CCPA Compliance for WiFi Marketing: The US Venue Operator's Guide

Who CCPA Applies To

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to for-profit businesses that:

1. Have annual gross revenues exceeding $25 million; OR
2. Buy, sell, or share the personal information of 100,000 or more California consumers or households annually; OR
3. Derive 50% or more of annual revenues from selling or sharing consumers' personal information

For most independent hospitality venues, threshold 1 and threshold 3 are unlikely to apply. Threshold 2 — 100,000 California consumers annually — is the most relevant trigger for venues with significant WiFi traffic and California customer bases (relevant for: venues in California, hotels, tourist-area venues).

A single location café in Ohio serving primarily local customers is almost certainly not subject to CCPA. A hotel in San Francisco or Los Angeles with significant WiFi traffic is almost certainly subject to it.

What Counts as Personal Information Under CCPA

CCPA's definition of personal information is broader than GDPR's. For WiFi marketing purposes, the following all qualify as personal information under CCPA:

• Email address
• IP address
• MAC address (device identifier)
• Inferences drawn from WiFi session data (visit frequency, dwell time patterns)
• Name
• Any data that identifies, relates to, or could be linked to a specific consumer

The MAC address classification is particularly important for WiFi operators. CCPA treats MAC addresses as personal identifiers — which means the passive probe-request data your APs detect from non-connecting devices is potentially subject to CCPA if it is stored and linked to an individual.

Consumer Rights Under CCPA

CCPA grants California consumers the following rights:

Right to Know: Consumers can request disclosure of what personal information you have collected about them, how it was collected, and who it was shared with.

Right to Delete: Consumers can request deletion of their personal information from your systems (with certain exceptions).

Right to Opt-Out of Sale: If you sell personal information, consumers can opt out. For most venue operators who do not sell data, this is not applicable — but note that CPRA expands "sharing" to include sharing data with advertising networks, which might apply if you use Facebook Custom Audiences with your WiFi list.

Right to Correct: Under CPRA (2023 expansion), consumers can request correction of inaccurate personal information.

Right to Limit Use of Sensitive Personal Information: CPRA creates a new category of "sensitive personal information" (precise geolocation, racial origin, health data, biometric data, etc.) that consumers can limit the use of.

Portal Updates Required for California Visitors

If CCPA applies to your operation, your WiFi portal must:

1. Disclose at the point of collection what personal information you collect and why (a "Notice at Collection" — typically a linked privacy notice or a summary statement on the portal page)
2. Not require marketing consent as a condition of WiFi access (aligns with CCPA's prohibition on denying service for exercising privacy rights — similar to GDPR's freely given consent requirement)
3. Include a Do-Not-Sell/Do-Not-Share link in your privacy policy if you share data with advertising networks

CPRA Additions: Sensitive Data and Opt-Out Signals

CPRA (effective January 1, 2023) added obligations beyond original CCPA:

Sensitive data handling: If your WiFi system collects or infers sensitive personal information (precise geolocation is the most common in hospitality), consumers can limit its use to what is necessary to provide the requested service.

Global Privacy Control (GPC): Businesses subject to CCPA must honour GPC signals — a browser-level privacy preference that signals an opt-out from data selling/sharing. If a California consumer visits your portal with GPC enabled, you must treat this as a Do-Not-Sell signal.

Practical implication: Check with your WiFi marketing platform vendor whether their portal software detects and honours GPC signals. VoqadoWiFi honours GPC signals on portal pages for opted-in CCPA mode.