Council public WiFi providers: procurement routes and what to specify

UK councils usually buy public WiFi in two parts. The cloud platform, meaning captive portal, filtering and reporting, often comes through G-Cloud. Access points, installation and backhaul come through a network framework or a tender under the Procurement Act 2023. Your specification should set coverage, peak concurrency, IWF filtering, WCAG 2.2 accessibility and a UK GDPR lawful basis.

Which procurement route should your council choose?

Most council public WiFi projects contain two different purchases. Treating them as one is the most common cause of delay.

The first purchase is a cloud software service. It covers the captive portal, which is the web page a visitor sees before getting online. It also covers authentication, content filtering and reporting. The second purchase is physical: access points on lamp columns and buildings, power, backhaul, installation and maintenance.

G-Cloud fits the first purchase. It is a Crown Commercial Service (CCS) framework for cloud hosting, cloud software and cloud support, bought through the Digital Marketplace. The physical build usually needs a framework that covers hardware and installation services, or your own competitive procedure.

A third model sits apart. The supplier funds the build and operation in return for access to council assets and the right to sell advertising or sponsorship. That arrangement may be a concession contract, which carries its own rules. Involve your legal team before you go to market.

The Procurement Act 2023 came into force on 24 February 2025 and replaced the Public Contracts Regulations 2015 for new procurements. Procurements and frameworks started under the old rules continue under them. Check which regime applies before you write a single requirement.

Where the procurement routes genuinely differ

The table compares the four routes UK councils use most for city centre WiFi procurement.

Route	Covers the cloud platform	Covers access points and installation	Competition required	Time to contract	Council control over data and branding	Best suited to
G-Cloud via the Digital Marketplace	Yes	No, cloud services only	No: search, shortlist, direct award	Fastest of the four	High	Replacing the platform on council-owned access points
CCS network framework, such as Network Services 3 (RM6116)	Yes, within a managed service	Yes	Further competition among framework suppliers	Moderate	High	A full build of a new town centre network
Open or competitive flexible procedure under the Procurement Act 2023	Yes, as specified	Yes, as specified	Full public competition on Find a Tender	Slowest, plus an eight working day standstill	High	Bundling WiFi with CCTV, sensors or other assets
Supplier-funded concession	Yes, supplier-provided	Yes, supplier-funded	Yes, above the concession threshold	Slow, similar to a tender	Lower: the supplier monetises the splash page	Councils with no capital budget that accept advertising

Framework lots and expiry dates change. Confirm the current lot structure and end date on the CCS website before you plan a timeline around any framework. Regional purchasing consortia also run frameworks with networking lots, so check those against your requirements too.

When G-Cloud is the right call

G-Cloud suits you when the radio network already exists or you are buying it separately. A typical case is a council that owns access points from an earlier project and whose platform contract is ending. You need a new captive portal, filtering and reporting layer on top of the existing hardware.

How a G-Cloud purchase runs

1. Write down your requirements before you search, including filtering, accessibility and reporting needs.
2. Search the Digital Marketplace with keywords that match those requirements, such as "guest WiFi" and "captive portal".
3. Save and export your search results. They form your audit trail.
4. Filter and shortlist against your requirements, asking suppliers clarification questions where a service description is unclear.
5. Evaluate the shortlist on price and quality, then direct award using the framework's call-off contract.

You buy each service as its supplier describes it on the Digital Marketplace. You cannot add requirements after award. If IWF filtering, WCAG 2.2 conformance or UK data hosting matter to you, check that the service description states them in writing.

Why hardware compatibility decides the shortlist

A platform that only works with one vendor's access points forces a hardware swap you did not budget for. Purple's Guest WiFi runs as a hardware-agnostic cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. A platform change therefore leaves the radio estate in place. For the full case, read why your next WiFi upgrade doesn't need new hardware. If your town centre runs on FortiGate firewalls, see our guide to FortiGate captive portal setup with an external portal server.

When a network framework or your own tender is the right call

A new build involves lamp column surveys, power connections, highways consents, backhaul and a maintenance regime. G-Cloud covers none of that. A further competition under a network framework lets you set your own specification and evaluation weighting among pre-qualified suppliers.

Run your own procedure when no framework fits. The same applies when you want to combine WiFi with CCTV, smart city sensors or small cell infrastructure on shared street assets. Under the Procurement Act 2023, you publish a tender notice on Find a Tender. You then assess bids against published award criteria and send each bidder an assessment summary. A standstill period of eight working days follows before you sign.

