Restaurant Text Message Marketing Rules for 2027: TCPA, 10DLC

Last verified: October 12, 2026, against the eCFR, FCC orders, federal court opinions, CTIA guidelines, carrier and texting-platform documentation, and state statutes.

This is general information for restaurant owners, not legal advice. For your own texting program, talk to a lawyer who handles TCPA cases.

In March 2024, a judge in St. Louis County, Missouri, gave final approval to a $750,000 class settlement against Ima Pizza, the company behind the &pizza chain, over a mistake any restaurant with a texting tool can make. The class was every person "to whom Ima Pizza has sent text messages after the recipient requested to no longer receive text messages from Ima Pizza," and the court approved $240,000 in attorneys' fees and expenses (final order, Circuit Court of St. Louis County, March 27, 2024). Class members could claim $372 for each text they received after opting out (Top Class Actions, January 2024).

The suits keep coming, and they keep being about basics. In August 2026, a California plaintiff sued Chick-fil-A alleging two marketing texts arrived at 7:22 a.m. and 7:15 a.m. Pacific, before the federal 8 a.m. start, on a number on the National Do Not Call Registry since 2003 (complaint, Lee v. Chick-Fil-A, C.D. Cal., August 13, 2026). Those are allegations, and the case is pending. A month later, a Florida-law class action against Red Robin over texts sent after STOP replies was dismissed on jurisdiction, not the merits (order, Preminger v. Red Robin, M.D. Fla., September 17, 2026).

Now picture a 40-seat ramen shop with an 1,800-person text list (an illustrative example, not a real restaurant). Every number came from an unchecked box at online checkout or a JOIN keyword on a table tent, and every sign-up got one confirmation text. The shop sends three texts a month on Tuesday afternoons, from a registered number, and stops a number the moment someone replies STOP. That's a clean program, and every rule behind it is below.

The rules at a glance

Federal rows apply everywhere. State rows apply when your guests live there, which for most independents means your own state.

Do restaurants need permission to send marketing texts?

Yes. A restaurant needs a guest's prior express written consent before it sends marketing texts with automated texting software, and the carriers that deliver those texts expect written opt-in for marketing no matter how a court reads the law.

The federal rule covers any text "that includes or introduces an advertisement or constitutes telemarketing" sent with automated equipment (47 CFR 64.1200(a)(2)). Consent means a signed written agreement that names the number, clearly authorizes the marketing texts, and says the guest is "not required to sign the agreement" to buy anything (paragraph (f)(9)). The signature can be electronic, "including permission obtained via an email, website form, text message, telephone keypress, or voice recording" (FCC 12-21, February 2012).

An order-ready text is informational, so the written-consent rule doesn't reach it. But CTIA, the wireless industry association, warns that "adding a call-to-action (e.g., a coupon code to an informational text) may place the message in the promotional category" (CTIA Messaging Principles and Best Practices, May 2023). Keep the coupon out of the pickup text.

You may have heard the Supreme Court made this easier: in 2021 it held that an autodialer needs "a random or sequential number generator" (Facebook v. Duguid, April 2021), which many texting platforms lack. Written consent stays the safe standard anyway:

• Do Not Call rules ignore the software. "Texters must have the consumer's prior express invitation or permission before sending a marketing text to a wireless number in the DNC Registry" (FCC 23-107, Federal Register, January 2024).
• States reach further. Florida requires written consent for automated sales texts and allows $500 per text (Fla. Stat. 501.059), and Washington bans commercial texts unless the guest "clearly and affirmatively consented in advance" (RCW 19.190.070).
• Carriers expect it. CTIA's guidelines say businesses should "obtain a Consumer's express written consent to specifically receive marketing messages" (CTIA, May 2023), and law firm Holland and Knight notes carriers made those principles mandatory for business texting (Holland and Knight, May 2026).
• Courts split by region. Since the Supreme Court said trial judges aren't bound by the FCC's reading of the law (McLaughlin v. McKesson, June 2025), the Fifth Circuit has accepted oral consent (Bradford v. Sovereign Pest Control, February 2026) and the Seventh Circuit has barred private Do Not Call suits over texts (Steidinger v. Blackstone, July 2026), each for its own three states only.

