Skip to main content
English (UK)

How to leverage SMS marketing for restaurants to increase return visits

This guide explains how restaurant operators and venue IT teams can use Guest WiFi infrastructure to capture verified, GDPR-compliant first-party data and automate SMS marketing campaigns that drive measurable return visits. It covers the full technical architecture from captive portal configuration and RADIUS authentication through to Purple Engage segmentation, SMS gateway delivery, and closed-loop attribution. Marketing Directors, CRM Managers, and venue operators will find actionable deployment steps, compliance guidance, and ROI measurement frameworks.

📖 8 min read📝 1,981 words🔧 2 worked examples❓ 4 practice questions📚 10 key definitions

Listen to this guide

View podcast transcript
PART 1 - INTRODUCTION AND TECHNICAL DEEP-DIVE Right. Let's talk about SMS marketing for restaurants, and specifically, why the way most operators approach it is fundamentally broken. The problem is not the channel. SMS is extraordinary. Ninety-eight per cent open rate. Ninety per cent of messages read within three minutes. A conversion rate of up to thirty-two per cent. Those numbers are not marketing copy; they come from Gartner and from operators who have actually deployed this at scale. The problem is the data. Most restaurants are trying to run SMS campaigns with phone numbers they collected from a paper sign-up sheet, a third-party delivery app, or a loyalty card that guests filled in once and forgot about. That data is stale, unverified, and in many cases, non-compliant with GDPR. Here is the insight that changes everything. Your physical network infrastructure - specifically your Guest WiFi - is already collecting verified, consented, first-party data from every single guest who walks through the door. The question is whether you are using it. [pause] Let me walk you through the architecture, because this is where the real value sits. When a guest enters your restaurant and connects to the WiFi, they hit a Captive Portal. A Captive Portal is simply a web page that intercepts their connection and requires them to authenticate before they get internet access. At that moment, you have a unique opportunity. You can require a mobile phone number as the authentication credential, and you can present a clear, explicit opt-in checkbox for marketing communications. This is not a dark pattern. This is a conscious-choice opt-in. The guest sees exactly what they are agreeing to. They tick the box. They get online. You get a verified mobile number, a timestamp, and a GDPR-compliant consent record. The authentication itself runs through RADIUS - Remote Authentication Dial-In User Service. It is the industry-standard protocol for network access control. The access point communicates with the Purple cloud overlay, which handles the authentication and stores the profile. Now, here is where it gets interesting from an IT perspective. This architecture is hardware-agnostic. Whether your venues are running Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, or Ubiquiti UniFi, the Purple cloud overlay integrates directly. You do not need a hardware refresh. The intelligence sits in the cloud, not in the access point. Once the guest data is in the platform, Purple Engage builds a unified profile. It tracks visit frequency, dwell time, the time of day they typically visit, and which locations they frequent. This is first-party behavioural data. It is yours. No third-party intermediary owns it. From that profile, you configure automated triggers. For example: a guest who visited three times in the last month but has not returned in forty-five days automatically receives an SMS at eleven in the morning on a Thursday. The message is personalised. It references their visit history. It offers a specific incentive for the upcoming weekend. The message routes through an SMS gateway to the carrier network and lands on the guest's phone within seconds. When they return to the venue, their device reconnects to the Guest WiFi automatically. Purple logs that return visit and attributes it directly to the campaign. You now have a closed-loop measurement system. - PART 2 - CASE STUDIES, PITFALLS, Q&A, AND SUMMARY Let me give you two concrete examples of how this plays out in practice. First: a fifty-location restaurant chain. They had inconsistent data collection across sites. Some venues used Cisco Meraki, others used HPE Aruba. The marketing team could not run a unified campaign because the data lived in silos. The solution was to deploy the Purple cloud overlay across all fifty locations. A single captive portal configuration, pushed centrally, standardised the data capture. Within sixty days, they had a clean, unified database of opted-in phone numbers from guests across every site. The first SMS campaign, targeting lapsed regulars who had not visited in forty-five days, drove a twenty-two percent return visit rate. Second: a stadium hospitality operator. They wanted to drive traffic to specific food and beverage outlets during low-demand periods of an event. Using the Guest WiFi location analytics, the system detected high density in seating areas but low traffic near the concession stands. It triggered an SMS campaign to opted-in guests offering a time-limited discount, valid for the next thirty minutes. The result was a measurable uplift in outlet revenue during what would otherwise have been a dead period. [pause] Now, let me be direct about where operators go wrong, because the pitfalls are predictable. The first mistake is a slow captive portal. If the portal takes more than two seconds to load, guests abandon it. You lose the data capture opportunity. Keep the portal form minimal. Ask for a phone number and consent. Nothing else. The second mistake is pre-ticked consent boxes. Under GDPR, this is not valid consent. The guest must actively tick the box. Purple's platform enforces this by design. The third mistake is message frequency. SMS is an intimate channel. Two promotional messages per month is the ceiling for most audiences. Go above that, and opt-out rates climb sharply. The fourth mistake is sending to the full list. Segment. A guest who visits every week does not need a win-back message. A guest who visited once six months ago does. Use the behavioural data to send the right message to the right person at the right time. [pause] Let me address the questions I hear most often. Does this work if we already have a loyalty programme? Yes. The Guest WiFi data enriches your existing loyalty profiles. You can match phone numbers to loyalty IDs and fill gaps in your CRM. What about guests who do not want to give their phone number? They can still access the WiFi via email or social login. The phone number field is mandatory only for the SMS opt-in flow. How long does deployment take? For a single venue, configuration takes less than a day. For a multi-site rollout, the centralised management console means you can push a consistent configuration to all locations simultaneously. Is the data secure? Purple holds ISO 27001 certification and is GDPR and CCPA compliant. The platform has processed over four hundred and forty million logins in 2024 across eighty thousand live venues, with ninety-nine point nine nine nine per cent uptime. [pause] To summarise. SMS marketing for restaurants delivers extraordinary results, but only when the underlying data is clean, consented, and current. Guest WiFi is the most reliable mechanism for capturing that data at scale. The architecture is straightforward. Captive portal captures the phone number and consent. Purple Engage builds the behavioural profile. Automated triggers send the right message at the right time. Return visits are tracked and attributed back to the campaign. The three things to do this week: first, audit your current captive portal and confirm it is capturing phone numbers with explicit opt-in. Second, check your existing guest database for compliance; remove any records without a clear consent timestamp. Third, configure one automated trigger in Purple Engage for lapsed guests, set it live, and measure the return visit rate over thirty days. That is where you start. The data will tell you what to do next. Thank you for your time.

