POS, Wi-Fi, phones, texting and delivery apps — the compliance parts

Every system on this page gets sold to you on features. Each one also carries a rule that nobody in the sales call mentions, because the vendor is not the party who gets fined.

None of it is enforced by your health district. It is enforced by your card processor, the FCC, the phone carriers and the Ohio Department of Taxation — four bodies that will not appear at your pre-licensing inspection and will absolutely appear later.

Guest Wi-Fi and the POS

They cannot be the same network, and the fix people reach for first does not work.

PCI DSS requires the cardholder data environment to be isolated from networks accessible to guests.⁴ Running guest Wi-Fi and the POS with different passwords on one flat network does not satisfy that — a password controls who joins, not what they can reach once they are on.

The working arrangement is separate VLANs — one for guest traffic, one for POS terminals, one for back office — with firewall rules that prevent routing or lateral movement between them. Sharing one physical switch is fine; the separation has to be logical and enforced.

Two consequences worth knowing before you buy hardware:

Segmentation is itself in scope. If guest Wi-Fi shares physical hardware with the payment network, the controls doing the separating become part of what gets tested and documented. Segmentation is not a way to make the network disappear from the assessment; it is a way to make the assessment smaller.

Done properly it saves money. Isolating the cardholder environment shrinks the scope of your PCI obligations — kitchen displays, back office, guest Wi-Fi and everything else come out of it — which is the actual commercial argument for a business-class router over the one your ISP left in the box.

Ask your POS vendor and your ISP the same question in writing: is the guest network on a separate VLAN with no route to the POS, and who is responsible for maintaining that? The two of them frequently each assume the other did it.

If you run a captive portal

A portal that collects email addresses before granting access is a marketing list, and it inherits every obligation a marketing list has: what you told people you would do with it, how they opt out, and what happens if it leaks. Decide whether you actually want that data before you turn the feature on — free Wi-Fi with no signup has none of those problems.

Phone systems: the rule almost nobody knows

If you install a multi-line telephone system — which is most VoIP systems sold to restaurants — federal rules apply, and they are not optional.

Direct 911 dialing. The system must be configured so a user can reach 911 from any station equipped with dialing facilities, without dialing any additional digit, code, prefix or post-fix — including a trunk-access code such as the digit 9.¹²

This is Kari’s Law, and it exists because a nine-year-old tried four times to call 911 from a motel room while her mother was being killed, and the calls never connected — because the phone system needed a 9 first and she did not know it.³

On-site notification. The system must send a notification when a 911 call is placed — to a central location at the facility, or to a designated person — so somebody on the premises knows to meet the ambulance at the door.¹

Dispatchable location. The address plus what a responder needs to actually find the caller. Deadlines have passed:¹

What to do about it: ask your phone vendor, in writing, to confirm the system dials 911 with no prefix, sends an on-site notification, and transmits a dispatchable location. Then test it — call 911, tell the dispatcher immediately that you are testing a new system, and confirm what address and detail they see. Most vendors handle this correctly; the failure mode is an older system carried over from the previous tenant with a 9-for-outside-line configuration nobody revisited.

Text marketing

Two separate hurdles, and clearing one does not clear the other.

Consent. The Telephone Consumer Protection Act requires prior express written consent before marketing texts. In practice that means a clear opt-in, disclosure of message frequency, and opt-out instructions in every message. A phone number collected for a reservation is not consent to send promotions.

Carrier registration. Business texting from a normal ten-digit number runs through the 10DLC system, which requires registering your brand and each campaign before carriers will deliver reliably. Unregistered traffic gets filtered or blocked — so the first symptom of getting this wrong is usually that your messages silently stop arriving, not a letter.

Whoever sells you the SMS platform will walk you through registration. Consent is yours, and it is the part with money attached.

Third-party delivery

Two Ohio-specific things.

Sales tax changed in 2025. Under House Bill 315, a qualifying delivery network company can request a waiver shifting tax collection on the goods back to the seller — but the delivery company remains liable for tax on its own delivery charges either way.⁵ And since April 3, 2025, all delivery charges are taxable, including charges on otherwise nontaxable food.⁵

Practically: ask each platform whether it holds a waiver, because the answer decides whether tax on the food is theirs to remit or yours. Getting that wrong produces either a double remittance or a gap, and the gap is the one that comes back with interest. Confirm your position with your accountant against the Department of Taxation’s own releases rather than the platform’s summary of them.⁶

Ohio has no listing-consent law. New York and California require a written agreement before a platform may list a restaurant. Ohio does not. If you find your restaurant listed without an agreement — with a menu you did not supply and prices you did not set — that is a contract and trademark matter for a lawyer, not a state compliance complaint. Worth knowing which fight you are actually in before you spend a week on the wrong one.

Reservation systems

The lightest-touch item here, with one thing worth thinking about: a reservation system is a customer database. Names, phone numbers, emails, visit history, sometimes dietary notes.

That matters in two directions. It is an asset — the most valuable marketing list most restaurants own. And it is a liability, in that whatever you promised those guests about their data is now a promise you have to keep, including if you switch platforms and the old vendor keeps a copy.

Ask before you sign: who owns the data, can you export it in full, and what happens to their copy when you leave.

The short version

1. Guest Wi-Fi on its own VLAN, firewalled from the POS. Get it in writing from whoever configures it.
2. Test 911 from the phone system before you open, and confirm no prefix is needed.
3. No marketing texts without written consent, with opt-out in every message.
4. Ask each delivery platform whether it holds an Ohio tax waiver, and tell your accountant the answer.
5. Ask who owns your reservation data before you are trying to leave.

None of this is legal, tax or security advice. PCI obligations run through your merchant agreement, tax through your accountant and the Department of Taxation, and the 911 rules through the FCC — all of them separate from anything your health district reviews.