How to leverage advantages of SMS marketing to increase return visits
This technical guide details how IT and operations leaders can leverage existing enterprise WiFi infrastructure to capture first-party data and drive a 24% increase in return visits through automated SMS marketing. It covers deployment architecture, GDPR compliance, and behavioural segmentation strategies using Purple Engage.
Listen to this guide
View podcast transcript
- Executive summary
- Technical deep-dive: architecture and data flow
- Captive portal integration
- Identity resolution and passive tracking
- Implementation guide: segmentation and automation
- Core segmentation strategies
- Best practices and compliance
- Explicit consent is mandatory
- Manage frequency to prevent opt-outs
- Ensure robust opt-out workflows
- ROI and business impact

Executive summary
Guest WiFi is an underutilised asset in most physical venues. While IT teams deploy enterprise hardware from Cisco Meraki or HPE Aruba to provide connectivity, the commercial value of that infrastructure often remains untapped. This guide explains how to convert anonymous footfall into verified first-party data, enabling bulk SMS marketing campaigns that drive a 24% increase in return visits (Purple platform data). We detail the technical architecture required to capture phone numbers at the captive portal, manage consent under GDPR and TCPA, and automate targeted SMS dispatch using Purple Engage. For CTOs and venue operations directors, this approach provides a scalable, hardware-agnostic method to build a CRM database from scratch and generate measurable ROI without deploying custom mobile applications. SMS delivers a 98% open rate and returns between 21 and 41 pounds for every 1 pound spent (Sakari, 2025), making it one of the highest-performing direct marketing channels available to physical venue operators today.
Listen to the executive briefing podcast:
Technical deep-dive: architecture and data flow
Implementing a bulk SMS marketing strategy requires a secure, compliant data pipeline from the physical venue to the mobile device. The architecture relies on a cloud overlay that integrates with your existing wireless infrastructure - no hardware replacement required.
Captive portal integration
When a visitor connects to the Guest WiFi network, the wireless controller redirects their traffic to a captive portal hosted by Purple. This portal acts as the primary data ingestion point. Instead of open access, you require authentication via a phone number.
This process uses standard RADIUS (Remote Authentication Dial-In User Service) authentication. The hardware vendor - whether Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, or Fortinet - communicates with Purple's cloud RADIUS servers. Once the visitor provides their phone number and explicitly checks the opt-in box for SMS marketing, Purple authenticates the device MAC address and grants internet access. The phone number, device MAC address, timestamp, and venue location are securely transmitted to the Purple Engage CRM.

Identity resolution and passive tracking
Purple acts as the central identity provider. It matches the device MAC address to the provided phone number. As the visitor returns to the venue - or visits other venues within your estate - the network detects the MAC address and logs the visit without requiring re-authentication. This passive tracking builds a detailed behavioural profile: frequency of visits, dwell time, and cross-venue movement.
Modern mobile operating systems use private MAC addresses by default. However, devices typically assign a consistent private MAC address to a specific network SSID. As long as the visitor connects to your specific network, the tracking remains consistent for that venue, preserving the integrity of the data.
Implementation guide: segmentation and automation
The primary risk with SMS marketing is treating it as a broadcast channel. Sending generic messages to your entire database generates opt-outs, not return visits. The solution is behavioural segmentation. Because Purple Engage holds rich visit data, you can build precise audience segments and automate targeted campaigns.
Core segmentation strategies
Instead of mass texts, implement these automated triggers:
The win-back campaign (Lapsed visitors) Set a trigger in the CRM: if a device MAC address has not been detected in your venue for 60 days, dispatch an automated SMS with a strong re-engagement offer. A 20% discount or an exclusive event invitation drives immediate action.
The contextual welcome (Real-time targeting) When a known MAC address connects to your network, trigger an immediate SMS valid only for the next two hours at your on-site cafe or restaurant. The visitor is physically present, making the relevance immediate.
The loyalty reward (Frequent visitors) Segment visitors who connect three or more times per month. Send them early access to events or personalised recommendations based on their visit patterns.

