81% of restaurant operators now have their own website, according to TouchBistro's 2026 State of Restaurants Report, up from a smaller share just a few years ago as online ordering and reservations moved from nice-to-have to default. What almost no study has measured is how many of those websites actually publish a privacy policy or terms and conditions page once they collect a name, an order, or a card number.
Below is what restaurant-specific adoption data shows, what the closest general web benchmark says about the legal-page gap, and where a restaurant's own site still carries compliance obligations even when most orders route through a third-party delivery app.
How many restaurants have a website in 2026?
81% of restaurant operators have a website for their restaurant, according to TouchBistro's 2026 State of Restaurants Report, based on a survey of more than 600 full-service restaurant owners, presidents, and general managers fielded October 2 to 25, 2025, in partnership with The Harris Poll. The same survey found that 68% of restaurateurs have automated online ordering running on their own site or app, and 90% of operators use a reservation system to manage table bookings, whether built into their website or run through a third-party tool.
Figure 1: Share of restaurant operators using each technology, 2026. Source: TouchBistro, 2026 State of Restaurants Report.
That combination, a website plus automated ordering plus a booking system, means the typical restaurant site now collects names, phone numbers, delivery addresses, and payment tokens directly, not just a takeout menu PDF. Each of those collection points is exactly what a privacy policy and a terms and conditions page are supposed to disclose.
Do restaurant websites publish a privacy policy or terms and conditions page?
No study has directly measured how many restaurant websites carry a privacy policy or terms and conditions page. The closest available benchmark comes from Pennsylvania State University's 2023 "Privacy Lost and Found" study, which crawled a dataset built from more than 7.17 million companies and found that only 34% of company websites carried a discoverable privacy policy hyperlink, with 66% carrying none at all. That figure spans every industry in the study's sample, not restaurants specifically, so it should be read as a general small-business benchmark rather than a restaurant-sector finding.
Applied to the restaurant sector's own 81% website-adoption rate, the gap is still informative: even a website that exists to take orders and store customer information is more likely than not, based on the general web pattern, to be missing the pages that disclose what happens to that information. The National Restaurant Association's broader 2026 State of the Restaurant Industry report projects the industry will post $1.55 trillion in restaurant and foodservice sales this year, scale that makes the compliance gap a meaningful aggregate exposure even at a small per-restaurant probability.
For an independently operated restaurant site running its own ordering and reservation forms, a matching terms and conditions page needs to cover order accuracy, delivery liability, gift card terms, and cancellation or no-show policy, alongside a privacy policy covering what customer data is stored and for how long.
What happens when a delivery platform, not the restaurant, handles the order?
A meaningful share of restaurant online orders never touch the restaurant's own website at all. DoorDash works with more than 390,000 US restaurant partners, commanding roughly 67% of the US food delivery market, and Uber Eats separately reports helping more than 700,000 merchants, restaurants among them, reach customers through its own app. Orders placed through either platform run under that platform's own terms and privacy policy, not the restaurant's.
Figure 2: Which terms apply depending on where a restaurant order is placed, 2026. Source: DoorDash and Uber Eats merchant disclosures.
That split narrows a restaurant's own compliance surface for pure delivery orders, but it does not eliminate it. A restaurant using a marketplace app for delivery still needs its own terms and conditions for anything that happens on its own domain: direct reservations, gift card purchases, loyalty program signups, and any first-party online ordering it runs alongside the marketplace listing.
How exposed is restaurant customer data to breaches?
Restaurant point-of-sale and reservation systems handle a steady stream of payment card and personal data, and that data has already been the target of a large, named 2025 breach. Restaurant Management Company of Wichita, Inc., one of the largest Pizza Hut franchisees in the United States, discovered unauthorized access to its systems between October 4 and 13, 2025. The compromised information, which varied by individual, potentially included names, mailing addresses, dates of birth, bank account and routing numbers, health insurance information, and Social Security numbers for approximately 120,426 people, with the largest concentration, 52,017 people, in Texas. The company did not send notification letters until April 20, 2026, more than six months after the unauthorized access was discovered.
Figure 3: Restaurant Management Company of Wichita breach timeline, 2025 to 2026. Source: breach notification filings tracked by claimdepot.com.
That six-month gap between discovery and notification is common across breach cases generally, but it means affected customers had no way to watch for fraud on exposed accounts during the entire period their data was already compromised. A restaurant's privacy policy should state a realistic data retention window for payment and reservation records rather than an open-ended one, since a shorter retention window limits what is exposed if a similar incident happens.
What should a restaurant's terms and conditions page actually cover?
A generic terms and conditions template misses several restaurant-specific details a customer or a regulator would expect. Menu pricing and availability change without notice, so the terms should state that displayed prices and item availability are not guaranteed until an order is confirmed. Allergen and nutrition information needs its own disclaimer distinct from the main terms, since misstated allergen information carries real liability exposure beyond a typical consumer-goods return dispute. Gift card terms need an expiration and refund policy stated plainly, and loyalty program terms need to disclose what customer data the program collects beyond a basic order.
