Allergen disclosure requirements for US restaurants come from multiple regulatory layers. Federal law defines which allergens must be identified. State laws like California’s ADDE Act (SB-68) are raising the standard by requiring written, item-level disclosure directly on menus. This page explains what those requirements are, where they apply, and what operators need to do to meet them.
Key Takeaways
- Allergen disclosure in US restaurants is governed by a combination of federal definitions and state-level requirements. Federal law defines the nine major allergens. State laws like California’s SB-68 specify how they must be communicated on menus.
- Under SB-68, restaurant chains with 20 or more US locations must provide written, item-level allergen disclosure on menus by July 1, 2026.
- Disclosure is not a one-time setup. Operators are expected to disclose what they know or should reasonably know, which requires ongoing validation of supplier data, recipes, and menu outputs.
- Allergen information must be consistent across every customer-facing channel: in-store menus, websites, and third-party delivery platforms.
- Documentation matters. Auditors and regulators will ask when data was last reviewed, who approved it, and what changed. Operators need systems that can produce that evidence on demand.
- Menu-level disclosure is only reliable if the kitchen processes behind it support accuracy. Disclosure and execution are directly linked.
What are restaurant allergen disclosure requirements?
Allergen disclosure requirements are the legal obligations that require food businesses to inform customers about the presence of major allergens in the items they serve. In a restaurant context, this means identifying which allergens are present in each menu item and making that information accessible to the guest before they order.
This goes beyond putting a label on a package. Restaurant disclosure is about live, customer-facing communication: on menus, on menu boards, through digital formats, and through staff who can answer allergen questions accurately.
The requirements are not static. They depend on maintaining accurate food data, keeping menus current, and ensuring that what is communicated to the guest reflects what is actually in the dish. A disclosure that was correct six months ago may no longer be compliant. If a recipe or supplier has changed since it was last updated, the information reaching the guest is inaccurate.
Which laws govern allergen disclosure in restaurants?
Allergen disclosure requirements in the US do not come from a single law. They are built from a combination of federal definitions and state-level mandates. Federal law sets the baseline by defining which allergens must be identified. State laws are increasingly going further by specifying how that information must be communicated on restaurant menus.
Federal Requirements
At the federal level, two key pieces of legislation define which allergens must be disclosed:
The Food Allergen Labeling and Consumer Protection Act (FALCPA), enacted in 2004, established the original eight major allergens that must be declared on packaged food labels: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, and soy.
The FASTER Act, signed into law in 2021, added sesame as the ninth major allergen, effective from January 1, 2023.
These laws apply primarily to packaged food labeling rather than restaurant menus. However, they establish the nationally recognized allergen list that state-level restaurant disclosure requirements build on.
The FDA Food Code, which serves as a model for state and local food safety regulations, requires food establishments to inform customers about major allergens and to have staff who can answer allergen-related questions. It sets expectations for allergen awareness but does not mandate a specific menu disclosure format. Adoption and enforcement vary by jurisdiction.
In summary, federal law defines which allergens matter and expects food businesses to manage them. It does not fully standardize how restaurants communicate allergen information to guests on menus. That is where state law steps in.
State-level Requirements
State laws are closing the gap between federal definitions and restaurant-level execution. The most prescriptive example currently in effect is California’s ADDE Act (SB-68), which takes effect on July 1, 2026.
SB-68 requires restaurant chains with 20 or more US locations to disclose the nine major allergens on menus. The disclosure must be written, provided per menu item, and accessible to the guest at the point of ordering. Digital formats such as QR codes are permitted, but a written alternative must always be available.
If you are unsure whether your operation falls in scope, see the breakdown of who the 20-plus location rule applies to.
SB-68 is currently the most specific state-level allergen disclosure law targeting restaurant menus. But it reflects a broader trend. Regulatory expectations around menu-level allergen transparency are increasing nationally, and operators in any state should be prepared for similar requirements to follow.
Which allergens must be disclosed?
The nine major allergens recognized under federal law and required under SB-68 are:
- milk,
- eggs,
- fish,
- crustacean shellfish,
- Tree nuts,
- peanuts,
- wheat,
- soy,
- sesame.
This includes derivatives such as casein (milk), soy sauce (soy), and flour-based roux (wheat). If a derivative is present in a recipe, the parent allergen must be disclosed. Highly refined oils are generally exempt because the refining process removes the allergenic protein, but cold-pressed or expeller-pressed oils are not. For a closer look at where allergens are less obvious in ingredients and compound products, see the guide to hidden allergens and derivatives.
Where and how must allergen information be provided?
The regulatory requirements focus on three principles: allergen information must be written, it must be provided per menu item, and it must be accessible to the guest at the point of ordering.