The Public Services (Social Value) Act 2012 requires you to consider economic, social and environmental wellbeing when procuring services above the threshold. Give social value a weighting and ask for measurable commitments, not statements.

Worked scenario: splitting a market town purchase (illustrative figures)

Situation. A market town council wants free public WiFi along a 600-metre pedestrianised high street and inside its covered market hall. It owns council CCTV fibre along the street but has no access points. Its own people counters show around 8,000 visitors in the zone on a peak Saturday.

What was done. The council split the purchase in two. It bought access points, mounting and installation through a framework further competition, with a post-installation validation survey as a payment milestone. It then bought the cloud platform through G-Cloud and made hardware compatibility a pass or fail shortlist criterion. To size capacity, it assumed 25% of peak visitors would connect, and that 60% of those would be online at the same moment.

Outcome. The arithmetic gave a written capacity requirement: 8,000 x 25% x 60% = 1,200 concurrent devices at peak. Every bidder priced against the same 1,200-device figure, so bids were directly comparable. Because the two purchases were separate, the council could replace the platform later without touching the radio network.

What should a council public WiFi specification include?

A good specification states outcomes you can test at handover. Avoid vendor model numbers. Specify what the network must do and how you will measure it.

Coverage

Define the coverage zone on a map and mark the indoor spaces, such as market halls, libraries and bus stations. Require a predictive design survey before installation and a validation survey afterwards, both against a minimum signal level agreed in the design. Our guide to WiFi site surveys explains what each survey should deliver. Specify outdoor-rated access points with an ingress protection rating under IEC 60529 that suits street mounting. Require structural assessment of any lamp column used.

Specify WiFi 6 (IEEE 802.11ax) or later. It handles dense crowds better than older standards, which matters on market days and at events.

Concurrency and capacity

State peak concurrent devices per zone, as in the worked scenario above. Set a minimum per-device throughput and an event-day uplift for parades, markets and festivals. Specify backhaul capacity that matches the peak, not the average. Require per-device bandwidth limits so one visitor cannot saturate a zone.

Content filtering against the IWF list

Every UK public WiFi network should block the Internet Watch Foundation (IWF) URL List. That list identifies webpages known to host child sexual abuse imagery, and IWF updates it twice a day. Make it a mandatory requirement on every SSID, with no visitor-side opt-out.

Go further and require Friendly WiFi accreditation. It is the UK's government-initiated certification scheme for public WiFi filtering. As a minimum, it requires blocking of the IWF list and pornographic content. Add any further categories your council decides, such as malware and phishing sites. Require a documented process for reviewing sites blocked in error.

Accessibility

The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 cover council websites. Your captive portal is a council-branded web page, so specify WCAG 2.2 level AA conformance and a published accessibility statement. Require the portal to work with screen readers and at 400% zoom. It should not depend on a CAPTCHA, and it should offer at least one login route that needs no social media account.

Consider Passpoint (also called Hotspot 2.0) and OpenRoaming. Both are industry standards that let a device join a WiFi network automatically, using credentials it already holds. Returning visitors then skip the portal entirely, which helps anyone who finds web forms difficult.

UK GDPR lawful basis and PECR

Under Article 6 of UK GDPR, public authorities cannot rely on legitimate interests for processing carried out to perform their tasks. For running the WiFi service itself, your lawful basis is usually public task under Article 6(1)(e). Your data protection officer should confirm it. Any electronic marketing needs consent under the Privacy and Electronic Communications Regulations 2003 (PECR). That means unticked boxes and conscious-choice opt-ins, kept separate from the terms of use.

Article 35(3)(c) of UK GDPR requires a data protection impact assessment (DPIA) for systematic monitoring of a publicly accessible area on a large scale. Footfall reporting across a town centre falls squarely within that description. Complete the DPIA before you award the contract.

In most models, the council is the data controller and the supplier is its processor, under an Article 28 contract. Specify retention periods, UK data hosting or an adequacy basis, and data return on exit. If a sponsor will receive any data, map the controller relationship before launch. Purple holds ISO 27001 and Cyber Essentials certification, is GDPR and CCPA compliant, and is a certified B Corp.

Security and service levels

Most public WiFi runs as an open network behind a captive portal. Specify client isolation, so devices on the network cannot reach each other. Where the access points support it, specify Opportunistic Wireless Encryption (OWE), certified as Enhanced Open, which encrypts traffic on open networks without a password.