Figure 4: Restaurant operator technology investment priorities, 2026. Source: National Restaurant Association, 2026 State of the Restaurant Industry.
Investment in the underlying systems is accelerating regardless of whether the legal pages keep pace: 48% of operators plan to invest in POS systems this year, and 52% plan to invest in both back-office technology and inventory management, according to the National Restaurant Association's 2026 State of the Restaurant Industry report. Each of those systems typically adds a new vendor with its own data-sharing relationship that a restaurant's privacy policy should name.
Restaurant website legal-page checklist
| Website feature | Data collected | Page needed | Who is responsible |
|---|---|---|---|
| Own online ordering | Name, address, payment token | Privacy policy, terms and conditions | Restaurant |
| DoorDash or Uber Eats orders | Name, address, payment token | Platform's own terms and privacy policy | Delivery platform |
| Reservation system | Name, phone number, party size | Privacy policy | Restaurant or reservation vendor |
| Loyalty or rewards program | Email, purchase history | Privacy policy, program terms | Restaurant |
The Bottom Line
81% of restaurants now run a website that collects real customer data through ordering, reservations, or loyalty signups, and general web research suggests most small-business sites in that position still lack a proper privacy policy. Splitting orders across a restaurant's own site and third-party delivery marketplaces narrows the compliance surface for pure delivery transactions but does not remove it, since reservations, gift cards, and loyalty programs almost always stay on the restaurant's own domain. A restaurant running any first-party data collection should generate terms and conditions built for a restaurant website rather than relying on a generic template that skips menu pricing disclaimers, allergen liability language, and gift card terms. For how this same legal-page gap plays out among small businesses generally, see 66% of Small Business Websites Lack a Privacy Policy [2026], and for a comparable industry facing its own compliance-surface split between owned and third-party platforms, see Fewer Than 10% of EdTech Tools Meet This 2026 Privacy Bar. A closer look at real estate websites, the next post planned for this cluster, is not yet published on this site.
Frequently Asked Questions
How many restaurants have a website in 2026? 81% of restaurant operators now have their own website, according to TouchBistro's 2026 State of Restaurants Report, a survey of more than 600 full-service restaurant owners, presidents, and managers fielded October 2 to 25, 2025. 68% of operators have automated online ordering in place, and 90% use a reservation system.
Do restaurant websites need a privacy policy or terms and conditions page? No study has directly audited restaurant websites for privacy policy or terms and conditions presence. The closest available proxy comes from Pennsylvania State University's 2023 study of over 7.17 million company websites, which found only 34% carried a discoverable privacy policy hyperlink at all. Any restaurant site collecting an order, reservation, or loyalty signup is handling personal data and needs both pages regardless of that general gap.
Does a restaurant's own site need terms if customers order through DoorDash or Uber Eats? Partly. DoorDash and Uber Eats each publish their own terms and privacy policy covering orders placed on their apps, and DoorDash alone works with more than 390,000 US restaurant partners under those terms. A restaurant still needs its own terms and conditions for anything happening on its own domain: direct online ordering, reservations, gift cards, and loyalty program signups.
What happened in the Restaurant Management Company of Wichita data breach? Restaurant Management Company of Wichita, Inc., one of the largest Pizza Hut franchisees in the United States, discovered unauthorized access to its systems between October 4 and 13, 2025. The incident exposed personal data, including Social Security numbers and bank account details, for approximately 120,426 people, with notification letters going out April 20, 2026, more than six months after discovery.
Where the Numbers Come From
- TouchBistro. (2026). "2026 State of Restaurants Report." Survey of 600+ full-service restaurant owners, presidents, and managers, fielded October 2 to 25, 2025, with The Harris Poll.
- Pennsylvania State University. (2023, October 25). "Most websites do not publish privacy policies, researchers say." Press coverage of the DocEng '23 "Privacy Lost and Found" study.
- ClaimDepot. (2026). "Restaurant Management Company Data Breach Affects 120,426." Breach notification filing tracker, Restaurant Management Company of Wichita, Inc.
- National Restaurant Association. (2026). "2026 State of the Restaurant Industry." Industry sales projection and operator technology investment plans.
- Restaurant Dive. (2026). "NAR: Restaurant, foodservice to surpass $1.5 trillion in sales." Coverage of the National Restaurant Association's 2026 sales projection.
Note: All figures verified as of September 2026. No study directly measures privacy policy or terms and conditions adoption among restaurant websites specifically; this post pairs TouchBistro's restaurant-specific technology adoption data with Pennsylvania State University's general web benchmark as the closest available proxy and flags that limitation throughout rather than presenting it as a restaurant-specific figure. This post's figures are refreshed at least twice a year.