A past order is not a substitute. The Do Not Call rules exempt an "established business relationship" for 18 months after a purchase, but that ends when the guest asks you to stop and does nothing for the written-consent rule or the carriers (47 CFR 64.1200(f)(5)). Nor can you borrow numbers from a delivery app; see does DoorDash share customer data with restaurants.

I grew up in my family's small food business in India. There was no brand and no storefront, just a local market and regulars who trusted us. Here's what I think that taught me about texting: a number a guest handed you on purpose is an asset, and a number you pulled off a receipt is a liability.

How do you build a text list the legal way?

You build it from guests who ask to join: a box they tick at your online checkout, a keyword they text from a table tent, or a YES they reply after a phone order. CTIA lists "signing up at a point-of-sale (POS) or other Message Sender on-site location" as a valid opt-in, and says senders "should not use opt-in lists that have been rented, sold, or shared" (CTIA, May 2023).

• Online checkout: a separate, unchecked box under the phone field, with the consent language beside it. A pre-checked box is not a guest agreeing to anything.
• Table tents, receipts, and bag cards: a keyword like JOIN and your number, with the frequency, "msg and data rates may apply," and how to stop.
• The register: invite guests to text the keyword themselves, so the consent comes from their own phone.
• Phone orders: a number taken for a pickup order is not marketing consent. Send one text asking the guest to reply YES, and save the reply.
• Wi-Fi, loyalty, and social: keep the text box separate and unchecked at Wi-Fi or loyalty sign-up (see the restaurant loyalty programs guide), and put the keyword in posts using restaurant social media post ideas.
• Incentives: a welcome offer for joining is fine, as long as nobody has to join to buy anything.

Keep the proof. CTIA lists what to keep for every sign-up: the timestamp, how the guest opted in, the exact language shown, the campaign, the IP address for web sign-ups, the phone number, and who consented (CTIA, May 2023). Federal claims like these generally have a four-year filing window (28 U.S.C. 1658), so keep records at least four years past your last text to that number.

Copy, paste, and fill in the brackets:

CHECKOUT CHECKBOX (unchecked by default)
[ ] Yes, send me recurring automated marketing texts from [Restaurant] at the number above, from [sending number]. Up to 4 msgs/month. Consent is not a condition of purchase. Msg & data rates may apply. Reply HELP for help, STOP to cancel. Terms: [link] Privacy: [link]

TABLE TENT, RECEIPT, OR BAG CARD
Text JOIN to [sending number] for [Restaurant] Text Club specials, up to 4 msgs/month. Msg & data rates may apply. Reply HELP for help, STOP to cancel. Terms and privacy: [link]

FIRST TEXT (send right after sign-up, before anything else)
[Restaurant] Text Club: You're in! Expect up to 4 texts a month with specials and new dishes. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

OPT-OUT CONFIRMATION (one text, no offers)
[Restaurant]: You're unsubscribed and won't get more texts from us.

What has to be in the first text?

The first text has to confirm the sign-up before anything else goes out. CTIA's guidelines say that confirmation should name the program, give a customer care contact or HELP instructions, explain how to opt out, say that messages recur and how often, and disclose any fees in "clear and conspicuous language" (CTIA Messaging Principles, section 5.1.2.1).

The sign-up itself, which CTIA calls the call to action, needs the program, the sending number, who is sending, clear opt-in language with any fees, and terms covering opt-out, customer care, and a privacy policy. CTIA's short code handbook adds the familiar "Message and data rates may apply" line and a frequency disclosure (CTIA Short Code Monitoring Handbook, version 1.9), and reviewers check for them; messaging provider Bandwidth tells customers to "make sure at least one sample message has opt-out language" (Bandwidth, January 2026).

Put the restaurant's name at the start of every text so a guest never has to wonder who's writing. Email runs on a different rulebook, CAN-SPAM, which the restaurant email templates guide covers line by line.

What hours can a restaurant send texts?

Federal rules allow marketing texts between 8 a.m. and 9 p.m. in the guest's local time (47 CFR 64.1200(c)(1)). Several states are stricter, and a Monday to Saturday schedule of 9 a.m. to 7 p.m., with no Sundays or legal holidays, clears every state window in this table.

