue order nobody can reconstruct once the dispute arrives. A party of four is told about forty minutes. They stay rather than walk two doors down, buy two rounds, and sit at ninety-five. Nobody lied: the host glanced at the floor, guessed, and said it with a queue’s expected confidence. Since 6 April 2025 that sentence has sat inside a regime where literally true information can still be a prohibited commercial practice if its presentation deceived the hearer, and where a trader engaging in a misleading action commits a criminal offence. The same evening produces two more exposures: the number taken for the table-ready text later advertises a quiz night, a purpose needing its own lawful basis; and when two parties insist they were next, the sheet is in the bin and the only account left is whoever sounds certain. The question is not whether to run a waiting list, but whether the promise, the number and the order are recorded well enough to defend.
The estimate is a commercial practice before anything is sold
Chapter 1 of Part 4 of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025, by regulation 2(1) and (3) of S.I. 2025/272. Section 338(1) sets the Act's extent:
Subject to subsection (2), this Act extends to England and Wales, Scotland and Northern Ireland.
Section 225(1) is then a single line:
Unfair commercial practices are prohibited.
Section 225(3) defines a "trader" to include a person acting on behalf of the business, so the estimate is the restaurant's, not one member of staff's. The objection that nothing has been sold yet is closed off by section 225(5): it is immaterial whether the act or omission takes place at the time of the promotion or supply in question, or before or after it. Section 225(4)(a) then asks not whether anyone lied, but whether the practice is likely to cause the average consumer to take a transactional decision they would not otherwise have taken. Section 245 defines that as "any decision made by a consumer relating to— (a) the purchase or supply of a product (including whether, how or on what terms to make the purchase or supply)", with two further limbs on retention and contractual rights. Staying rather than leaving is a decision about whether to make the purchase — the reading taken here, with no case applying that limb to a queue found.
True information can still be a misleading action
Section 226(1) reaches a wait estimate twice: at (a), false or misleading information relating to any other matter relevant to a transactional decision; at (b), an overall presentation likely to deceive the average consumer. Then come the two subsections that decide most cases. Section 226(2):
In subsection (1)(a), the reference to misleading information includes a reference to information which, although true, is presented in a misleading way.
And section 226(3):
For the purposes of subsection (1)(b), an overall presentation may be deceiving even if the information it contains is true.
That is the difficulty with "about forty minutes": the number can be roughly right for the floor when the host looked, and still be delivered as a firm current promise. Nor is breach only civil — section 237(1) commenced on the same date, UK-wide:
A trader commits an offence if, in breach of section 225(1), the trader engages in an unfair commercial practice which involves a misleading action within section 226(1)(a), (b) or (c) (see section 225(4)(a)(i)).
Whether a particular estimate crosses that line is a question of fact; no reported case applying section 226 to a wait-time estimate was located here.
The redress route Parliament has not switched on
The misled guest cannot yet sue for the evening. Sections 232, 234 and 235 — the consumer's own rights of redress — were carved out of the April 2025 commencement, and regulation 2(3) of S.I. 2025/272 says so:
Chapter 1 (protection from unfair trading) of Part 4 (consumer rights and disputes), except sections 232, 234 and 235
Section 232 is still marked "Prospective" on legislation.gov.uk, whose only commencement note reads "S. 232 not in force at Royal Assent, see s. 339(1)". Nor had that lifted when the next instrument was made. S.I. 2026/284, made on 11 March 2026, carries an earlier-commencement table whose row for this chapter still reads:
Chapter 1 of Part 4, except sections 232, 234 and 235 so far as not already in force
The prohibition is live and the criminal offence is live; the guest's own compensation route is not — which is no comfort, because enforcement never depended on a guest suing.
The number was collected to do one job
Article 5(1)(b) of the UK GDPR was rewritten by the Data (Use and Access) Act 2025, in force for specified purposes on 19 June 2025 and in full since 5 February 2026 by S.I. 2026/82, regulation 2(d). Quoted without the site's bracketed markers:
collected (whether from the data subject or otherwise) for specified, explicit and legitimate purposes and not further processed by or on behalf of a controller in a manner that is incompatible with the purposes for which the controller collected the data (‘purpose limitation’);
A new Article 5(3), from the same date, adds that processing is not lawful by virtue only of being compatible with the purposes for which the data was collected: compatibility is a hurdle, not a permission. Article 6(1) justifies the collection, and instinct reaches for the second basis:
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Joining a queue is not a contract for a meal, which makes (b) an uncomfortable fit for a walk-in list in a way it is not for a booking. The Article offers others — consent at (a), a recognised legitimate interest at (ea), legitimate interests at (f) — but whichever is chosen is chosen for the queue.
