Captive Portal vs Open WiFi: Which Is Better for Your Business?

The Question Behind the Question

When an operator asks whether to run open WiFi or a captive portal, they are rarely asking a networking question. They are asking a trade question: how much guest friction is a marketing list worth?

That is the right instinct, and it deserves an actual answer rather than a vendor pitch. So this piece does three things. It defines the options precisely, because the terms get used interchangeably and they are not the same. It walks through the ROI arithmetic with stated assumptions you can replace. And it names the cases where open WiFi is the better call, because those cases exist.

Definitions, Precisely

Open WiFi

An SSID that any device can join without credentials or interaction. The guest selects the network and is online. No password, no landing page, no record beyond what the access point logs at the MAC address level.

Password-protected WiFi

A network secured with WPA2 or WPA3 using a shared passphrase, usually printed on a receipt or a card at the counter. It restricts access and encrypts traffic over the air, but it captures no identity. From a marketing point of view it behaves exactly like open WiFi. We cover that comparison in captive portal vs password WiFi.

Captive portal WiFi

The guest joins the network, but traffic is held until they complete an action on a landing page. That action can be a simple terms acceptance or a short form that captures a name, an email address and, separately, marketing consent.

The distinction that matters: a captive portal is not a security measure. It is an identity layer. Anyone conflating the two is going to make a bad decision in one direction or the other.

The Honest Case for Open WiFi

Open WiFi is not a mistake in every context, and the case for it is stronger than most vendors admit.

It has zero friction. Nothing stands between the device and the internet. For venues where the WiFi is part of the product, that can matter more than data.

It works with everything. Captive portals have real compatibility edges. Phones that use a private (randomized) MAC address can look like a new device to the network, so guests may see the portal again sooner than you expect. Some smart TVs, handheld consoles and older IoT devices cannot show a portal at all. If your guests bring that class of device, an open SSID avoids a support burden.

It requires no consent infrastructure. If you collect nothing, you have nothing to store, secure, disclose or delete on request. That is a real reduction in compliance work.

It costs nothing to run. No portal software, no list hygiene, no email platform.

The cost of open WiFi does not show up on an invoice. Every guest interaction ends at the door. You provided value, they used it, and the relationship ends when they walk out. Whether that matters depends on whether repeat business is part of your economics.

The Case for a Captive Portal

A portal turns an anonymous session into a contactable record, and that record does four things open WiFi cannot.

It builds an owned list. Email is one of the few channels where an algorithm does not decide who sees your message. And the people on this list have actually been in your venue.

It produces behavioral data. Connection frequency, day-part patterns and time since last visit, per person. This is first-party data generated as a byproduct of a service you already provide.

It enables segmentation. Once you can tell a weekly regular from a one-time visitor, you can stop sending the same message to both.

It creates an attribution trail. A promo code in a portal-sourced email tells you which campaigns produced which visits. Open WiFi cannot do this, because it produces no campaigns.

The cost of a portal is one additional screen, a small compatibility tail, and a real obligation to handle personal data properly.

Running the Numbers

Vague ROI claims are worthless, so here is the arithmetic with every input stated. These are assumed numbers for illustration, not results from a real venue. Replace them with your own.

Assumptions

• 120 guests connect per day, about 3,600 connections a month
• Average transaction value: $24
• After removing regulars who connect repeatedly, 600 genuinely new people a month opt in to marketing
• Email open rate: 35 percent. For reference, Mailchimp's all-users average is 35.63 percent (Mailchimp email marketing benchmarks, data to December 2023). Mailchimp notes that Apple Mail Privacy Protection affects open rate accuracy, so treat any open rate as rough.
• 5 percent of people who open a campaign come in and redeem it
• Software: $49 a month on the Growth plan, which includes 5,000 guest logins a month
• Contribution margin: 65 percent

Open WiFi returns

Marketing revenue you can attribute to the network: zero. There is no mechanism by which an anonymous session produces a follow-up visit that you caused. The network still has value (guests may stay longer and appreciate the amenity) but it produces no measurable return.

