GDPR & Guest WiFi

If you collect any personal data from guests via your WiFi splash page - even just an email - UK and EU GDPR apply. So does PECR (the Privacy and Electronic Communications Regulations) the moment you send a marketing message to that email. Done correctly, GDPR-compliant guest WiFi protects the business; done badly it's a major liability.

The six requirements you cannot skip

1. Lawful basis. Almost always "consent" for marketing emails; "legitimate interest" can occasionally apply but is usually the wrong choice for a splash page.
2. Specific, granular, opt-in consent. No pre-ticked boxes. Marketing opt-in must be a separate action from the WiFi sign-in itself.
3. Accessible privacy notice linked from the splash page, in plain English, telling the guest exactly what you collect, why, how long you keep it, and who else sees it.
4. Right to access, rectification and erasure. A guest can email you and ask for their data back, or for it to be deleted, and you must comply within 30 days.
5. Audit trail. You must be able to prove, per individual, when consent was given and what they were asked. CaptiFi stores each guest's answer to the marketing question on their visit record with the time they signed in, and their profile shows it; keep a dated copy of your consent wording each time you change it.
6. Data minimisation. Only collect what you actually need. Asking for date of birth, postcode and gender on a coffee-shop splash page is generally not defensible.

PECR - the rule about marketing emails specifically

PECR (UK) and the ePrivacy Directive (EU) layer additional rules on top of GDPR for any "electronic communication for marketing purposes" - emails, SMS, push notifications. The core requirement is prior, specific, opt-in consent, with the option to opt out in every message. Soft opt-in (you bought from us recently) doesn't apply to a guest WiFi sign-up.

What good practice looks like

• WiFi sign-in form has the email field as required, and the marketing opt-in is never pre-selected: an unticked box, or its own question with Accept and Reject.
• Privacy notice link is one tap away, on the splash page itself.
• Every marketing email has an unsubscribe link in the footer, and the headers that give Gmail, Yahoo Mail and other mail apps their one-click Unsubscribe button.
• Data is retained only as long as the legitimate purpose lasts (e.g. 24 months from last visit).
• The platform stores tamper-evident consent logs by default.

For a deeper walkthrough see the GDPR-compliant WiFi guide.