Set a platform uptime target with service credits, plus response times by fault severity. Purple's platform runs at 99.999% uptime. Require an exit plan that returns your data in a standard format and leaves the access points usable with another platform.

What council public WiFi costs to run, and who pays

Budget across three cost lines. Capital covers access points, mounting, backhaul installation and surveys. Recurring costs cover platform licences, backhaul circuits, power, maintenance and support. Periodic costs cover the hardware refresh at the end of the access points' working life. Many projects fund the capital and forget the recurring line, and the network degrades within a few years.

Funding model	Who pays	Council control	Best when
Council capital and revenue budget	The council	Full control of branding, data and filtering	You want WiFi as public infrastructure with no advertising
Business Improvement District (BID) levy	Levy-paying businesses through the BID	Shared with the BID board	A BID already funds high street improvements in the zone
UK Shared Prosperity Fund allocation	Central government, through your local investment plan	Full, within grant conditions	Your investment plan covers town centre improvements
Splash page sponsorship	A named local sponsor	High: you approve sponsor content	A local employer or developer wants civic visibility
Supplier-funded concession	The supplier, recovered through advertising	Lower: the supplier controls monetisation	You have no capital budget and accept advertising

Sponsor and advertising content on a portal falls under the UK Code of Non-broadcast Advertising (the CAP Code). Write approval rights into the contract. Grant-funded projects should check that recurring costs remain eligible, or that revenue funding exists once the grant ends.

How do councils measure high street footfall with WiFi?

WiFi gives economic development teams two data sources, and they differ in reliability.

Connected sessions come from visitors who log in through the captive portal. They give accurate counts of visits, dwell time, time of day and, where a visitor has opted in, repeat visits. This is your most dependable footfall data.

Presence detection counts devices that search for WiFi without connecting. Since iOS 14 and Android 10, phones use randomised MAC addresses by default. A single phone can therefore appear as several devices. Treat presence counts as trend indicators, not headcounts, and calibrate them against fixed people counters where you have them.

The ICO treats MAC addresses as potentially personal data. Put signage at the edge of the coverage zone and in your privacy notice explaining what you collect and why.

Report the measures a high street board can act on: weekly visits, average dwell time, return rate, evening economy activity, zone-by-zone comparisons and event uplift. Purple's WiFi Analytics presents these as dashboards your team can share with BIDs and traders. Purple recorded 440 million logins across its network in 2024, according to its own data. The same reporting model serves retail estates and shopping centres.

Worked scenario: measuring a festival weekend (illustrative figures)

Situation. A city centre runs a two-day food festival. The economic development team needs to show traders and the BID whether the event drew people into the core shopping streets, and for how long.

What was done. The team took connected sessions from the four Saturdays before the festival as a baseline. They then compared the festival Saturday by zone, separating the festival site from the surrounding retail streets.

Outcome. On these illustrative numbers, the baseline averaged 2,400 connected visits and the festival Saturday recorded 3,600. That is a 50% uplift: (3,600 - 2,400) / 2,400. Average dwell time rose from 38 to 61 minutes. The zone split showed that most of the extra visits stayed inside the festival site, which shaped next year's route planning.

How should you judge public WiFi suppliers on evidence?

Score suppliers on what they can prove. A claim with no document behind it scores zero.

What they claim	Evidence to request	Red flag
Scale and experience	Live venue count, references at comparable public spaces	Only case studies with no named sites
Reliability	Uptime history and SLA with service credits	Uptime target with no credits attached
Security	ISO 27001 certificate and its scope, Cyber Essentials certificate	Certificate scope excludes the service you are buying
Content filtering	IWF list membership or Friendly WiFi accreditation	"We filter adult content" with no named list
Accessibility	WCAG 2.2 AA audit report and accessibility statement	No audit, or an audit of an older WCAG version
Data protection	Template DPIA, Article 28 terms, data hosting location	Marketing consent bundled into terms of use
Hardware compatibility	Named access point vendors, with integration documentation	Platform tied to one hardware vendor
Footfall reporting	Sample reports, explanation of how MAC randomisation is handled	Presence counts sold as exact headcounts
Exit	Written exit plan and data export format	No data return commitment

Purple runs guest WiFi across 80,000+ live venues in over 90 countries. Our transport customers include c2c Rail and Avanti West Coast, covered on our trains page. For hospitality references, see hotels. To compare portal platforms side by side, read Cloud4Wi alternatives: captive portal platforms compared.

Council public WiFi specification checklist

Copy these into your requirements document as testable statements.