Written disclosure is the baseline. Under SB-68, allergen information must appear in written form. This can be on the menu itself, on a menu board, or through a supplementary document such as an allergen chart or booklet. Verbal communication from staff can support the disclosure but does not satisfy the requirement on its own.
Digital formats are permitted with conditions. QR codes and digital menus are allowed, but they cannot be the sole method of access. A written alternative must always be available for guests who cannot or choose not to use a digital format. For a comparison of how digital and print approaches work under California’s requirements, see the article on digital vs print allergen disclosure.
Disclosure must be per item, not per menu. A general statement such as “our kitchen uses allergens” does not meet the requirement. Each menu item must identify which of the nine major allergens it contains. The information must be specific enough for a guest to make a safe ordering decision based on their individual allergy.
Consistency across channels is an operator obligation. The same allergen information must be accurate and current wherever a guest can view your menu: in-store, on your website, and on third-party delivery platforms. A disclosure that is correct in-store but outdated on a delivery app is still a compliance gap, and the responsibility sits with the operator.
For practical guidance on formatting, placement, and the use of symbols, see the step-by-step guide to allergens on menus in California and the comparison of icons vs words for ADDE Act allergen disclosure.
What does “reasonably should know” mean in practice?
Allergen disclosure requirements do not only cover what you have confirmed. They cover what you could have identified through standard due diligence. If the information was available and you did not check it, that is not a defense.
In practice, this means operators are expected to:
Check supplier specifications for every incoming ingredient. Suppliers provide specification sheets that declare allergen content. If a spec sheet is available and the operator does not review it, any undisclosed allergen that reaches a guest is a compliance failure on the operator’s side, not the supplier’s. When suppliers substitute products or reformulate ingredients, the allergen profile can change without warning. Setting up automated supplier alerts ensures these changes are flagged before they reach the kitchen.
Maintain accurate recipe data. Every recipe should be mapped against the nine major allergens based on its current ingredients. That includes compound components where allergens may not be obvious from the product name: a pre-made sauce containing soy, a seasoning blend containing wheat, a stock base containing fish derivatives. If your recipes use these products and you have not broken them down to the ingredient level, the allergen data behind your menu is incomplete. For more on where these risks occur, see the guide to hidden allergens and derivatives.
Update disclosures whenever the data changes. A disclosure that was accurate at launch but has not been reviewed after a recipe change, a supplier substitution, or a new menu item is no longer reliable. “Reasonably should know” is an ongoing obligation, not a one-time check. It requires a system that connects supplier data to recipes to menus so that a change at any point in the chain triggers a review of everything downstream.
The burden here sits squarely with the operator. Regulators and courts are unlikely to accept “we didn’t know” if the allergen information was identifiable through the supplier spec, the ingredient list, or the recipe record. A centralized allergen database that connects these data points makes ongoing due diligence manageable. Without one, the obligation still exists, but the risk of missing something increases with every recipe, supplier, and menu change.
Why allergen disclosure breaks down in real operations
Most disclosure failures do not start as deliberate non-compliance. They start as small data gaps or process oversights that go unnoticed until an auditor flags them or a guest has a reaction. Understanding where these failures create regulatory exposure helps operators prioritize what to fix first.
Allergen data that does not match the current menu. If a recipe has changed but the allergen disclosure on the menu has not been updated, the operation is serving inaccurate information. Under SB-68, the requirement is to disclose allergens accurately per menu item. An outdated disclosure is not a minor administrative gap. It is a violation. An inspector or auditor comparing your published menu against your current recipes and supplier specs will identify the discrepancy.
Inconsistent disclosures across customer-facing channels. The allergen information on your in-store menu, your website, and your third-party delivery platforms must match. If a guest orders through a delivery app based on allergen data that does not reflect a recent recipe change, the liability sits with the operator. Regulators and legal teams will look at every channel where the guest could have received the information, not just the in-store menu.
No documentation of evidence accuracy. If an auditor asks when your allergen data was last reviewed, who approved it, and what changed, you need to be able to answer. Operators who manage allergen data in spreadsheets or paper records often cannot produce this evidence because those tools offer no version history, no timestamps, and no user attribution. The absence of documentation does not prove non-compliance on its own, but it makes it very difficult to demonstrate that due diligence was followed.
Undisclosed allergens in compound or multi-component items. A build-your-own bowl, a combo meal, or a dish with a pre-made sauce can contain allergens that are not visible from the item name or description. If the allergen data for these components has not been broken down to the ingredient level, the disclosure is incomplete. An enforcement review will assess whether the operator reasonably could have identified the allergen through standard recipe and supplier documentation. If the answer is yes, the gap becomes a violation.