Read that table as the strictest case. Pennsylvania, Connecticut, and Texas write their hour rules around unsolicited messages, so texts sent with consent or to existing customers likely fall outside them, and Oklahoma's law exempts food sales of $500 or less, existing customers, and retail businesses open a year under the same name (HB 3168). Maryland's hours cover every telephone solicitation (Md. Com. Law 14-4502), Louisiana's apply to "all forms of telephonic solicitation" (LPSC order, March 2021), and Florida's limits are written about phone calls, so treat them as covering texts until a court says otherwise. Even the federal window covers "telephone solicitations," which excludes messages sent with "prior express invitation or permission" (47 CFR 64.1200(f)(15)), and that fight sits at the center of the quiet-hours class actions. None of it is worth litigating over a Tuesday special.

Rhode Island is stricter still for the narrowly defined sellers its law covers, weekdays 9 a.m. to 6 p.m. and Saturdays 10 a.m. to 5 p.m. (R.I. Gen. Laws 5-61-2), and it bans text ads except from businesses with an existing relationship that offer an opt-out (R.I. Gen. Laws 5-61-3.5).

Schedule by where the guest is, not where your kitchen is. People keep their numbers when they move, so use the ZIP code from their orders when your tool allows it.

How often can a restaurant text?

Federal law sets no cap for guests who opted in, but Florida and Maryland allow no more than three solicitations to the same person in 24 hours on the same subject (Fla. Stat. 501.616; Md. Com. Law 14-4502). CTIA's guidelines have you disclose your message frequency at sign-up and set no number of their own (CTIA, May 2023), so the number you promise becomes your practical ceiling.

A sensible starting rhythm is two to four marketing texts a month, each worth opening: a slow-night offer sent mid-afternoon with one deadline, a new dish on launch day, a holiday menu about a week ahead, and a feedback request an hour or two after pickup. Reorder reminders work best as triggered flows rather than blasts, and order updates stay informational, with no coupons.

Welcome, winback, and birthday flows are set up step by step in restaurant marketing automation flows, and the case for a list at all, how few first-time guests return, is in restaurant customer retention statistics.

Does a restaurant need 10DLC registration?

Yes, if you text from an ordinary 10-digit number through a texting platform. Your provider registers your business (the brand) and your texting program (the campaign) with The Campaign Registry, and carriers block unregistered 10-digit business texts.

You never deal with the registry yourself: "direct registration with TCR is not available for Brands," so your texting provider files for you (The Campaign Registry). Twilio's documentation is blunt: "Anyone sending SMS/MMS messages over a 10DLC number from an application to the US must register for A2P 10DLC" (Twilio, July 2026), and Telnyx says unregistered traffic has been "blocked altogether" since February 2025 (Telnyx).

• Brand details: legal business name, address, EIN, industry, contact information, and website (Microsoft Azure Communication Services).
• Campaign details: the use case, a description, sample messages, how guests opt in, your HELP reply, and keywords; "carriers reject campaigns where sample messages don't match the declared use case" (Telnyx), and opt-in "can't be implied" (Bandwidth).
• Registry fees: $4.50 once for a private company's brand, and $1.50 a month for a low-volume campaign up to $10 a month for a marketing campaign (TCR fee guide, August 2026), plus a $15 carrier review per campaign (Telnyx fees). Providers mark these up; Bandwidth lists $9 per brand and $20 a month per standard campaign (Bandwidth fees).
• Per-text carrier fees rose in 2026: T-Mobile's surcharge went to $0.0045 per outbound text on January 19, AT&T's to $0.0035 on April 1, and Verizon's to $0.0050 on October 1 (Bandwidth carrier surcharges).

Toll-free numbers take a different road: since January 31, 2024, "only fully verified toll-free numbers can send traffic," verification "takes about five to six weeks" (Microsoft Azure Communication Services), and since February 17, 2026 applications need a business registration number such as an EIN (Bandwidth). Short codes, the five and six digit numbers big brands use, need every carrier's approval, a process that "generally takes 8 to 12 weeks" (Microsoft, same page).

For a one to three location restaurant, a registered 10DLC number is the usual path. Ask your vendor: is the brand registered under my legal name and EIN, which use case did you register, and what happens if registration lapses?

What happens when someone replies STOP?

