WiFi Data Retention: How Long Should You Keep Guest Data?

This is general information, not legal advice. We checked the legal points below against the GDPR text, the UK ICO's guidance and the California CCPA statute on 9 October 2026.

What Data You Actually Hold

A WiFi marketing setup produces several kinds of data, and each needs its own retention decision.

Contact data: name, email address, phone if you ask for it, birthday if you ask for it, and the guest's consent choices with the wording shown. This is the core marketing record.

Session records: timestamped logs of each connection, with the device MAC address, the venue or access point, and start and end times. Your WiFi controller keeps its own logs as well as your WiFi marketing platform.

Behavioural data: what you derive from sessions, such as visit counts, the last visit date and segments like regulars or lapsed guests.

Marketing interaction data: opens, clicks and unsubscribes. These sit in your email platform (Mailchimp or similar) under that platform's terms, so your policy has to cover them there too.

Aggregated analytics: footfall counts and dwell time charts with no identifiers. Once data is truly anonymised it is no longer personal data, which is why the ICO lists anonymising as an alternative to deleting. Pseudonymised data, such as a hashed email or a MAC address you can map back, still counts as personal data (ICO, storage limitation).

GDPR's Storage Limitation Principle

GDPR Article 5(1)(e) requires personal data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (GDPR, EUR-Lex).

There is no universal number. The ICO says plainly that "the UK GDPR does not set specific time limits for different types of data", and that "you need a policy setting standard retention periods wherever possible" (ICO). Three other articles turn that into paperwork:

• Article 13(2)(a): when you collect the data, tell people "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period". On a WiFi portal that goes in the privacy notice linked from the form.
• Article 30(1)(f): your record of processing should include, where possible, "the envisaged time limits for erasure of the different categories of data".
• Article 5(2): you must be able to demonstrate compliance, so write the reasons down.

The US has the same idea in places. California's CCPA requires covered businesses to state at collection how long they intend to keep each category of personal information, or the criteria used, and not to keep it longer than reasonably necessary (CCPA statute 1798.100(a)(3), CPPA). If you collect data from children under 13 in the US, the amended COPPA Rule requires a written retention policy with a deletion timeframe (16 CFR 312.10, eCFR).

Practical Retention Windows

These are our starting points as operators, not legal minimums or maximums. Adjust them to your purposes and write down why.

Active marketing contacts (opted in, visiting): keep while the guest keeps visiting or clicking. Review anyone with no visit and no click for 12 months. Either ask them once whether they still want to hear from you, or delete them and keep only the email address on a suppression list.

Session logs (raw WiFi session records): 12 months lets you compare a season with the same season last year. Anything older needs a reason. Check whether national law where you operate requires you to keep connection logs for a set period, because that overrides your own preference.

Unsubscribed contacts: stop all marketing use. Keep only what you need to make sure you never email them again. The ICO's own example says it is appropriate to "retain enough information about the former customer" to honour a marketing objection. That usually means the email address alone, held on a suppression list.

Hard bounced contacts: an address that hard bounces cannot receive your email, so there is little reason to keep it as a marketing record. We suppress or delete them within 30 days.

Erasure requests: under Article 17, a person can have their data erased when it is no longer necessary for its purpose or when they withdraw the consent it relied on and there is no other legal ground. Erase it everywhere it lives, including your email platform.

The Deliverability Argument for Retention Limits

Old lists hurt sending as well as compliance. Addresses get abandoned, and guests who have forgotten signing up at your bar two years ago are the ones most likely to press "report spam".

Mailbox providers watch complaint rates closely. Google's sender guidelines ask senders to keep the spam rate reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% (Google Workspace Admin Help, email sender guidelines). A short, recently active list makes those numbers much easier to hold.

In Mailchimp there are two different tools, and they do different jobs:

• Archive moves a contact out of your audience. Archived contacts "don't count toward your billing tier", but Mailchimp itself says "archiving is not a legal substitute for deletion" (Mailchimp, Archive contacts).
• Permanently delete erases the contact's personal information, and Mailchimp warns that "these contacts can never be re-imported again" (Mailchimp, Delete contacts). Use it for erasure requests.

Implementing Automatic Deletion

VoqadoWiFi does not have an automatic retention setting today, so retention is a scheduled task you run. Here is the routine we suggest:

1. Once a quarter, go to CRM / Guests and export the CSV of all guests. It includes the last visit date and the consent columns.
2. Sort by last visit and mark everyone past your retention window.
3. Delete those guests from their record in CRM / Guests. Deleting a guest there removes the guest and their session rows.
4. Remove the same people from your email platform. VoqadoWiFi does not delete them from Mailchimp for you.
5. Keep the suppression list (email addresses only) so nobody you deleted is emailed again by mistake.

Then document the periods: in your record of processing and in the privacy notice linked from your portal. Our guest WiFi privacy notice template has a section for it. State the actual periods, or the criteria if a fixed period is not possible, because Article 13 asks for one or the other.