How your privacy gets cooked by those restaurant waitlist apps

Patience is a virtue. It could also protect your data.

Alfred Ng Senior Reporter / CNET News
Alfred Ng was a senior reporter for CNET News. He was raised in Brooklyn and previously worked on the New York Daily News's social media and breaking news teams.
Alfred Ng
8 min read
Waiting in line for sushi breakfast, Tsukiji Outer Market, Tokyo
Elizabeth Beard / Getty Images

I hate having to wait. But do I hate it enough to give up my privacy ?

This dilemma popped up on a Wednesday night in October, as I stood at the front of a Szechuan restaurant in Brooklyn, eyeing the empty tables inside.

It wasn't particularly busy, and I really wanted this special grilled fish I knew I couldn't cook. The staff there was clearing a table, and the host asked me if I could fill in my name and phone number on the iPad kiosk before being seated.

I've given my name and phone number to restaurants before -- usually when they're full and it's 30 to 45 minutes before there's an opening. Not when there's clearly a table opening up. But I obliged.

I tapped on the iPad screen and then noticed something that made me realize this restaurant was doing more with my name and phone number than just telling me a table was ready. The waitlist app had a privacy policy.

Add restaurants to the long list of places asking us for personal information, and think again about the dominant role data has in our lives. Tech giants like Google and Facebook use data from your social media profile and web browsing to track you across the internet and figure out what your interests and hobbies are, ultimately serving that information up to advertisers. Other businesses say they want to use that data to improve their services.

It extends to data coming from your mobile devices as well, with apps using your GPS to push location-based marketing. With companies expanding how they suck up that info on a massive scale, it's no wonder local restaurants want a slice of that pie.

This local spot was using an app called Nowait. It's not alone.

Chili's started using it in 2015, and Yelp bought it in 2017 for $40 million. Chili's has a special contract with Nowait through which it can use your phone number for its loyalty program and promotional purposes. The app was in 4,000 restaurants before Yelp's acquisition.

Yelp said it no longer provides this type of access for restaurants. Chili's didn't respond to a request for comment.

Table's Ready, another waitlisting app, has hundreds of customers across the US, according to its CEO, Mike Errecart.

Thousands of restaurants across the country, as well as breweries and pharmacies, are all using waitlist apps, many of which collect data on you and track you to varying degrees.

OpenTable, which Priceline acquired for $2.6 billion in 2014, notes in its privacy policy that it can share data, like where you prefer to sit, with other restaurants and with third-parties for marketing, as well as with other Priceline-owned companies like Kayak and Booking.com. The company, which is used by more than 47,000 restaurants, didn't respond to multiple requests for comment. 

The practice has some people on edge.

"After reading their privacy policy, I logged into my account and changed some of my settings," said Richard Ford, chief scientist at security company Forcepoint.

None of the waitlisting apps mentioned selling the data they've collected, but they all note that they can share it with third parties for analytics and some apps allow for marketing.

'Out of control'

Robert Myer, the founder of Nowait, and now an entrepreneur-in-residence at Carnegie Mellon University, created the app because he was tired of waiting for a seat. He was at a restaurant in San Francisco in 2009 looking for a brunch spot, and the hostess asked him for a phone number to call when there was an opening.


Robert Myer created the Nowait app after an experience at a restaurant in San Francisco. 


At the time, she had just taken it down on pen and paper, he said. But he saw the potential to scale up.

"I thought, 'Wow, it'd be really cool if we could figure out a process where every restaurant could do this automatically,'" Myer said. "And if we had it in a database, I could publish what the wait time was ahead of time, and people could check in remotely."

Now the data is so valuable, even when there's no wait, that some places will ask you to check in anyway so they can collect the information.

Alastair MacTaggart, a real estate developer and the advocate behind California's Consumer Privacy Act, told lawmakers that he encountered this while trying to get a haircut.

"Supercuts now has a little kiosk, and they wanted my email address and my cellphone number to check in, and I was the only person in line," he said during an hearing in October. "The data collection has just gotten out of control."

Regis Corp., which owns Supercuts, declined to comment.

Since then, MacTaggart said he's been noticing data collection tools in common, everyday services all around him. Even accepting a birthday party invite for his child's friends comes with strings attached.

"It's out of control. On what planet should they be able to get your information like that just because you want a haircut?" he said in an interview.  

Data-driven dining

The boom comes as companies start to see the value of building up a database of your personal preferences.

Now restaurants know how often a specific customer comes to eat, when peak traffic is and how long people are willing to wait for tables.

That shift allows restaurants to analyze data to predict busy times and improve the customers' experience, Myer said.

When he first built the app, Nowait offered a text-marketing feature for restaurants that wanted to send ads to customers who gave their phone numbers. It fizzled out because not enough restaurants were using it, he said.