header_image.png

Executive summary

SMS marketing for restaurant venues is not a broadcast channel. It is a precision data operation. The channel itself is exceptional: 98% open rates, 90% of messages read within three minutes, and conversion rates up to 32% (Gartner, 2022). The bottleneck is always the data. Most operators are running campaigns against stale, unverified phone numbers collected from paper sign-up sheets or third-party delivery apps. That data is non-compliant with GDPR and ineffective at scale.

The fix is already installed in your venue. Your Guest WiFi network captures a verified mobile number from every guest who connects, at the exact moment of visit, with explicit consent. Purple Engage connects that data to an automated SMS campaign engine, segments guests by behaviour, and triggers personalised messages that drive return visits. Return visits are then tracked automatically when the guest's device reconnects to the network, closing the attribution loop.

This guide covers the architecture, deployment steps, compliance requirements, and measurable outcomes for implementing SMS marketing for restaurant environments at scale.

Technical deep-dive

The data capture architecture

The foundation of effective SMS marketing for restaurant venues is first-party data collected at the point of visit. Relying on staff to request phone numbers is inconsistent and unscalable. The network infrastructure must automate this.

When a guest enters the venue and connects to the Guest WiFi SSID, the access point redirects their HTTP traffic to a captive portal. A captive portal is a web page that intercepts the connection and requires authentication before granting internet access. At this point, the portal presents a form requesting a mobile phone number and an explicit, unticked opt-in checkbox for marketing communications.

This is a conscious-choice opt-in. The guest actively ticks the box, reads the consent statement, and submits the form. The system records the phone number, the timestamp, the venue location, and the consent status. This record satisfies the requirements of GDPR Article 7 and the UK GDPR, which require that consent be freely given, specific, informed, and unambiguous.

The authentication itself runs over RADIUS (Remote Authentication Dial-In User Service), the industry-standard protocol for network access control defined in RFC 2865. The access point acts as a RADIUS client, forwarding the guest's credentials to the Purple cloud overlay, which acts as the RADIUS server. Purple validates the credentials, authorises access, and stores the guest profile.

campaign_architecture_diagram.png

Hardware-agnostic integration

This architecture does not require a hardware refresh. Purple operates as a cloud overlay that integrates directly with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet. The intelligence sits in the cloud, not in the access point. You configure the access point to redirect unauthenticated clients to the Purple captive portal URL, and the platform handles the rest.