Best practices and compliance
Compliance is the foundation of any sustainable SMS strategy. You must design your data capture workflows to meet strict regulatory standards.
Explicit consent is mandatory
Under GDPR Article 6(1)(a) and the TCPA, consent must be freely given, specific, informed, and unambiguous. Captive Portals must present an explicit, unticked opt-in checkbox. Pre-ticked boxes are not valid consent. Purple's portal enforces this by design. Ensure your opt-in language explicitly states the nature of the messages and the frequency.
Manage frequency to prevent opt-outs
Research shows that 53% of consumers unsubscribe from SMS lists because brands send too many messages. Limit promotional bulk SMS to no more than twice per week unless the message is triggered by real-time on-site behaviour. Triggered messages can be sent more frequently because they are contextually relevant.
Ensure robust opt-out workflows
Every SMS must include a clear opt-out instruction, such as "Reply STOP to unsubscribe." When a user replies STOP, your SMS gateway must update Purple Engage immediately, suppressing that number from all future campaigns. You must verify that your gateway integration is correctly configured before going live.
ROI and business impact
The advantages of SMS marketing for venue operators are clear and measurable. SMS achieves a 98% open rate, compared to email's 20%. Ninety percent of messages are read within three minutes of delivery. The click-through rate for SMS sits at around 18%, versus email's 2.5%.
When fuelled by first-party data captured through Guest WiFi, SMS becomes a precision instrument. Purple's platform data shows an average 24% increase in return visits for audiences engaged through automated SMS campaigns. Whether you operate in Retail , Hospitality , Healthcare , or Transport , converting your existing network infrastructure into a CRM engine provides a scalable method to generate measurable ROI.
Key Definitions
First-party data
Information collected directly from your audience or customers, such as phone numbers captured via a captive portal.
Crucial for building a CRM database that is immune to third-party cookie deprecation and algorithm changes.
Captive portal
A web page that users must view and interact with before access is granted to a public-access network.
The primary ingestion point for capturing visitor data and marketing consent on Guest WiFi networks.
RADIUS
Remote Authentication Dial-In User Service, a networking protocol that provides centralised authentication, authorisation, and accounting.
The standard protocol used by enterprise hardware (Cisco Meraki, HPE Aruba, etc.) to communicate with Purple's cloud platform.
MAC address
Media Access Control address, a unique identifier assigned to a network interface controller for use as a network address in communications.
Used by Purple Engage to passively track return visits and cross-venue movement without requiring users to log in again.
MAC address randomisation
A privacy feature in modern mobile operating systems that uses a private, rotating MAC address instead of the device's hardware address.
IT teams must understand that devices typically use a consistent private MAC address for a specific network SSID, preserving tracking integrity for that venue.
Identity resolution
The process of matching a device identifier (like a MAC address) to a known user profile (like a phone number).
Enables venues to link passive network probes to verified individuals for targeted marketing.
GDPR Article 6(1)(a)
The General Data Protection Regulation clause stating that processing is lawful only if the data subject has given consent.
Requires venue operators to use explicit, unticked opt-in checkboxes on captive portals.
TCPA
Telephone Consumer Protection Act, a US law regulating telemarketing calls, auto-dialled calls, pre-recorded calls, and text messages.
Requires clear opt-in language stating the nature and frequency of marketing messages.
Worked Examples
A 200-site retail chain needs to increase off-peak footfall without increasing their paid advertising spend.
The chain configured their Cisco Meraki access points to route traffic through the Purple captive portal. They required a phone number and presented an explicit SMS opt-in checkbox. Within 30 days, they built a database of opted-in shoppers. They created a segment for visitors who connected between 09:00 and 11:00, and scheduled an automated SMS campaign offering a 15% discount valid only before noon on weekdays.
A large stadium operator with 40,000 fans connecting to WiFi simultaneously needs to manage crowd flow and increase merchandise sales during events.
The operator used HPE Aruba hardware and Purple to capture phone numbers at login. They segmented the audience by access point location to determine whether a fan was in the North Stand or the South Stand. Five minutes before half-time, they dispatched localised SMS offers: North Stand fans received a discount code for the North Concourse store, and South Stand fans received one for the South Concourse.
Practice Questions
Q1. A hotel chain wants to launch an SMS campaign targeting guests who haven't visited in the last 6 months. Their marketing team proposes exporting the entire email database and sending a mass text. What is the technical and compliance risk of this approach?
Hint: Consider the difference between email consent and SMS consent, and the impact of broadcast messaging.
View model answer
The primary risk is compliance failure. Consent for email marketing does not automatically transfer to SMS marketing under GDPR or TCPA. Sending unsolicited texts to an email database violates regulations. Additionally, treating SMS as a broadcast channel rather than segmenting the audience leads to high opt-out rates (53% of consumers unsubscribe due to over-frequency). The correct approach is to capture explicit SMS consent via the Guest WiFi captive portal and trigger automated win-back campaigns based on MAC address absence.
Q2. Your venue's IT team reports that modern smartphones use MAC address randomisation. They are concerned this will break the ability to track return visits and trigger automated SMS campaigns. How do you address this concern?
Hint: Think about how iOS and Android handle private MAC addresses for specific network SSIDs.
View model answer
While iOS and Android use private MAC addresses, they typically assign and maintain a consistent private MAC address for a specific network SSID. Therefore, as long as the visitor connects to your specific Guest WiFi network, the tracking remains consistent for that venue. Purple's identity resolution links the provided phone number to this consistent private MAC address, allowing passive tracking of return visits without requiring the user to log in again.
Q3. A retail venue wants to trigger an SMS offer the moment a customer walks through the door. They plan to send a message every time the customer's device probes the network. Why is this a poor implementation strategy, and how should it be configured instead?
Hint: Consider the impact of frequency on opt-out rates and the necessity of meaningful segmentation.
View model answer
Triggering an SMS every time a device probes the network will result in severe over-frequency, leading to immediate opt-outs. A device may probe the network multiple times during a single visit or when the user simply walks past the venue. The strategy should be configured in Purple Engage to trigger only on a verified connection event, and it must include frequency capping (e.g., maximum one welcome message per week) and meaningful segmentation (e.g., targeting only first-time visitors or lapsed visitors) to ensure relevance.