GDPR, CCPA, and WiFi Data: Everything You Must Know

The Legal Framework for WiFi Marketing

WiFi marketing touches three areas of law: data protection (the GDPR in Europe and the UK, the CCPA in California and similar laws in other US states), electronic marketing rules (the EU ePrivacy Directive as applied in each country, and PECR in the UK), and national telecoms rules.

This lesson covers the obligations most relevant to a venue running a guest portal: what you must do, what you must have in writing, and what to check before launch.

This is general information, not legal advice. For your situation, speak to a qualified data protection adviser. This lesson should help you ask the right questions.

GDPR Fundamentals for WiFi Marketing

The General Data Protection Regulation applies to organisations that process personal data of people in the EU, including businesses outside the EU that offer services there. The UK has its own almost identical version, the UK GDPR. If your venue is in France, Germany, Spain, Ireland or elsewhere in the EU, the GDPR applies to your WiFi marketing.

Personal data in a WiFi context includes email addresses, names, device MAC addresses, IP addresses and visit timestamps linked to a person. Collecting them through a portal rather than a web form makes no legal difference.

Lawful basis for marketing

You need a lawful basis for each purpose. For marketing emails to guests, that basis is almost always consent. Article 4(11) of the GDPR defines valid consent as:

• *Freely given:* the guest cannot be made to accept marketing as the price of WiFi. Article 7(4) says this is weighed when a service is made conditional on consent.
• *Specific:* the guest knows what they are agreeing to: emails from your venue.
• *Informed:* you say who you are (your legal entity), what you collect and why.
• *Unambiguous:* a clear action, such as ticking a box. Recital 32 states that silence, pre-ticked boxes or inactivity do not count.

In portal terms: one box that combines "use the WiFi" with "receive marketing" is not freely given consent. The guest must be able to get online while declining marketing.

The safer pattern is a required WiFi terms box and a separate, unticked marketing box. You will collect fewer opt-ins than with a combined box, but every one of them will stand up.

Your Privacy Notice Obligations

Article 13 requires you to tell people, at the moment you collect their data:

1. 1Who the controller is (your business) and how to contact you
2. 2The purposes and the legal basis for processing
3. 3Who receives the data, such as your WiFi platform or email tool
4. 4How long you keep it, or how you decide
5. 5Their rights: access, rectification, erasure, restriction, portability and objection
6. 6That they can withdraw consent at any time
7. 7That they can complain to a supervisory authority

You do not need all of this on the portal itself. A clearly visible link to a complete privacy notice is the usual approach. Article 12 also requires the notice to be concise and in clear, plain language, so legal jargon a guest cannot follow does not meet the standard.

Data Subject Rights: What You Must Support

The rights that come up most often with WiFi data:

Right of access (Article 15): a guest can ask for a copy of all the data you hold on them, including visit history.

Right to rectification (Article 16): a guest can ask you to correct a wrong email or name.

Right to erasure (Article 17): a guest can ask you to delete their data. For marketing data that rests on consent, you should expect to honour these requests.

Withdrawing consent and objecting to marketing (Articles 7(3) and 21): a guest can withdraw consent at any time, and once someone objects to direct marketing their data must no longer be used for it.

Under Article 12(3) you must answer requests without undue delay and within one month, extendable by two further months for complex cases. Every marketing email needs an unsubscribe link that works.

Before going live, check that you can:

• Find and export everything you hold on one guest by email address
• Delete one guest's data completely
• Stop marketing to someone as soon as they unsubscribe

Data Retention: You Cannot Keep Data Indefinitely

Keeping every guest forever is a common failure. Article 5(1)(e), the storage limitation principle, says personal data may be kept no longer than necessary for the purpose.

The GDPR does not name a period. You choose one, write down why, and state it in your privacy notice. For example, you might decide to delete or anonymise guests who have not visited or opened an email for 24 months. Whatever you choose, apply it consistently.

In practice:

• Delete or anonymise records once a guest passes your inactivity period
• Optionally send one last email before deleting, asking if they want to stay on the list
• Keep only aggregate counts (logins per day, for example) for long-term trends; a device identifier is still personal data, so it does not make a record anonymous

CCPA for US Venues

The California Consumer Privacy Act, as amended by the CPRA from 2023, applies to for-profit businesses doing business in California that meet any one of these thresholds, according to the California Privacy Protection Agency: annual gross revenue of $26,625,000 or more (the figure in effect from January 1 2025, adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or making half or more of annual revenue from selling or sharing personal information.

Most independent venues will not meet these thresholds, but multi-site groups and larger hospitality companies may. Where the CCPA applies, the main obligations include:

• Right to know: consumers can ask what personal information you collect, why, and who you share it with
• Right to delete: similar to the GDPR right to erasure
• Right to opt out of sale or sharing: if you sell guest data or share it for cross-context advertising, Californians can tell you to stop
• No retaliation: you cannot refuse service to someone for using these rights

If you collect emails only for your own marketing and do not sell or share them, CCPA compliance is far simpler. Other US states have passed similar laws with their own thresholds, so check the states you operate in.

The Data Processing Agreement

Article 28(3) requires that processing by a processor is governed by a contract. Your WiFi platform stores and processes guest data on your behalf, so it is a processor and you need a data processing agreement (DPA) with it.

Before going live with any WiFi platform, check:

1. 1A DPA is available, either built into the terms or for signature
2. 2The provider lists its sub-processors (hosting, email delivery and so on)
3. 3Where the data is stored, and what transfer safeguards apply if it leaves the EU or UK

A provider that cannot produce a DPA when asked is a serious red flag.

Practical Compliance Checklist

Before your portal goes live, confirm:

• The portal separates WiFi access from marketing consent
• The marketing box is unticked by default
• A privacy notice link is visible on the portal
• The privacy notice covers everything in Article 13, in plain language
• Every marketing email has a working unsubscribe link
• You can export one guest's data for an access request
• You can delete one guest's data for an erasure request
• A DPA is in place with your platform provider
• Your retention period is written down and applied
• You have a process for answering requests within one month

The compliance page sets out how VoqadoWiFi handles guest data on its side. We do not have a standard DPA document; ask through the contact form and we will answer the one you send.

• 1GDPR consent must be freely given, specific, informed and unambiguous, so pre-ticked boxes do not count
• 2Link a privacy notice where you collect the data; GDPR Article 13 lists what it must say
• 3Guests can ask to see, correct or delete their data, and you normally have one month to respond
• 4The GDPR sets no fixed retention period: choose one, justify it and state it in your privacy notice
• 5Article 28 requires a contract (a data processing agreement) with any processor, including your WiFi platform