Across 80,000+ live venues and 440 million logins processed in 2024 (Purple internal data), this architecture has proven reliable at every scale from a single-site restaurant to a 50-location chain.

Data enrichment and segmentation

Once the guest profile exists in Purple Engage, the platform begins building a behavioural record. Each subsequent visit appends data: visit frequency, dwell time, time of day, day of week, and venue location. Over three to four visits, the platform has sufficient data to segment guests meaningfully.

Segments are defined by rules applied to this behavioural data. For example:

Segment name Rule definition Intended campaign
Lapsed regulars Visited 3+ times in 90 days, no visit in 45 days Win-back SMS with weekend incentive
New guests First visit within 7 days Welcome message with return offer
High-frequency guests Visited 8+ times in 90 days Loyalty reward notification
Lunch-time visitors Average visit time between 11:30 and 14:00 Midweek lunch promotion

This segmentation is what separates effective SMS marketing for restaurant venues from generic broadcast campaigns. A guest who visits every week does not need a win-back message. A guest who visited once six months ago does.

Automated campaign triggers

From the segment definition, you configure an automation trigger in Purple Engage. The trigger specifies the condition (e.g., 45 days since last visit), the send time (e.g., Thursday at 11:00 AM), and the message template. Dynamic fields pull the guest's first name and the venue name into the message automatically.

The message routes from Purple Engage through an SMS gateway to the carrier network. Delivery typically occurs within seconds. When the guest returns to the venue, their device reconnects to the Guest WiFi automatically. Purple logs this as a return visit and attributes it to the campaign, creating a closed-loop measurement system.

sms_funnel_infographic.png

Listen to the expert briefing

Implementation guide

Deploying SMS marketing for restaurant operations requires a structured approach across network configuration, platform setup, and campaign design.

Step 1: Configure the Captive Portal

Log into the Purple portal and navigate to the splash page editor. Add the phone number field as a mandatory authentication requirement for Guest WiFi access. Include a clearly worded opt-in checkbox for marketing communications. The checkbox must be unticked by default. The consent statement must specify what the guest is agreeing to, how often they will receive messages, and how to opt out.

For guidance on designing an effective splash page, see How to make a great first impression with your guest WiFi (and keep your brand consistent) .

Step 2: Define segmentation rules

In Purple Engage, create the segments that reflect your marketing objectives. Start with two: a win-back segment for lapsed guests (no visit in 30 to 45 days) and a new guest segment (first visit within the last seven days). These two segments cover the highest-value use cases and provide a baseline for measuring campaign effectiveness.

Step 3: Build the automation triggers

For the lapsed guest segment, configure a trigger to send an SMS at 11:00 AM on a Thursday. Thursday is optimal for restaurant promotions because guests are planning their weekend dining. The message should be short, personal, and include a specific offer with a clear expiry date.

For the new guest segment, configure a trigger to send 48 hours after the first visit. The message should thank the guest and offer a reason to return within the next two weeks.

Step 4: Test and deploy

Run a test campaign using a small internal group. Verify message delivery, dynamic field accuracy (guest name, venue name), and the functionality of any included links. Check that the opt-out mechanism works correctly. Once verified, activate the automation.

Step 5: Measure and optimise

After 30 days, review the campaign performance in the Purple analytics dashboard. The key metrics are delivery rate, open rate (tracked via link clicks), return visit rate, and opt-out rate. Use these to refine the message timing, offer value, and segment criteria.

For further reading on related channel strategies, see How to leverage SMS marketing agencies to increase return visits .

Best practices

These practices reflect industry standards and operational experience across 80,000+ venues.

Timing drives results. Send dinner promotions between 3:00 PM and 5:00 PM, when guests are making dining decisions. Send weekend offers on Thursday morning. Avoid sending messages after 9:00 PM or before 9:00 AM; this is a TCPA requirement in the US and a GDPR best practice in the UK and EU.

One message, one action. Every SMS must have a single, clear call to action. Include a direct link to book a table or view the offer. Remove any secondary information that dilutes the action.

Limit frequency. Two promotional messages per month is the ceiling for most guest audiences. Exceeding this increases opt-out rates sharply. Every opt-out is a permanent loss from the database.

Personalise at minimum. Include the guest's first name in every message. Messages addressed to the guest by name achieve 50% higher redemption rates than generic messages (Bloom Intelligence, 2024).

