GDPR and Guest WiFi

GDPR-compliant guest WiFi requires separating marketing consent from WiFi access. Guests must be able to connect to a venue's WiFi without being forced to opt in to marketing emails. The marketing checkbox must be unticked by default, and consent must be freely given, specific, informed, and unambiguous.

The Two Types of Data Collection

When a guest connects to WiFi through a captive portal, two things can happen. First, the guest enters their email address to access the WiFi service. This is covered by legitimate interest under UK GDPR, because the venue needs the email to provide the service (identify the user, manage access, comply with record-keeping obligations).

Second, the guest may choose to opt in to marketing communications. This requires separate, explicit consent under both UK GDPR and PECR (the Privacy and Electronic Communications Regulations). The consent must be via an unticked checkbox that the guest actively ticks. Pre-ticked boxes are not compliant.

These two steps must be distinct. A captive portal that bundles WiFi access and marketing consent into a single action ("enter your email to connect and receive offers") is not GDPR compliant.

What Venues Must Do

UK venues offering guest WiFi with email capture must store personal data securely, provide a clear privacy policy explaining what data is collected and why, allow guests to request deletion of their data (the right to be forgotten), only use data for the purposes stated at the point of collection, keep records of when and how consent was given, and honour opt-out requests promptly.

Common Mistakes

The most common GDPR mistakes with guest WiFi are bundling marketing consent with WiFi access (using a single "enter your email to connect and receive marketing" action), pre-ticking the marketing consent checkbox, not providing a privacy policy link on the captive portal, not recording when consent was given, and not having a process for handling data deletion requests.

PECR: The Other Regulation

PECR (Privacy and Electronic Communications Regulations) sits alongside GDPR and specifically governs electronic marketing in the UK. Under PECR, sending marketing emails to individuals requires prior consent unless an existing customer relationship exists and the marketing is about similar products. For WiFi-captured emails, explicit opt-in consent is the safest and most defensible approach.

How CaptiveFlow Handles GDPR

CaptiveFlow enforces GDPR compliance by design. The marketing checkbox is unticked by default and cannot be changed to default to checked. Consent is timestamped and recorded separately from WiFi access. Data is stored in the EU via Supabase. CaptiveFlow operates as a data processor on behalf of venue operators, who are the data controllers. A Data Processing Agreement is available on request. For full details, see our GDPR compliance page.