You stop texting that number. Under FCC rules in force since April 11, 2025, a guest can revoke consent "by using any reasonable method," the replies stop, quit, end, revoke, opt out, cancel, and unsubscribe count automatically, and the request must be honored "within a reasonable time not to exceed ten business days" (47 CFR 64.1200(a)(10); effective date notice, October 2024).

• One confirmation, no offer. You may send a single text that "merely confirms" the opt-out and contains no marketing; one sent within five minutes is presumed fine (47 CFR 64.1200(a)(12)).
• Other channels count. A voicemail or email asking you to stop creates a "rebuttable presumption" of revocation (paragraph (a)(11)), and CTIA says plain requests like "please opt me out" should be acted on (CTIA, May 2023).
• Don't use the full ten days. A Papa John's customer replied STOP and got texts four and seven days later; the court refused to call that reasonable as a matter of law, and the case settled in 2024, according to compliance firm CompliancePoint (CompliancePoint, archived August 2024).
• Florida has its own clock. Before suing over texts, a Florida guest must reply STOP and allow 15 days (Fla. Stat. 501.059), the rule behind the Red Robin case.
• Keep a do-not-text list. The FCC's internal do-not-call rule says a request "must be honored for 5 years" (47 CFR 64.1200(d)(6)), and Virginia requires at least 10 years for telephone solicitations (Va. Code 59.1-514).

I talk to restaurant owners every week. Here's what I think about STOP: it's a clean exit, not a lost customer. A guest who opts out of texts can still order from your site tomorrow. A guest who keeps getting texts after STOP is a lawsuit looking for a plaintiff.

Can a restaurant text about drink specials?

Only with care. Alcohol is restricted content under carrier rules, so a drink special needs an age-verified list and a texting provider willing to approve an alcohol campaign, and some providers won't approve one at all.

CTIA's handbook puts alcohol in the SHAFT group (sex, hate, alcohol, firearms, tobacco), content that is "either explicitly prohibited or has additional Wireless Provider requirements," and asks for age verification at opt-in, giving "electronic confirmation of age and identity" as the example (CTIA Short Code Monitoring Handbook, version 1.9). Platforms apply it strictly: Twilio requires a 21+ age gate "on all linked websites and opt-in flows" and rejects campaigns whose website "uses a simple checkbox or date-of-birth field" (Twilio, March 2026), Bandwidth says alcohol content is "not allowed on 10DLC or the customer's website at all" (Bandwidth), and Microsoft lists alcohol as ineligible for toll-free verification (Microsoft Azure Communication Services).

For a restaurant with a bar, that means keeping the main campaign about food. If happy hour matters enough to text about, ask your provider in writing whether it supports an age-gated alcohol campaign and which verification it accepts; a reply of YES to "are you 21?" is not the verification these rules describe. Your state's alcohol advertising rules apply on top of any carrier approval.

What changes for restaurant texting in 2027?

Two dated changes are on the calendar: the FCC's rewrite of its opt-out rule, which replaces a January 31, 2027 deadline (FCC DA 26-12), and a stricter identity check for texting brands from January 21, 2027 (Telgorithm).

• The opt-out rewrite. On September 30, 2026, the FCC voted 3 to 0 to replace the "revoke-all" rule (FCC news release). A STOP in reply to a marketing text will revoke consent for all of that sender's marketing texts and calls, an opt-out from an informational text can be limited to that category, and senders may designate an exclusive opt-out method if they disclose it, though the seven standard reply words still count (FCC 26-67, October 2026). It takes effect 30 days after Federal Register publication, superseding the January 31, 2027 waiver date (FCC DA 26-12); law firm Crowell and Moring says that "could be as early as November 2026" (Crowell and Moring).
• More proposals. The same order asks whether to shorten the 10 business day deadline (one industry letter suggests seven), require two-way texting, and require a one-step "revoke all" option, with comments running into early 2027 (FCC 26-67).
• Identity checks for texting brands. Messaging providers report that the registry's Authentication+ 2.0 check expands to all brand types except sole proprietors on January 21, 2027, and that brands registered with a free email address will need government ID authentication (Telgorithm, August 2026). Register with an email on your own domain.
• New state rules, first full year. Pennsylvania's hours took effect October 18, 2026, and Washington cut damages for unlawful commercial texts from $500 to $100 for suits filed from June 11, 2026 (Washington ESHB 2274). We found no state texting law taking effect in 2027 as of October 12, 2026.
• The courts keep splitting. Sonic won dismissal of a Do Not Call text suit in Georgia in April 2026 because texts aren't "telephone calls" (Irvin v. Sonic, N.D. Ga.); a Connecticut court had held the opposite (Wilson v. Easy Spirit, D. Conn.).
• Filings stay high. WebRecon counted 2,810 TCPA suits in 2025 (WebRecon, January 2026), and TCPAWorld counted 1,072 TCPA class actions through May 2026, up 26% from 850 a year earlier (TCPAWorld, July 2026).