The link between disclosure and kitchen execution
Allergen disclosure is only as reliable as the kitchen processes behind it. If your menu states that a dish contains wheat and soy, but prep teams are not following procedures that prevent undisclosed cross-contact with other allergens, the disclosure is incomplete regardless of what is printed. Disclosure accuracy and kitchen execution are two sides of the same obligation. For guidance on how cross-contact risks affect menu accuracy, see the article on cross-contact vs cross-contamination. For staff readiness, see the guide to training staff for ADDE Act readiness.
How multi-location restaurants manage disclosure at scale
The disclosure challenge for multi-unit operators is not accuracy at one location. It is accurate at every location, on every channel, at all times. When one site updates its allergen data after a recipe change and another does not, or when in-store menus reflect current recipes but the delivery app listing still shows last quarter’s data, the brand is serving inconsistent information. Under SB-68, the disclosure obligation applies per menu item at every location in scope. A gap at a single site is a violation for the brand.
Managing this requires centralized control over allergen data. When recipe and allergen information is held in a single source of truth, a change made once flows to every location and every customer-facing channel from the same source. A multi-site allergen governance framework defines who approves changes, how updates are distributed, and what happens when a location deviates. A digital audit trail records every change with a timestamp and an owner, so that when an auditor asks when the data was last reviewed at a specific site, the answer is documented rather than assumed.
What operators should prepare for under SB-68
If your operation falls in scope (20 or more US locations, at least one in California), the following should be in progress now, not closer to the July 1, 2026 deadline.
- Map every menu item against the nine major allergens. This includes sauces, garnishes, sides, drinks, desserts, and any shared components. If an item is on the menu, its allergen profile must be documented.
- Validate your supplier data. Confirm that specification sheets are current for every incoming ingredient. Flag any suppliers who have not provided updated allergen declarations.
- Update allergen disclosures across all customer-facing channels. In-store menus, websites, digital menu boards, and third-party delivery platforms must all reflect the same accurate data.
- Build documentation that can evidence compliance. Auditors will ask when allergen data was last reviewed, who approved it, and what changed. Ensure your system can produce that evidence on demand.
- Train staff on allergen communication. Front-of-house teams need to know how to direct guests to allergen information and how to escalate specific allergen questions. Kitchen teams need to understand how their processes support the accuracy of what is disclosed. For a structured approach, see the guide to training staff for ADDE Act readiness.
- Establish an ongoing review cycle. Allergen disclosure is not a launch task. Build allergen review into every recipe change, supplier substitution, and new menu item workflow.
For the full preparation timeline, see the SB-68 compliance roadmap.
Frequently Asked Questions
Do restaurants have to list allergens on menus?
There is no single federal law that mandates allergen disclosure on restaurant menus. However, the FDA Food Code expects food establishments to inform customers about major allergens, and state laws are increasingly requiring written, item-level disclosure. In California, SB-68 makes this a legal requirement for chains with 20 or more US locations from July 1, 2026.
What is required under SB-68?
Restaurant chains with 20 or more US locations must disclose the nine major allergens on menus in written form, per menu item, accessible to the guest at the point of ordering. Digital formats are permitted but a written alternative must always be available. Fines range from $500 to $2,500 per violation, and repeat offenses can put permits at risk.
Does SB-68 apply to franchisees or only the parent brand?
The law applies to restaurant operations with 20 or more locations nationally. For franchise models, both the franchisor and franchisee may carry compliance obligations depending on how menus, recipes, and supplier relationships are managed. If allergen data is controlled centrally, the franchisor is responsible for its accuracy. If individual franchisees modify menus or source locally, they share that responsibility. For a full breakdown, see the article on who the 20-plus location rule applies to.
Are restaurants required to disclose allergens for delivery orders?
The allergen data displayed on third-party delivery platforms is the responsibility of the restaurant operator, not the delivery service. If allergen information is outdated or incorrect on a delivery app, the compliance gap sits with your business. Treat every channel where a guest can view your menu as an extension of your in-venue disclosure. For more detail, see the article on third-party menus and delivery apps.
What documentation do restaurants need for allergen compliance?
Operators should be able to evidence when allergen data was last reviewed, who approved it, and what changed. This includes supplier specification sheets, recipe-level allergen records, menu update logs, and staff training records. A digital audit trail that timestamps every change is the most reliable way to demonstrate due diligence. For guidance on presenting this evidence during inspections or bid evaluations, see the article on how to present ADDE compliance evidence during audits.
References
Food Allergen Labeling and Consumer Protection Act (FALCPA)
Related Sources
Restaurant Allergen Compliance Guide
How to List Allergens on a Menu