CCPA Compliance for WiFi Marketing: The US Venue Operator's Guide

This is general information, not legal advice. We checked every legal statement below against the CCPA statute and regulations published by the California Privacy Protection Agency (CPPA) and the California Attorney General's CCPA page on 9 October 2026. If you are close to a threshold, or you share guest data with ad platforms, talk to a California privacy lawyer.

Who CCPA Applies To

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), covers for-profit businesses that do business in California and meet at least one of these thresholds (CCPA statute, Civil Code 1798.140(d), CPPA):

1. Annual gross revenue above $25 million in the preceding calendar year, as adjusted for inflation. The CPPA's adjusted figure is $26,625,000, effective January 1, 2025 (CPPA, CPI adjustments).
2. Alone or in combination, annually buys, sells or shares the personal information of 100,000 or more consumers or households.
3. Derives 50 percent or more of its annual revenue from selling or sharing consumers' personal information.

Read threshold 2 carefully. It counts personal information you buy, sell or share, not every guest who logs in. Collecting a large WiFi list and keeping it to yourself does not meet threshold 2 on its own.

"Share" has a narrow legal meaning: disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands (1798.140(ah) in the same statute). If you upload your guest list to an ad platform to target ads, check that activity against the definition before you assume you are outside the law.

Illustrative examples:

• An independent cafe in Ohio with local guests, revenue far below the threshold and no data sharing is very unlikely to be covered.
• An independent hotel in San Francisco is not covered just because it is in California and has busy WiFi. Revenue, selling and sharing are the tests.
• A restaurant group doing business in California with revenue above $26,625,000 is covered, and its WiFi portal is one of its collection points. The statute can also reach affiliates that control or are controlled by a covered business and share its branding (1798.140(d)(2)).

What Counts as Personal Information Under CCPA

The statute defines personal information as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked" with a particular consumer or household (1798.140(v)). Its listed examples include a real name, a unique personal identifier, an online identifier, an IP address and an email address.

A "unique identifier" includes a device identifier and an IP address: a persistent identifier that can recognize a consumer, or a device linked to a consumer, over time (1798.140(aj)). For a WiFi portal that means:

• Email address, name and phone number
• IP address
• MAC address, as a device identifier, when it can be linked to a guest
• Inferences drawn to build a profile of a guest, such as a visit pattern you use for targeting (1798.140(v)(1)(K))

Access points also log MAC addresses from devices that never sign in. If you store those and can link them to a guest, treat them as personal information too.

Consumer Rights Under CCPA

The Attorney General's CCPA page lists these rights:

Right to know what personal information a business collects about them and how it is used and shared.

Right to delete personal information collected from them, with some exceptions.

Right to opt out of sale or sharing, including through the Global Privacy Control (GPC).

Right to correct inaccurate personal information.

Right to limit the use and disclosure of sensitive personal information.

Right to non-discrimination for exercising these rights.

You have 45 days from receiving a verifiable request to respond, extendable once by another 45 days when reasonably necessary if you tell the consumer within the first 45 days (1798.130(a)(2)). You must offer two or more ways to submit requests, at minimum a toll-free number, unless you operate exclusively online (1798.130(a)(1)(A)).

In VoqadoWiFi, CRM / Guests > Export CSV gives you the guest records for a right to know request, and you can delete a guest from their record in CRM / Guests. Deletion in VoqadoWiFi does not reach copies elsewhere, such as a Mailchimp audience or a spreadsheet, so delete there too.

Portal Updates Required for California Visitors

If CCPA applies to you, your WiFi portal needs three things.

1. A Notice at Collection, at or before the point of collection. It lists the categories of personal information, the purposes, whether you sell or share it, and how long you keep each category or the criteria you use (1798.100(a)). For a web form, the regulations say you may post a conspicuous link to the notice close to the fields or close to the submit button (CCPA regulations, section 7012(c)(2), CPPA). If you do not give the notice, you must not collect the data (section 7012(d)). Our guest WiFi privacy notice template is a starting point.
2. Marketing that is not a condition of getting online. The non-discrimination rule bars denying goods or services because a consumer exercised their CCPA rights (1798.125(a)(1)(A)). Separately, the regulations define a financial incentive as "a program, benefit, or other offering, including payments to consumers, for the collection, retention, sale, or sharing of personal information" (section 7001(p)). If free WiFi or a discount is offered in exchange for an email address, read the notice of financial incentive rules in section 7016 with your lawyer. The cleanest setup is separate, unticked marketing consent next to the WiFi terms; VoqadoWiFi's explicit consent mode does this and records the wording each guest saw.
3. A "Do Not Sell or Share My Personal Information" link if you sell or share. The Attorney General's page says that if a business sells personal information, the notice at collection must include it.

CPRA Additions: Sensitive Data and Opt-Out Signals

The CPRA changes are now part of the CCPA text.

Sensitive data handling: Sensitive personal information includes account log-in details with a password, racial or ethnic origin, and precise geolocation, defined as device data used to locate a consumer within a circle with a radius of 1,850 feet (1798.140(ae) and (w)). Consumers can limit how you use it (1798.121). A typical guest WiFi form collects none of the listed items. Do not add fields that would, and ask your lawyer whether any location data your system keeps falls inside the geolocation definition.

Global Privacy Control (GPC): The Attorney General says a GPC signal "must be honored by covered businesses as a valid consumer request" to opt out of sale or sharing. The regulations add that this "is not required for a business that does not sell or share personal information" (section 7025(c)(1)). When it does apply, you treat the signal as an opt out for that browser or device and any profile linked to it.

Practical implication: If you do not sell or share guest data, GPC changes nothing for you. If you share it, for example by uploading guests to ad platforms, you need a way to process opt out signals. VoqadoWiFi's portal does not read GPC signals today, so a venue that shares guest data needs to handle opt outs another way, or stop sharing.

Penalties: The CPPA can impose administrative fines of up to $2,663 per violation, or $7,988 per intentional violation or violation involving the personal information of consumers the business knows are under 16, as adjusted from January 1, 2025 (CPPA, CPI adjustments; 1798.155(a)).

Next step: write down which of the three thresholds you meet, and whether any guest data leaves your systems for advertising. Those two answers decide most of the work above.