Maintain the opt-out path. Every message must include a clear opt-out instruction, such as "Reply STOP to unsubscribe." This is a legal requirement under TCPA and a GDPR obligation. Purple's platform appends this automatically.

Audit the database quarterly. Remove phone numbers that have not engaged with any message in 12 months. Sending to inactive numbers increases bounce rates and risks carrier blocking.

-

Troubleshooting and risk mitigation

High portal abandonment rate

If guests connect to the SSID but do not complete the captive portal login, the portal is likely loading too slowly or asking for too much information. Allocate sufficient bandwidth to the walled garden (the pre-authentication network zone). Reduce the portal form to the minimum required fields: phone number and consent checkbox. Every additional field reduces completion rates.

Invalid phone numbers in the database

If SMS delivery rates are low, the database likely contains invalid or landline numbers. Implement real-time phone number validation on the captive portal form. Purple's platform supports this natively, flagging numbers that do not match a valid mobile format before they enter the database.

Compliance violations

The two most common compliance failures are pre-ticked consent boxes and missing opt-out mechanisms. Pre-ticked boxes do not constitute valid consent under GDPR Article 7. Purple's platform enforces unticked defaults by design. Ensure every automated message template includes the opt-out instruction. Maintain a timestamped consent log; Purple stores this automatically and it is available for audit.

Carrier blocking

If a high volume of messages are sent to invalid numbers or generate a high opt-out rate, mobile carriers may flag the sender ID and block future messages. Maintain a clean database, respect frequency limits, and use a dedicated short code or verified sender ID rather than a generic long number.

Network architecture conflicts

In multi-SSID environments, ensure the Guest WiFi SSID is isolated from the staff and IoT networks. For guidance on SSID architecture, see Three SSIDs to rule them all: guest, Passpoint, and IoT WiFi . Incorrect VLAN configuration can cause the captive portal redirect to fail, preventing data capture entirely.

-

ROI and business impact

The business case for SMS marketing for restaurant venues rests on three measurable outcomes: return visit rate, cost per acquisition, and lifetime value uplift.

Return visit rate. Restaurants using behavioural SMS campaigns via Guest WiFi data typically see a 22% increase in return visits from lapsed guests (Purple internal data). For a venue with 500 lapsed guests per month, a 22% return rate generates 110 additional covers per month.

Cost per acquisition. SMS costs approximately £0.03 to £0.05 per message. Sending to 500 guests costs £15 to £25. If 110 guests return and spend an average of £30 per cover, the campaign generates £3,300 in revenue from a £25 spend. That is a return on spend of 132 times.

Lifetime value uplift. Guests who receive personalised SMS messages are 50% more likely to return than those who do not (Bloom Intelligence, 2024). A guest who visits twice a month instead of once doubles their annual spend at the venue.

Attribution accuracy. Because return visits are tracked via Guest WiFi reconnection, the attribution is direct and verifiable. Unlike email or social media campaigns, where attribution relies on self-reporting or probabilistic matching, the WiFi-based return visit log provides a deterministic record.

For a broader view of how Guest WiFi and WiFi Analytics contribute to venue revenue, explore Purple's product pages. For industry-specific deployment patterns, see the Hospitality and Retail sections.

Metric Typical result Source
SMS open rate 98% TextUs, 2025
Messages read within 3 minutes 90% Tatango
SMS conversion rate 32% Gartner, 2022
Return visit uplift from personalised SMS 50% more likely Bloom Intelligence, 2024
Lapsed guest recovery rate 22% Purple internal data
Average ROI per £1 spent £21 to £71 UpCity, 2023

Key Definitions

Captive Portal

A web page that intercepts network traffic from an unauthenticated client and requires user interaction - typically providing a phone number or email address - before granting internet access.

The primary mechanism for capturing first-party data in a physical venue. Every guest who wants internet access passes through this gate, making it the most reliable data collection point available to a restaurant operator.

RADIUS

Remote Authentication Dial-In User Service. A networking protocol defined in RFC 2865 that provides centralised authentication, authorisation, and accounting management for network access.

The access point acts as a RADIUS client, forwarding guest credentials to the Purple RADIUS server for validation. Understanding this protocol is important when configuring access points from Cisco Meraki, HPE Aruba, or Ruckus to integrate with the Purple platform.

First-party data

Information collected directly from your own audience, at the point of interaction, with their knowledge and consent - as opposed to data purchased from a third party or inferred from third-party tracking.

GDPR and increasing browser restrictions on third-party cookies make first-party data the only reliable foundation for digital marketing. Guest WiFi is one of the few mechanisms that generates verified, consented first-party data in a physical venue.

