A POS system touches more legal areas than most owners expect: card payment security, customer data and marketing consent, tips and employee time records, fees shown to customers, sales tax and recordkeeping. Square takes on a large share of the payment security burden, but the business owner stays responsible for how the system is configured and used.
This article is general information, not legal advice. Laws differ by state, city and country and change often. Talk to a licensed attorney, an accountant and your local regulators about your specific situation.
1. Card payment security (PCI)
The Payment Card Industry Data Security Standard (PCI DSS) sets rules for anyone who handles card data. Square's guidance is that if you use Square for all storage, processing and transmission of your customers' card data, you do not need to take extra steps to become PCI compliant. That condition matters. Your responsibility can grow if you step outside it.
- Never write down card numbers, take them over email, or store them in notes or spreadsheets.
- Avoid keying in cards by hand unless necessary, and never keep the details afterward.
- Use only Square or Square-integrated apps to take payments, so card data stays inside Square's systems.
- Secure your devices: lock screens, keep software updated and do not install unrelated apps on POS devices.
2. Customer data and privacy
When customers give a phone number or email at checkout, join loyalty or order online, you collect personal data. Several US states now have consumer privacy laws, and some apply only above certain business sizes. General good practice:
- Collect only what you use. A phone number for loyalty is reasonable. A birthday you never use is not.
- Publish a privacy policy on your website and ordering pages that explains what you collect and why.
- Limit access. Use Square permission sets so only managers can view or export customer lists. Our guide to managing employee permissions in Square shows how.
- Handle requests. Have a simple process if a customer asks what you hold about them or asks you to delete it.
For practical customer data habits, see managing customer data with Square.
3. Marketing consent: texts and emails
US federal laws, including the Telephone Consumer Protection Act (TCPA) for calls and texts and the CAN-SPAM Act for commercial email, regulate marketing messages. In broad terms:
- Get clear permission before sending marketing texts, and keep a record of it.
- Make it easy to opt out, and honor opt-outs quickly.
- Do not assume a phone number given for a receipt or loyalty means consent to marketing.
- Identify your business in every message.
Text marketing in particular carries real legal risk. Ask your attorney to review your sign-up wording.
4. Tips, wages and time records
Your POS records tips and, if you use Square's time tracking, clock-ins and breaks. Those records can matter in a wage dispute or audit.
- Tip ownership: federal law restricts managers and owners from keeping employees' tips, and states add their own rules on tip pooling and tip credits.
- Card fee deductions from tips: whether you can deduct processing fees from card tips depends on federal and state rules.
- Breaks and overtime: meal and rest break rules vary widely by state.
- Accurate timecards: make sure edits to timecards are approved and documented.
See taxes and tips in the restaurant business for the tip reporting basics.
5. Service charges, surcharges and pricing
How you show prices and fees is increasingly regulated. Some states and cities have rules about how service charges and other mandatory fees must be disclosed, and card surcharging is restricted or regulated in some states and by card network rules. Before adding a service fee or card surcharge in Square, confirm it is allowed where you operate, how it must be shown on menus and receipts, and whether service charges are treated as wages or taxable sales.
6. Sales tax and recordkeeping
- Make sure the tax rates in Square match the rules for each location. Square calculates tax from your settings, but filing and paying are your responsibility. Our guide to using Square for sales tax reporting walks through it.
- Keep sales, tax, payroll and tip records for as long as your accountant advises. The IRS and state agencies set retention periods for different records.
- Export key reports regularly and store them outside your POS as a backup.
7. Accessibility
Customer-facing technology, including websites, ordering apps and self-ordering kiosks, may be subject to accessibility requirements under the Americans with Disabilities Act and state laws. Choose tools with accessible design, keep an alternative way to order (like the counter), and ask your attorney about your obligations.
8. Contracts and terms
- Read Square's seller agreement and the terms of any app you connect.
- Understand chargebacks: keep receipts and order records so you can respond to disputes.
- Keep account access tight. Only owners should hold full access, and remove former staff right away.
Legal checklist for your POS
- No card data stored outside Square.
- Privacy policy published on your website and ordering pages.
- Marketing opt-in recorded and opt-out honored.
- Tip policy written down and reviewed by an advisor.
- Fees and surcharges checked against local rules.
- Tax rates confirmed for each location.
- Team access reviewed every quarter.
Food safety is its own area. See how Square can help with food safety compliance.
Where Orda fits
If you add ordering channels, choose ones that keep payments inside Square. Orda apps, ordering websites and kiosks take payments through Square, and every order is created in Square POS, so your payment records and reports stay in one place. More than 10,000 Square businesses have used Orda.