Building an email and text list for a new café, legally

Instagram decides who sees your posts. Google decides where you rank. Your own list of customers who asked to hear from you is the one channel nobody else controls. When the pumpkin cold brew comes back, one email or text reaches the people who asked to be told.

It's also the channel with the most law attached. Email has CAN-SPAM. Texts have the Telephone Consumer Protection Act (TCPA), which lets people sue, plus state laws such as Florida's. This guide covers the rules a café is most likely to run into and how to collect sign-ups the right way from day one.

It's the fourth post in our Marketing a new café series.

This is general information, not legal advice. Texting rules in particular are changing: the FCC adopted new opt-out rules on September 30, 2026 that weren't in effect when we checked on October 5, 2026. Have your texting provider or a lawyer review your sign-up wording.

Email: the CAN-SPAM rules

The FTC's compliance guide lists what every commercial email must do (FTC: CAN-SPAM Act compliance guide):

• "Don't use false or misleading header information." Send from your café's real name and address.
• "Don't use deceptive subject lines."
• "Identify the message as an ad."
• "Tell recipients where you're located. Your message must include your valid physical postal address."
• "Tell recipients how to opt out of receiving future marketing email from you."
• "Honor opt-out requests promptly." That means "within 10 business days", without a fee or extra steps, and your opt-out mechanism must work "for at least 30 days after you send your message."
• "Monitor what others are doing on your behalf." You "can't contract away your legal responsibility to comply with the law."

Three more points from the same guide:

• Opted-out addresses stay out. Once people opt out, "you can't sell or transfer their email addresses, even in the form of a mailing list."
• Business email counts too. "The law makes no exception for business-to-business email." That matters if you email offices about catering.
• The penalties are real. The FTC states that "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088" (the FTC adjusts this figure for inflation).

The statute itself requires the ad identification, the opt-out notice and "a valid physical postal address of the sender" (15 U.S.C. 7704(a)(5)).

Any good email service builds in the unsubscribe link and the address footer. Your job is to fill in a real address, keep subject lines honest and never re-add someone who left.

Texts: the TCPA and written consent

Texts are where cafés get into trouble, because the consent rules are stricter and individuals can sue.

Marketing texts need prior express written consent. The FCC's rule bars any call "that includes or introduces an advertisement or constitutes telemarketing, using an automatic telephone dialing system or an artificial or prerecorded voice" to a cell phone without "the prior express written consent of the called party" (47 CFR 64.1200(a)(2)). The FCC's consumer guide says it plainly: "Commercial texts require written consent; for informational texts, your consent may be oral" (FCC: stop unwanted robocalls and texts).

What written consent means. Under 64.1200(f)(9), it's "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver" marketing messages, with the phone number. It must disclose that the person "is not required to sign the agreement ... as a condition of purchasing any property, goods, or services." An electronic signature counts where federal or state law recognizes it.

Other rules that apply to texts:

• Quiet hours: no telephone solicitations to a residential subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)" (64.1200(c)(1)).
• Do Not Call: the registry rules apply to "telephone solicitations or telemarketing calls or text messages to wireless telephone numbers" (64.1200(e)).
• Opt-outs: a person may revoke consent "by using any reasonable method", and replying "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" counts automatically. You must honor it "within a reasonable time not to exceed ten business days" (64.1200(a)(10)).
• The cost of getting it wrong: the TCPA lets a person sue "to receive $500 in damages for each such violation", up to three times that if the violation was willful or knowing (47 U.S.C. 227(b)(3)).

What changed recently. The FCC's 2023 "one-to-one consent" rule never took effect: the Eleventh Circuit vacated it in January 2025 (Insurance Marketing Coalition v. FCC), so the older definition above still applies. On September 30, 2026, the FCC adopted an order letting senders designate an exclusive opt-out method, effective "30 days after Federal Register publication" (FCC 26-67). Check its status before you launch a texting program.