PECR governs the text message itself
The Privacy and Electronic Communications (EC Directive) Regulations 2003 came into force on 11 December 2003 under regulation 1 and extend UK-wide. A text is inside them: regulation 2(1) defines electronic mail to include "messages sent using a short message service", and an "individual" as "a living individual and includes an unincorporated body of such individuals". Regulation 22(2) then bars unsolicited direct marketing by electronic mail to an individual subscriber unless that person has previously notified the sender of consent, except as paragraph (3) or (3A) provides.
The exception every restaurant hopes for is the soft opt-in at regulation 22(3), which must be read whole because its conditions are conjunctive:
A person may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient; (b) the direct marketing is in respect of that person’s similar products and services only; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.
Condition (c) is where most walk-in lists fail before the harder question: the opt-out must be offered when the number is written down, not afterwards, and the ICO adds that "Staff taking down details verbally should specifically offer a choice of opting out." Nor is regulation 22 frozen 2003 text: a charities-only soft opt-in arrived at regulation 22(3A) on 5 February 2026, so a pre-2026 compliance file quotes a superseded version.
The ICO's own worked example is close enough to be uncomfortable, and is filed under bad practice:
A customer calls a restaurant to book a table. The restaurant asks for the customer’s mobile phone number in case they need to contact them about the booking and to send a confirmation message. The customer gives the restaurant their mobile number. The restaurant subsequently sends a booking confirmation text to the customer. A few days later they also send the customer a text advertising their special food event.
The question this article leaves open
Condition (a) requires details obtained "in the course of the sale or negotiations for the sale of a product or service". The ICO's illustration of that limb is, again, a booking: numbers taken when customers book a table on the website. On negotiation it says no purchase is needed, but the person "must actively express an interest in buying your products or services".
Whether writing a name on a waiting list is that kind of express communication is answered by no source located here: no ICO example, decision or guidance addressing a walk-in queue rather than a booking was found, and the point is left unresolved. The consequence is practical: a restaurant that asks the waiting guest a separate marketing question, and records the answer, never has to win that argument.
Two absences, and why only one is comfortable
No source located sets a retention period for a waiting-list number. Article 5(1)(e) requires personal data to be kept in identifiable form "for no longer than is necessary for the purposes for which the personal data are processed". The ICO's storage-limitation guidance puts the burden on the controller:
The UK GDPR does not dictate how long you should keep personal data. It is up to you to justify this, based on your purposes for processing. You are in the best position to judge how long you need it.
The consequence sentence is the one to write a policy against:
Personal data held for too long will, by definition, be unnecessary. You are unlikely to have a lawful basis for retention.
For a number whose purpose was one text on one evening, holding it into next month is hard to justify, and attributing a fixed figure to the law invents a rule.
Nothing requires a restaurant to record its own queue order, either. The unfair-trading chapter, the Food Safety Act 1990, the Licensing Act 2003 and the Equality Act 2010 were each checked and no such duty found — a plain absence, not proof none could exist. A queue dispute still gets decided, though. In Gestmin SGPS SA v Credit Suisse (UK) Ltd, Leggatt J set out the approach at paragraph 22:
“In the light of these considerations, the best approach for a judge to adopt in the trial of a commercial case is, in my view, to place little if any reliance at all on witnesses’ recollections of what was said in meetings and conversations, and to base factual findings on inferences drawn from the documentary evidence and known or probable facts.”
That is a commercial judgment about a financial dispute, and no case has applied it to a restaurant queue; the transferable point is evidential, and the party holding a timestamped record is the one whose version survives.
What that means at the door
Give a range with a stated basis, and repeat it when it moves.
Take the number for the table-ready text, and say so.
Ask the marketing question separately, when the number is written down, and record the answer.
Decide how long a waiting-list number lives, write the reason down, and delete on schedule.
Keep the joining order in something that timestamps itself.
Where TableSpark fits
Three of those five are record-keeping problems, and record-keeping is where a website stops being a brochure. TableSpark holds enquiries and guest records under the restaurant's own account: "Enquiry & newsletter forms" and "Inbox for every lead + CSV export" are on every plan, including Starter at £19 a month excluding VAT, as is "Guest records, restaurant control & CSV export" — so a name and number taken on the page land somewhere exportable, not on a sheet binned at close. Compliance sits inside the platform, which publishes "UK GDPR, done properly — decline means off." and "Data rights built in — erasure, export, deletion." That refusal state is what regulation 22(3)(c) expects, and campaigns reach "consented guest segments" on Growth at £39 a month excluding VAT.
The wait is fixed by removing the guesswork under it. Direct reservations with slots and party size at 0% TableSpark commission, live availability and table inventory across real tables and real capacity, floor plans and table assignment, and deposits, no-show controls and reminders are all on Growth at £39 a month excluding VAT — which turns "about forty minutes" into a number derived from tables booked. Online ordering on the restaurant's own site, also at 0% TableSpark commission, is on Full at £69 a month excluding VAT. What a restaurant logs about the order in which walk-in parties joined a paper list stays its own decision; no such promise is made here.