Procurement

• Cloud platform and physical build scoped as separate lots or purchases
• Regime confirmed: Procurement Act 2023 or legacy rules
• Social value weighting and measurable commitments defined
• Contract term, renewal options and exit plan stated

Coverage and capacity

• Coverage zone mapped, indoor spaces marked
• Predictive design survey and post-installation validation survey required
• WiFi 6 (IEEE 802.11ax) or later, outdoor-rated access points
• Peak concurrent devices per zone stated, with event-day uplift
• Minimum per-device throughput and backhaul capacity stated

Filtering and security

• IWF URL List blocked on every SSID
• Friendly WiFi accreditation required
• Additional filter categories listed, with a process for reviewing sites blocked in error
• Client isolation enabled, OWE where supported

Accessibility

• Captive portal conforms to WCAG 2.2 level AA
• Accessibility statement published
• Login route available with no social media account
• Passpoint or OpenRoaming support for automatic reconnection

Data protection

• Lawful basis documented for each processing purpose
• DPIA completed before contract award
• Marketing consent separate, unticked and PECR compliant
• Article 28 processor terms, retention periods and UK hosting or adequacy basis
• Coverage zone signage and privacy notice in place

Reporting and service

• Connected visits, dwell time, return rate and zone comparisons in standard reports
• Presence data labelled as estimates
• Uptime SLA with service credits and fault response times
• Data export in a standard format on exit

How to decide for your town centre

Answer three questions in order. Do you already own working access points? If you do, G-Cloud is usually the fastest route to a new platform. Do you need a new physical network? Then use a framework further competition, or your own procedure if you are bundling other street assets. Do you lack capital funding? Weigh BID, grant and sponsorship options before you accept a concession, because a concession hands control of the splash page and its data to the supplier.

Whichever route you take, specify outcomes you can test at handover: coverage, concurrency, IWF filtering, WCAG 2.2 and a documented lawful basis.

Frequently asked questions

How do councils procure public WiFi?

Councils usually procure public WiFi in two parts. The cloud platform, covering captive portal, filtering and reporting, is often bought through G-Cloud on the Digital Marketplace. Access points, installation and backhaul are bought through a CCS or regional framework further competition, or through an open or competitive flexible procedure under the Procurement Act 2023. Some councils use supplier-funded concessions instead, where advertising pays for the network.

Can public WiFi be bought through G-Cloud?

Yes, the cloud software part can be bought through G-Cloud. Captive portal, authentication, content filtering and reporting services are listed on the Digital Marketplace, and you can direct award after searching and shortlisting. G-Cloud does not cover physical access points, mounting, power or installation, so a new build needs a separate purchase. Check each service description carefully, because you cannot add requirements after award.

What content filtering does UK public WiFi need?

UK public WiFi should block the Internet Watch Foundation URL List, which identifies webpages hosting child sexual abuse imagery. Most councils also require Friendly WiFi accreditation, the government-initiated scheme that sets IWF list and pornography blocking as its minimum. You can add categories such as malware and phishing. Require a documented process for reviewing sites blocked in error, so legitimate services stay reachable for residents and visitors.

How do councils measure high street footfall with WiFi?

Councils measure footfall through connected sessions and presence detection. Connected sessions from portal logins give accurate visit counts, dwell time and repeat visits where visitors opt in. Presence detection counts devices searching for WiFi, but MAC address randomisation since iOS 14 and Android 10 makes those counts estimates. Report connected data as your primary measure and calibrate presence trends against fixed people counters.

Can we keep our existing access points if we change provider?

Yes, if the new platform is hardware-agnostic. Purple runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet access points. Changing platform then means reconfiguring the existing network to point at the new captive portal, not replacing hardware. Ask any bidder to name the vendors they support and provide integration documentation for yours.

What lawful basis should a council use for public WiFi data?

Most councils use public task under Article 6(1)(e) of UK GDPR to run the WiFi service. Public authorities cannot rely on legitimate interests for processing carried out to perform their tasks. Electronic marketing needs separate consent under PECR, collected with unticked boxes. Complete a DPIA before launch, because town centre footfall reporting counts as systematic monitoring of a publicly accessible area.

Can sponsorship or advertising fund free public WiFi?

Yes, sponsorship and advertising can fund free public WiFi, with trade-offs. A named sponsor on the splash page keeps council control high if you retain approval rights over content. A supplier-funded concession can cover build and running costs, but the supplier controls monetisation of the portal. Advertising content must comply with the CAP Code, and any data shared with a sponsor needs a clear controller relationship.