Florida: the telephone solicitation act

Florida's law covers texts directly: a "telephonic sales call" includes "a telephone call, text message, or voicemail transmission to a consumer for the purpose of soliciting a sale" (s. 501.059, Florida Statutes). Under the same section:

• Automated sales texts need "prior express written consent" (501.059(8)(a)).
• A "signature" includes "checking a box indicating consent or responding affirmatively to receiving text messages" (501.059(1)(h)).
• Before suing over texts, the person must reply "STOP", and you then have 15 days to stop texting them (501.059(10)(c)).
• Damages are "actual damages or $500, whichever is greater" (501.059(10)(a)).

A separate Florida section limits a "commercial telephone seller or salesperson" to no calls before 8 a.m. or after 8 p.m., and no more than three calls in 24 hours on the same subject (s. 501.616(6)). Whether it applies to a café texting its own customers depends on definitions we haven't covered here, so the safe habit is simple: text between 8 a.m. and 8 p.m., and not more than once a day.

The carriers' rules

Phone carriers set their own requirements for business texting. They aren't law, but a texting provider will hold you to them. CTIA's guidelines, which describe themselves as "voluntary best practices" (CTIA: Messaging Principles and Best Practices), say:

• Messages "should be sent only after the Consumer has opted-in to receive them."
• The confirmation text should include how to get help, "how to opt-out" and "a disclosure that the messages are recurring and the frequency of the messaging."
• Senders "should not use opt-in lists that have been rented, sold, or shared."

Texting from an ordinary business phone number also usually means registering through your provider for 10DLC, a channel where brands are "verified prior to being allowed to send messages" (The Campaign Registry).

How to collect sign-ups at the café

Keep email and text separate. Two boxes, two decisions. Someone happy to get a monthly email may not want texts.

Use plain sign-up wording. An example for texts, to adapt with your provider:

Yes, text me Harbor Lane Coffee offers and news at the number above. Recurring messages, about 4 a month. Consent isn't required to buy anything. Msg and data rates may apply. Reply STOP to cancel, HELP for help.

Where to ask:

• A QR code at the register and on the table tents, to a sign-up page on your email or texting service
• A tablet sign-up at events (see the community post in this series)
• Your website and Instagram bio link

What never counts as a sign-up:

• A phone number from a receipt, a delivery app or a reservation
• A number someone gave you for a catering quote or a callback: they agreed to hear about that, not to get promotions
• A list you bought or borrowed

Keep records. Your email or texting service should store when and how each person signed up and the wording they saw. If yours doesn't, keep that yourself.

A first-year rhythm

Fewer, better messages keep the unsubscribe rate down.

Where Mays fits

Mays doesn't keep a customer marketing list or send marketing emails or texts to your customers. (Catering outreach to local offices is the exception; we cover it later in this series.) Use an email or texting service built for that, and let it handle the unsubscribe links, STOP replies and sign-up records.

Where Mays touches customer contact details is catering:

• A text the customer asked for. When someone calls your catering hotline, the AI takes the event details and texts the caller a link to a short form. The image at the top of this post shows it: the caller confirms the event and adds an Email for your quote, where Mays sends "your two options + payment link". That's an answer to their request, not a sign-up for promotions, so don't add those contacts to your marketing list unless they sign up separately.
• The sign-up script, written once. Put your register script ("Want our monthly email? Scan here") and the never-counts list above in a Knowledge Base article, and turn it into a short training module for new hires.

Catering is set up with our team, because the hotline, texting and email need configuring.

Your list-building checklist

• An email service with an unsubscribe link and your postal address in every email
• A texting service that handles STOP and HELP and registers your number
• Separate email and text sign-ups, with the text consent wording
• No numbers from receipts, delivery apps, catering inquiries or bought lists
• Texts only between 8 a.m. and 8 p.m.; opt-outs honored right away
• Sign-up records kept
• The script and rules in your staff training

Train every hire on the sign-up script

Write the script and the rules once, and make them part of week-one training.

Start your free trial: 30 days, every module, no card needed. Taking catering calls? Read catering phone orders without a host.