Consent is permission to contact someone, for a stated purpose, on a stated channel, recorded in a way you could show to somebody later. Opt-in is one mechanism for obtaining it: the guest performs an action that means yes.
The two words get used interchangeably and it causes real trouble, because you can have an opt-in with no meaningful consent behind it, and you can have consent that no opt-in ever recorded.
This is a plain description of the principles, and it is not legal advice. The rules genuinely differ depending on where you and your guests are, and they change. If you operate in more than one country, or you have just acquired a site, that is a question for a lawyer rather than for a blog.
The distinction that matters most is purpose
A guest gives you an email address so you can send a booking confirmation. That is a transactional purpose, and the message about their table is expected — they would be annoyed if it did not arrive.
A newsletter is a different purpose. So is a win-back, an event invitation, and a birthday message with an offer attached. The address is the same; the permission is not.
"They gave us their email at booking" is the most common consent error in restaurants. What they gave you was a way to be told the table was confirmed.
Express and implied
Express consent is the guest actively agreeing: a box they ticked that was not pre-ticked, a form they filled in, a reply saying yes. It is unambiguous and you can point at it a year later.
Implied consent is inferred from a relationship — the guest is an existing customer and would reasonably expect to hear from you. Some jurisdictions recognise a version of this for existing customers, usually narrowly drawn, usually time-limited, and usually only for things similar to what the person originally bought.
The practical position: build on express consent and treat any implied-consent argument as a fallback you would rather not have to make. Express consent travels better between jurisdictions, is far easier to defend, and produces a list of people who want to hear from you — which is also the list that performs.
Per channel, always
Consent is not one switch. Email, SMS, telephone, and post are separate channels with separate expectations, and messaging apps are a conversation of their own again.
SMS is the one restaurants overreach on most often, because the number was collected for a very specific reason — to text a guest when the table is ready — and repurposing it for marketing is visible and irritating. Guests treat a marketing text as more intrusive than a marketing email, and they are right to.
- Record consent per channel rather than per guest.
- A guest who happily reads your monthly email may want nothing to do with a text, and the reverse happens too.
- A withdrawal on one channel is not automatically a withdrawal on all of them — but honour it broadly when the guest is plainly telling you to stop.
- Keep transactional messages separate from marketing in whatever system sends them, so an unsubscribe never stops a booking confirmation.
What a consent record should contain
The purpose of a record is that somebody can answer, eighteen months later, the question "why did we email this person." A tick in a column does not answer it.
GUEST an identifier, not just a name CHANNEL email / SMS / phone / post PURPOSE marketing / transactional / both STATE given / withdrawn / never asked SOURCE where it happened — booking form, host stand, event sign-up, import, in person TIMESTAMP when CAPTURED BY the person or the system WORDING what the guest actually agreed to, or a reference to which version of the wording was on screen at the time That last field is the one nobody keeps and the only one that answers the question when it is finally asked.
Where restaurants get into trouble
Six situations account for most of it, and none of them involve anyone behaving badly on purpose.
- Imported lists. A file from an agency, a previous owner, or an event partner. You did not obtain the consent and generally cannot describe it.
- Acquisitions. Guests who agreed to hear from a restaurant that no longer exists under that name. Whether that carries over is a real question worth asking properly.
- Host-stand sign-ups. A clipboard with no wording on it records enthusiasm rather than consent.
- Group-wide assumptions. Permission given to one brand is not automatically permission for the others, however the company is structured internally.
- Pre-ticked boxes. Widely disallowed, and separately a poor way to build a list, since it fills up with people who were not paying attention.
- "We have always emailed them." Duration is not permission. It is exposure with a longer history attached.
The commercial argument happens to agree
The tidy thing about consent is that doing it properly makes the marketing better rather than worse.
A list of people who actively said yes opens more, complains less, and does not damage your sending reputation — which is the mechanism deciding whether your email reaches anybody at all. The alternative, a large list assembled from everywhere, produces an impressive number in a report while quietly worsening deliverability for the guests who did want to hear from you.
If you are choosing between a big list and a clean one, take the clean one. It is one of the rare cases where the careful option is also the one that performs.