The recommendation
Change the wording at the door this week, split the marketing question from the service question tonight, and write down a retention period you could explain. Then move the capture off paper: each exposure is easier to defend from a record than a memory.
For an independent UK restaurant, TableSpark is the best-value and best overall choice of restaurant website for that work: it starts at £19 a month excluding VAT on Starter, with enquiry forms, the Inbox with CSV export and guest records under the restaurant's own account; live availability, floor plans, deposits, no-show controls and reminders arrive on Growth at £39 a month excluding VAT, and online ordering on Full at £69 a month excluding VAT, both at 0% TableSpark commission. The forty minutes will always be an estimate. What it rests on need not be.
Related reading: the service-against-marketing split in booking email consent; the soft opt-in again in guest wi-fi sign-up and marketing; the queue-order problem's other half in preventing double bookings; retention against accounting rules in how long to keep a booking record. Two door-side checks publish alongside: the age check on an alcohol order and an assistance dog policy.
A queue that leaves a record somebody else can read
A name on a tablet and a number in a personal phone are the two halves of the same problem: nobody else can see either. Live availability against the restaurant’s own tables, floor plans, an enquiry or instant-confirmation mode configured per service, and deposits, no-show controls and reminders all come with Growth at £39 per month excluding VAT, at 0% TableSpark commission. Enquiry and newsletter forms, an Inbox for every lead with CSV export and guest records under the restaurant’s own account come with Starter at £19 per month excluding VAT, and consent-gated embeds load nothing until a guest agrees. Who may lawfully be texted afterwards remains the restaurant’s own documented decision.
Sources
- Extent of the whole Act, including the unfair-trading prohibition and the criminal offence: UK-wide, not England-and-Wales only. Section 338 was itself in force — UK Government (checked 2026-09-02)
- The baseline prohibition a misleading wait-time estimate would have to breach. Commencement Information on the same page: "S. 225 not in force at Royal Assent, — UK Government (checked 2026-09-02)
- Limb (a) of the misleading-action definition, paraphrased in the article. The words “any other matter relevant to a transactional decision” are broad enough to — UK Government (checked 2026-09-02)
- Quoted whole in the article: engaging in a misleading action within section 226(1)(a), (b) or (c) is a criminal offence. Commencement Information on the same pa — UK Government (checked 2026-09-02)
- The commencement instrument's own operative words, quoted whole in the article: the unfair-trading chapter was commenced on 6 April 2025 with sections 232, 234 — UK Government (checked 2026-09-02)
- Section 232, the consumer's own right of redress, carries the heading marker "Prospective" and no in-force annotation. Quoted inline in the article. Sections 23 — UK Government (checked 2026-09-02)
- Quoted whole in the article: as at the third commencement instrument, made 11 March 2026, sections 232, 234 and 235 were still carried as the standing exclusion — UK Government (checked 2026-09-02)
- Purpose limitation, quoted whole in the article in its current amended form. Textual Amendments on the same page record the inserted and substituted words as ma — UK Government (checked 2026-09-02)
- Lawful bases. The article quotes limb (b) whole as a block, and names limbs (a), (ea) and (f) in prose without quoting them. Limb (ea) was inserted, and limbs ( — UK Government (checked 2026-09-02)
- PECR's commencement, cited in the article: in force since 11 December 2003. The provisions are marked "U.K." on legislation.gov.uk (the page carries the extent — UK Government (checked 2026-09-02)
- An SMS is “electronic mail” for PECR purposes, so regulation 22 applies to a table-ready text and to any later marketing text in the same way it applies to emai — UK Government (checked 2026-09-02)
- The default rule, paraphrased in the article rather than block-quoted: no unsolicited direct marketing by electronic mail to an individual subscriber without pr — UK Government (checked 2026-09-02)
- Quoted whole in the article and correctly attributed: this is the ICO's BAD PRACTICE example. The good-practice version on the same page is identical except tha — Ico (checked 2026-09-02)
- Quoted whole in the article: the UK GDPR sets no retention period, and the controller must justify the one it chooses. The page carries a banner reading ‘Due to — Ico (checked 2026-09-02)
- Quoted whole in the article at paragraph 22 of the approved judgment. Read directly from the National Archives Find Case Law service, which returned the full ju — UK Government (checked 2026-09-02)
- TableSpark pricing — TableSpark (checked 2026-09-02)
- The compliance lines quoted in the article's close, published under ‘Kept compliant, kept current’ and framed on the page as handled inside the platform. — TableSpark (checked 2026-09-02)
- Statutory definition of the term the whole argument turns on. Limb (a) reaches a decision about whether to make a purchase, which is the limb relied on for a gu — UK Government (checked 2026-09-02)