Conscious-choice opt-in

An opt-in mechanism where the guest actively selects a checkbox or confirms consent, rather than having consent assumed by default or pre-ticked. The checkbox must be unticked at the point of presentation.

Required under GDPR Article 7. Pre-ticked boxes do not constitute valid consent and expose the operator to enforcement action. Purple's platform enforces unticked defaults by design.

GDPR

General Data Protection Regulation. EU regulation (2016/679) governing the collection, storage, and use of personal data. The UK GDPR applies equivalent requirements in the United Kingdom post-Brexit.

Directly governs how restaurants collect and use guest phone numbers for SMS marketing. Key requirements: explicit consent, clear purpose specification, right to withdraw consent, and data minimisation.

TCPA

Telephone Consumer Protection Act. US federal law restricting telemarketing calls and automated text messages. Requires prior express written consent before sending marketing SMS messages.

Applies to any restaurant operating in or targeting guests in the United States. Violations carry fines of $500 to $1,500 per message. Strict opt-in management and opt-out processing are mandatory.

Cloud overlay

A software layer that operates on top of existing network hardware, providing additional capabilities - such as Captive Portal, analytics, and marketing automation - without requiring hardware replacement.

Purple's cloud overlay is the mechanism that makes hardware-agnostic deployment possible. It integrates with Cisco Meraki, HPE Aruba, Ruckus, and other major vendors via standard RADIUS and API connections.

Behavioural segmentation

Grouping guests based on their observed actions - visit frequency, dwell time, time of day, location - rather than demographic characteristics alone.

The basis for effective SMS targeting. A guest who visits every week requires a different message than one who visited once three months ago. Purple Engage builds these segments automatically from the WiFi session data.

Walled garden

The pre-authentication network zone on a Guest WiFi network. Clients in the walled garden can access the captive portal and any whitelisted URLs (such as the venue's own website) but cannot access the broader internet until they authenticate.

Ensuring the walled garden has sufficient bandwidth is critical for captive portal performance. A slow portal causes guests to abandon the login process, preventing data capture.

Dwell time

The duration a guest remains connected to the Guest WiFi network during a single visit, used as a proxy for time spent in the venue.

A key segmentation variable. A guest with a 90-minute average dwell time is likely a sit-down diner; one with a 15-minute average is likely a quick-service guest. These guests respond to different offers and message timing.

Worked Examples

A 50-location restaurant chain needs to standardise data collection across all venues to launch a unified SMS marketing strategy. Currently, each location uses different hardware - 30 sites run Cisco Meraki, 20 run HPE Aruba - and collects data inconsistently. The marketing team cannot run a chain-wide campaign because the data lives in silos.

Deploy the Purple cloud overlay across all 50 locations without replacing any hardware. Configure a single captive portal template in the Purple central management console, requiring a mobile phone number and an explicit, unticked marketing opt-in checkbox. Push this configuration to all 50 sites simultaneously. The Cisco Meraki sites are configured to redirect unauthenticated clients to the Purple portal URL via the Meraki splash page settings. The HPE Aruba sites are configured via the Aruba ClearPass integration. Both hardware types authenticate through the same Purple RADIUS endpoint. Within 60 days, the chain has a unified, GDPR-compliant database of opted-in phone numbers from guests across every site. Configure a single lapsed-guest automation trigger in Purple Engage: guests who visited three or more times in the previous 90 days but have not returned in 45 days receive an SMS at 11:00 AM on Thursday with a weekend offer.

Examiner's Commentary: This scenario demonstrates the hardware-agnostic value of the cloud overlay approach. The critical insight is that the marketing problem (siloed data) is solved by a network configuration change, not a CRM project. The 60-day timeline reflects the time needed to accumulate sufficient behavioural data for the lapsed-guest segment to populate. Launching the campaign before the segment has enough data produces poor results. The 22% return visit rate observed in this scenario is consistent with Purple's internal data across similar deployments.

A stadium hospitality operator runs food and beverage outlets across a 40,000-seat venue. During events, certain outlets experience high demand while others sit underutilised. The operator wants to use SMS to drive traffic to specific outlets in real time, without requiring staff to manually identify and contact guests.