Watch this: Restaurants are hungry for data, and waitlist apps are feeding them

Myer said he built Nowait with privacy as a priority, making sure that restaurants couldn't see a customer's phone number, but the app still stores that number to identify people.

So while the restaurants don't have your data on file, Nowait -- and Yelp, which owns Nowait -- does. Yelp keeps a record of the phone number you used for your own convenience, a company spokeswoman said in an email. This allows you to come back to the same restaurant and just enter your name if you're using the app.

Table's Ready got its start in 2011, catering to local restaurants with a service similar to Nowait for about $70 a month. Nowait cost between $100 and $200 a month before Yelp bought it. Now it varies by restaurant contracts, according to Yelp.

Vivek Raman, Yelp's engineering director of security, said the company stores that number specifically to improve a customer's experience, and that's it.

"Yelp doesn't use that phone number for anything else. That's a privacy decision we've done intentionally," he said.  

Like Nowait, Table's Ready keeps your phone number in its own databases, but restaurant staff can obtain it, Errecart said. The full phone number resides in the company's own servers, which restaurants can obtain by individual requests, but not in bulk.

Without a request to Table's Ready, restaurants still have the last four digits of customers' phone numbers, which serve as an ID.

"The phone number is the unique identifier of a person to see how often they visited, all this information that restaurants really value," Errecart said. "That's why we store it."

Art meets science in the kitchen of a top Barcelona restaurant

See all photos

He added that customers have a choice to not use waitlisting apps if they're concerned about giving away their phone number -- they just need to stick around to wait for their name to be called.

Myer sees the future of waitlisting apps as a win-win for restaurants and customers, without any concerns of a privacy trade-off. Restaurants are able to collect data, including how frequently you eat there, and in exchange, you don't need to wait at the venue for 20 to 30 minutes.

"We didn't require anyone to trade privacy," Myer said. "You went to the restaurant, you create an account so they know who you are to save time."

The privacy trade-off

Giving up your phone number might not seem like a big deal, but it's linked to a plethora of information.

Phone numbers are often listed in databases from information brokers, and they're also frequently tied to social media accounts on Twitter, Instagram and Facebook .

"The cellphone number is quickly becoming the new Social Security number in the digital age," said Jay Stanley, a senior policy analyst with the American Civil Liberties Union.

The extra convenience while waiting for a table at the restaurant isn't worth that privacy trade-off, he added.

Having access to that phone number is also ripe for abuse from restaurants. In March, Greenbush Brewery tweeted out that it still had a customer's name and phone number from the waiting list app after kicking the person out for drinking too much.


Greenbush Brewing tweeting out that it still had a customer's name and phone number from the waiting list app it used.

Screenshot by Alfred Ng/CNET

Multiple replies told the Michigan brewery to share that phone number, and the account responded in one tweet, "Tempting…"

It's unclear what waitlist app the customer used, and Greenbush Brewery didn't respond to a request for comment.

Stanley is also concerned about restaurants tracking your dining habits. There are ways to have that same convenience without giving up information, like the buzzers that some restaurants use, he said.

Still, these waitlisting apps are increasingly popular with many patrons more than willing to give up their information if it means a shorter wait time down the line. Trading data for convenience or a service is essentially the backbone of tech giants like Google and Facebook.

Even for Ford, whose job is to look at security issues as chief scientist for Forcepoint, the convenience often overshadows his privacy concerns.

"Based on my day job, I'm horribly aware that data is an asset and it's traded, aggregated, processed and sold," he said. "But when I'm taking my wife out for dinner, I don't think about the digital footprint I'm leaving. Even I fall into the trap of just throwing my hands up."

The concept has gotten so popular that Japanese coffee chain Shiru Cafe started offering free coffee to customers who provide personal data like their names, birthdays and work experiences.

MacTaggart doesn't see this trend living for long. As more big data breaches at companies like Equifax and Facebook happen, people are becoming more aware that their privacy is at stake, he said.

But for now, it's still an awkward conversation when you swim against the data current.

"We could complain to the restaurants and say 'you're asking for my personal information with no tangible benefit in return,'" Stanley said. "But imagine a situation like a date where nobody wants a negative conversation on their night out."

Well, unless you're me and live for negative conversations.

After seeing the privacy policy, I hesitated and asked the host what the restaurant does with my phone number. He gave the obvious answer, "Oh, we text you when the table is ready."

Before I could press him further, my girlfriend jumped in and said, "I'll just put my phone number in."

The fish was delicious. 

CNET Magazine: Check out a sample of the stories in CNET's newsstand edition.

Taking It to Extremes: Mix insane situations -- erupting volcanoes, nuclear meltdowns, 30-foot waves -- with everyday tech. Here's what happens.