Captive portal returns

After six months the list holds about 3,600 contacts. One campaign a month to that list:

• 3,600 sends at 35 percent open equals 1,260 opens
• 1,260 opens at 5 percent redemption equals 63 visits
• 63 visits at $24 equals $1,512 in campaign revenue
• At 65 percent contribution margin, about $980 of contribution
• Against $49 of software

Break-even

Each redeemed visit contributes about $15.60 ($24 at 65 percent). The software is covered at four redeemed visits a month. Halve the open rate and the redemption rate together and this illustration still produces about 16 visits and roughly $245 of contribution.

Two things make the real number smaller than the arithmetic. Some of those guests would have come back anyway, and any discount in the offer comes out of the margin. That is why the promo code matters: it shows you what the campaign actually caused. Our guest WiFi marketing cost guide breaks down what drives the software bill.

The Objections, Answered

"The extra screen will annoy guests." Some guests will skip it, and that is fine. The bigger risk is a badly built portal: slow to load, too many fields, no clear reason to sign up, or a form that breaks inside the iPhone captive network window. Friction is mostly a design problem. Measure how many people reach the portal against how many complete it, and fix the form before blaming the concept.

"We tried it and nobody signed up." A low opt-in rate almost always traces to one of three causes: the form asks for more than a name and an email, the offer is generic, or the portal does not display properly on a common device. All three are fixable. See opt-in rate optimization for the diagnostic sequence.

"Isn't collecting emails a privacy problem?" It is a privacy responsibility, which is not the same thing. In the EU and UK, marketing consent must be a clear opt-in: pre-ticked boxes do not count (GDPR Recital 32; CJEU, Planet49, C-673/17, 2019), and tying a service to consent that it does not need weighs against the consent being freely given (GDPR Article 7(4)). So keep WiFi access and marketing consent separate, store a timestamp, and make withdrawal easy. In the US, the CAN-SPAM Act does not require opt-in, but it does require a working unsubscribe and a postal address. The CCPA applies only to businesses above its thresholds, which most single venues are not. We still recommend explicit opt-in everywhere, because it keeps the list clean. This is general information, not legal advice.

"Won't it slow the network down?" The portal step happens when the guest first joins and again when their session expires. It does not affect throughput afterwards. Slowness noticed after a portal goes live is usually an unrelated bandwidth or access point placement issue.

The Security Point Nobody Makes Loudly Enough

A traditional open network does not encrypt traffic between the device and the access point, so anyone in radio range with freely available tools can capture it. Newer hardware can run Wi-Fi Enhanced Open, which encrypts open networks without a password (Wi-Fi Alliance, Security), but older guest devices may not support it.

Most browsing now uses HTTPS, so the practical risk to a guest is lower than it was a decade ago. It is not zero. An open SSID with nothing in front of it also gives you no terms of use and no record of who was on the network if something goes wrong.

A captive portal does not encrypt traffic either, and vendors who imply otherwise are being careless. What it adds is a terms acceptance tied to a session and a record of who connected. Client isolation (stopping guest devices from seeing each other) is a separate SSID setting on Omada and UniFi controllers: turn it on whichever option you choose.

The Decision Framework

Choose open WiFi if any of these describe your situation:

• Guests connect once and will not return, such as an airport gate area or a transit hub
• Most guest devices cannot show a portal reliably
• You have no capacity to run even one email campaign per quarter
• Your legal or procurement environment makes personal data collection impractical

Choose a captive portal if any of these describe your situation:

• Repeat business is part of your economics
• You currently cannot contact the people who walk through your door
• You have quiet periods you would like to fill with people who already like you
• You want to know whether marketing spend produces visits

For most restaurants, cafes, bars, hotels, gyms, salons and shops, the second list applies. Open WiFi is the right choice in a narrow set of circumstances.

What We Would Actually Do

Run the portal, but run it well. Two fields. A specific promise. An unticked consent box, logged and easy to withdraw. A welcome email ready before the list exists. One campaign a month, segmented by visit behavior from the start.

If the compatibility tail worries you, run a second open SSID alongside the portal network for devices that cannot sign in. Omada and UniFi controllers both let you add an SSID in a few minutes, and it removes the last real argument against portals without giving up the list.

The Starter plan is free for a single location and 500 logins a month, which is enough to measure your actual opt-in rate before committing to anything. That measurement is worth more than any assumption in this article, including ours.