Do QR code menus need cookie consent?

Only for non-essential cookies and tracking, such as analytics or advertising. Strictly necessary cookies, like a language setting, generally do not need consent.

Can a restaurant ask for an email to view the menu?

It is poor practice and likely collects more data than necessary. Let guests view the menu freely and offer sign-up separately.

Is the restaurant or the menu provider responsible under GDPR?

Usually the restaurant is the controller and the provider is a processor, set out in a data processing agreement, though it depends on the setup.

Do I need a privacy notice for my QR menu?

Yes, if personal data is processed, which includes technical data such as IP addresses. A short, plain-language notice linked from the menu is enough for most view-only menus.

Where should menu data be stored?

Preferably in the EEA. Transfers outside it need appropriate safeguards under the GDPR, so ask your provider where data is hosted.

QR code menus and GDPR: privacy, cookies and what guests should expect

By the Menulta editorial team · Facts checked 15 October 2026 · Updated 15 October 2026

The short answer

Viewing a QR code menu is like visiting a website: the provider's servers receive technical data such as the IP address, device type and language, and the page may use cookies. Under the GDPR and the ePrivacy rules, non-essential cookies and tracking need the guest's consent, and personal data must be handled lawfully and transparently. The simplest, most trusted approach is a menu that opens without sign-up, collects only what it needs, and explains this in a short privacy notice.

What data a QR menu typically processes

Technical data needed to deliver the page: IP address, browser, device type, language.
Optional analytics: which dishes are viewed, how long guests stay, which language is used.
Cookies or local storage: for language preference, consent choices or analytics.
If ordering or payment is offered: names, table numbers, order details and payment data.
If sign-up is required: email addresses or phone numbers.

Cookies and consent

Under the ePrivacy Directive, storing or reading information on a guest's device, for example with cookies, generally needs consent unless it is strictly necessary to provide the service the guest asked for. Remembering a language choice can be strictly necessary; analytics and advertising cookies usually are not. A menu that loads tracking scripts before the guest agrees is a compliance risk and a trust problem.

Consent banners are themselves a design challenge on menus, because they cover the dishes. The cleanest solution is to avoid non-essential cookies on the menu page, or to keep the banner small and let guests read the menu without choosing.

Avoid unnecessary data collection

The GDPR's data minimisation principle says to collect only what you need. Requiring guests to give an email address or phone number just to view a menu collects data you do not need for that purpose and puts guests off. If you want to build a mailing list, offer it separately and clearly, with consent, not as a gate in front of the menu.

Who is responsible

Usually the restaurant is the controller for guest data processed through its menu and the menu provider acts as a processor, although the exact roles depend on the setup. A data processing agreement should set out what the provider does with the data, where it is stored, which subprocessors are used and how long data is kept. Ask your provider for these documents before you go live.

Questions to ask your menu provider

Data protection questions for QR menu providers
Question	Why it matters
Does the menu set non-essential cookies?	Consent is needed before they load
Where is data stored?	Transfers outside the EEA need safeguards
Which subprocessors are used?	You need to know who handles guest data
Is there a data processing agreement?	Required where the provider is a processor
Can guests view the menu without signing up?	Data minimisation and guest trust
How long is data kept?	Storage limitation principle

Building guest trust

Guests are increasingly wary of scanning codes that ask for personal details. A menu that opens instantly, shows dishes without pop-ups and links to a short, plain-language privacy notice earns trust. It is also simpler to run, because the less personal data you collect, the less you have to protect.

Analytics without tracking guests

It is possible to learn how your menu is used without tracking individuals. Privacy-friendly analytics tools count page views, languages and popular dishes without cookies or personal identifiers. That gives you useful insight, such as which languages your guests use and which dishes they look at, while avoiding consent banners and keeping guest trust.

Ordering and payments

If your QR menu lets guests order or pay, more personal data is involved: names, table numbers, order history and payment details. Payment data should be handled by a recognised payment provider, not stored by the menu system. Explain in your privacy notice what you keep, why and for how long, and delete order data you no longer need.

Sources

This guide is general information, not medical or legal advice. Guests with an allergy should follow their doctor's advice. Operators should confirm their own setup with their food safety adviser or local authority.