Use Purple's Guest WiFi location analytics to monitor real-time guest density across the venue. Configure an automation rule in Purple Engage: when the system detects that a specific outlet zone has fewer than 20% of its typical peak-hour traffic while the event is in progress, trigger an SMS campaign to all opted-in guests currently connected to the WiFi in adjacent seating zones. The message offers a time-limited discount, valid for the next 30 minutes, at the underperforming outlet. Include a direct link to the outlet's digital menu. The trigger fires automatically without manual intervention. After the event, the Purple analytics dashboard shows the correlation between SMS sends and outlet traffic, providing attribution data for the next event.

Examiner's Commentary: This scenario illustrates the combination of location analytics and SMS automation. The key technical dependency is accurate zone-level WiFi coverage, which requires sufficient access point density to distinguish between seating areas and concourse zones. The 30-minute validity window creates urgency without being unreasonably short. The automation rule prevents the system from firing when the outlet is already at capacity, avoiding a negative guest experience.

Practice Questions

Q1. A restaurant operator wants to send an SMS to every guest who logged into the Guest WiFi in the past 12 months to promote a new menu launch. The database contains 8,000 phone numbers. What is the primary technical and compliance risk, and how should the operator address it?

Hint: Consider the requirements for explicit consent, the age of the consent records, and the difference between WiFi terms of service acceptance and marketing opt-in.

View model answer

The primary risk is a GDPR compliance violation. Logging into the Guest WiFi does not automatically constitute consent to receive marketing SMS messages. The operator must filter the 8,000 records to include only those with a timestamped, explicit marketing opt-in. Records where the guest accepted the WiFi terms of service but did not tick the marketing consent box must be excluded. Additionally, phone numbers decay over time; numbers collected 12 months ago have a higher invalid rate, which will increase bounce rates and risk carrier blocking. The operator should filter the database in Purple Engage to include only records with a valid marketing opt-in timestamp, then run a validation pass to remove invalid numbers before sending.

Q2. Your restaurant chain is migrating from Ruckus access points to Cisco Meraki across 20 sites over a three-month period. How does this hardware migration affect your existing Purple Engage SMS campaigns and guest data?

Hint: Consider where the guest data and campaign logic reside in the Purple architecture.

View model answer

The migration has no impact on the SMS campaigns or guest data. Purple operates as a hardware-agnostic cloud overlay. The guest profiles, segmentation rules, and automation triggers all reside in the Purple cloud, not in the access points. When each site migrates to Cisco Meraki, the new access points are configured to redirect unauthenticated clients to the existing Purple captive portal URL and to authenticate via the same Purple RADIUS endpoint. The guest data continues to accumulate without interruption. The only action required is updating the RADIUS server configuration on the new Cisco Meraki access points to point to Purple's RADIUS IP addresses and shared secret.

Q3. A venue operator notices that the captive portal completion rate has dropped from 68% to 31% over the past month. Guests are connecting to the SSID but abandoning the portal before submitting their phone number. What are the three most likely causes and how should each be diagnosed?

Hint: Consider network performance, portal design, and any recent configuration changes.

View model answer

The three most likely causes are: (1) Portal load time - the walled garden may have insufficient bandwidth, causing the portal to load slowly and guests to abandon it. Diagnose by measuring portal load time from a guest device during peak hours. If it exceeds two seconds, increase bandwidth allocation to the walled garden. (2) Portal form complexity - a recent change may have added additional required fields. Diagnose by reviewing the portal configuration change log. Remove any non-essential fields; the form should require only a phone number and consent checkbox. (3) SSID or DNS misconfiguration - a network change may have broken the captive portal redirect, causing some clients to see an error page rather than the portal. Diagnose by connecting a test device and checking whether the redirect fires correctly. Review any recent changes to the SSID configuration, DNS settings, or firewall rules.

Q4. A marketing manager wants to send SMS campaigns daily to maximise engagement. The IT manager objects on compliance and operational grounds. Who is correct, and what frequency policy should be implemented?

Hint: Consider GDPR proportionality, TCPA quiet hours, and the practical impact on opt-out rates.

View model answer

The IT manager is correct. Daily SMS sends violate the GDPR principle of data minimisation and proportionality - the frequency must be proportionate to the stated purpose at the time of consent. If guests consented to 'occasional promotional messages', daily sends exceed that scope. Under TCPA, messages sent before 8:00 AM or after 9:00 PM local time are prohibited, and excessive frequency is grounds for complaint. Operationally, daily messages will drive opt-out rates sharply upward, permanently reducing the database. The recommended policy is a maximum of two promotional messages per month, supplemented by behaviour-triggered automated messages (such as win-back or post-visit follow-up) which are event-driven rather than calendar-driven and therefore do not count against the promotional frequency limit.

Continue reading in this series