For everything else changing next year, from wages to menu prices, see the restaurant industry outlook for 2027.

The restaurant texting compliance checklist

Tape it next to the tablet and run every new campaign past it.

Where DirectOrders fits

DirectOrders is commission-free online ordering for independent restaurants on a flat monthly fee. Every plan includes a branded website with online ordering plus SMS and email marketing, and the restaurant owns its customer data, so the guests who opt in at your checkout are your list rather than a platform's. Pro is $249 a month, and Pro + Voice is $349 with 500 AI phone minutes included, with a 14-day free trial (pricing). The rules in this guide apply to every text you send, whichever tool sends it.

I've watched neighborhood restaurants, a family taqueria, a pho shop, a pizza place, hand a large share of their revenue to platforms that don't share the customer's email address back to them. Here's what I think: a text list built on real consent is one of the few customer relationships no platform can tax.

Sources

All checked October 12, 2026.

• Federal law and FCC: 47 U.S.C. 227 (Cornell LII); 47 CFR 64.1200 (eCFR); 28 U.S.C. 1658 (Cornell LII); FCC 12-21, Report and Order, February 2012; FCC 23-107 summary, Federal Register, January 26, 2024; FCC 24-24 effective date notice, Federal Register, October 11, 2024; FCC DA 26-12, January 6, 2026; FCC 26-67, Report and Order and FNPRM, October 1, 2026; FCC news release, September 30, 2026
• Courts: Facebook v. Duguid, April 1, 2021; McLaughlin Chiropractic v. McKesson, June 20, 2025; Bradford v. Sovereign Pest Control, 5th Cir., February 25, 2026; Steidinger v. Blackstone Medical Services, 7th Cir., July 14, 2026; Wilson v. Easy Spirit, D. Conn., March 31, 2026; Irvin v. Sonic Industries Services, N.D. Ga., April 20, 2026
• Restaurant cases: Giancristofaro v. Ima Pizza final order, March 27, 2024; Top Class Actions on the &pizza settlement, January 11, 2024; Lee v. Chick-Fil-A complaint, August 13, 2026; Preminger v. Red Robin order, September 17, 2026; CompliancePoint on Lourie v. Papa John's, August 2024
• States: Fla. Stat. 501.059 and 501.616; Oklahoma HB 3168 (2022); Maryland Com. Law 14-4502; Connecticut General Statutes chapter 743m; Texas Bus. and Com. Code chapter 301; Utah Code 13-25a-103; Louisiana PSC Do Not Call general order R-35852, March 10, 2021; Pennsylvania SB 992, Act 47 of 2026; Rhode Island 5-61-2 and 5-61-3.5; Washington RCW 19.190.070 and ESHB 2274 (2026); Virginia Code 59.1-514
• Industry and carriers: CTIA Messaging Principles and Best Practices, May 2023; CTIA Short Code Monitoring Handbook, version 1.9; Holland and Knight, May 27, 2026; The Campaign Registry and its fee guide, August 13, 2026; Telgorithm on Authentication+ 2.0, August 28, 2026
• Texting platform documentation: Twilio A2P 10DLC and error 30956; Telnyx 10DLC FAQ, campaign registration, and fees; Bandwidth campaign best practices, 10DLC fees, carrier surcharges, and toll-free BRN requirement; Microsoft Azure Communication Services SMS FAQ
• Litigation trackers and law firms: WebRecon, December 2025 and year in review; TCPAWorld, July 6, 2026; Crowell and Moring on FCC 26-67