The four qualities that make consent valid
The GDPR defines consent as freely given, specific, informed and unambiguous (Article 4(11)). Freely given means the guest can decline and still receive the service; Article 7(4) treats a service made conditional on unneeded consent as a strong sign it was not free, so WiFi access should not depend on agreeing to marketing. Specific means consent covers a named purpose; agreement to a newsletter is not agreement to be profiled or to have data shared with partners. Informed means the guest was told who is collecting the data, what will be done with it, and how to withdraw. Unambiguous means a clear affirmative act. Pre-ticked boxes, silence and inactivity all fail this test (Recital 32), and bundling consent into acceptance of terms and conditions fails the specificity test.
Demonstrability is the part venues forget
Holding valid consent is only half the obligation; Article 7(1) says you must be able to show it. A defensible record captures who consented, the identifier they consented with, the exact wording displayed at the time, the timestamp, and the source such as which venue and which portal. Because consent wording changes, store a version reference or a copy of the text rather than assuming today's wording applied historically. Withdrawal must be as easy as giving consent (Article 7(3)) and should be logged the same way. A marketing list with no consent trail behind it is a liability regardless of how it was collected. VoqadoWiFi stores each choice with the wording shown and the time; every VoqadoWiFi login uses a separate, unticked marketing box.
Designing the moment on a splash page
Separate the two decisions visually. One control grants WiFi access and accepts terms; a distinct, unticked control grants marketing permission with plain language about what will be sent and roughly how often. Avoid dark patterns such as a prominent accept button beside a faint decline link: a design that steers the guest toward yes undercuts the freely given and unambiguous tests. A smaller list of people who genuinely agreed is worth more than a larger list of people who did not, because they expect your email and you can defend every record.
This is general information, not legal advice. Rules on consent and marketing differ by country and state, so check what applies where you operate.
Run a guest WiFi login on your own network
VoqadoWiFi runs branded guest portals on TP-Link Omada and Ubiquiti UniFi networks. The Starter plan is free forever: one location, 500 logins a month, consent logging included.
Common questions about opt-in consent
Can I require marketing consent in exchange for WiFi?
Under GDPR-style rules, no. Consent conditioned on receiving a service is not freely given. Offer WiFi regardless and make the marketing opt-in a genuine choice.
How long does consent last?
There is no fixed expiry, but consent goes stale. Many operators re-confirm contacts who have not engaged for a long period, both for compliance comfort and because unengaged contacts damage deliverability.
Related terms
Opt-In Consent rarely comes up on its own. These are the entries operators usually read next.
Double Opt-In
Double opt-in is a two-step subscription process: a guest submits their address, then confirms it by clicking a link in a verifica…
Splash Page
A splash page is the branded screen a guest sees when they connect to guest WiFi, before internet access is granted. It typically…
First-Party Data
First-party data is information a business collects directly from its own customers with their consent, such as an email address g…
Social WiFi Login
A social WiFi login lets guests authenticate to guest WiFi using an existing account, such as a social or email provider, instead…