Retail WiFi procurement checklist: guest access, filtering and footfall analytics

A retail WiFi procurement checklist should test five things. Guest access must capture consented first-party data and filtering must cover every store. Footfall reports must compare stores like for like. The guest network must be segmented out of PCI DSS scope. The platform must run on the access points you own, such as Cisco Meraki, HPE Aruba or Ruckus.

What should a retail WiFi procurement checklist cover?

Retail guest WiFi serves three internal buyers. A tender that scores only one of them leaves the other two buying their own tools.

• IT wants a secure network that runs on the hardware already in the ceiling.
• Marketing wants consented contacts it can use.
• Operations wants footfall reporting to staff stores and compare formats.

This checklist is built around those three asks. It covers five areas:

• Guest access: how shoppers connect, what you capture and how you record consent.
• Content filtering: what is blocked, where the policy is enforced and how you prove it.
• Footfall reporting: which visitor metrics you get, how accurate they are and how they reach operations.
• Security and compliance: PCI DSS segmentation, encryption, GDPR and certifications.
• Estate fit: hardware support, multi-site management and integrations.

Purple runs Guest WiFi across 80,000+ live venues in over 90 countries. The platform handled 440 million logins in 2024 (Purple master deck, 2026). The questions below reflect what multi-site Retail buyers ask in tenders, and what you should ask any vendor you shortlist.

What do you need before you go to tender?

Four pieces of groundwork turn a vague requirement into one you can score. Skip them and every vendor's answer sounds equally good.

An estate inventory

List every store with its access point vendor, model, controller or cloud dashboard, and broadband line. Acquisitions and franchise models often leave a chain running two or three vendors at once. Note where you do not own the network, such as concessions inside department stores or units in a landlord-run shopping centre.

The inventory tells you whether a platform must work across mixed hardware. It also shows whether a refresh is genuinely due, or whether a cloud overlay on existing access points will do. Why your next WiFi upgrade doesn't need new hardware sets out that test.

Named owners for each area

Give each of the five areas an owner who signs off the score:

• IT owns security and estate fit.
• Marketing or CRM owns guest access and data capture.
• The head of operations owns footfall reporting.
• Your data protection officer reviews all three before contract.

Data protection groundwork

Guest WiFi collects personal data. Presence-based footfall counting can also involve device identifiers. Under UK GDPR and EU GDPR you need a lawful basis for each purpose.

Article 35 requires a data protection impact assessment (DPIA) where processing is likely to be high risk. The ICO's list of high-risk processing includes monitoring a person's location or behaviour. Email and SMS marketing in the UK also falls under the Privacy and Electronic Communications Regulations (PECR). Draft the DPIA before tender, so vendors answer against your actual risk register.

A baseline

Record what you measure today:

• daily connections per store
• login completion
• marketing opt-in rate
• door counter totals

Without a baseline, you cannot prove the new platform improved anything. If you have no guest WiFi data yet, door counter or till transaction counts give you a starting point.

How do you work through the checklist, area by area?

Score each area separately, then weight it to your priorities. A grocer may weight footfall reporting above data capture. A luxury brand may reverse that.

Guest access: how shoppers connect

The access method decides how much data you capture and how much friction shoppers feel. The captive portal is the splash page a device shows before it reaches the internet. It is where you capture details and record consent. Ask to see it live on iOS and Android, because both open captive portals in a restricted mini-browser.

Passpoint, also called Hotspot 2.0, lets a device join a network automatically using stored credentials. OpenRoaming is a roaming federation run by the Wireless Broadband Alliance. It is built on Passpoint and lets one sign-in work across participating venues.

Access method	What you capture	Shopper effort	Consent record	Who it suits
Click-through terms	Device and session data only	One tap	Terms acceptance, no marketing consent	Convenience stores and forecourts that want access, not data
Email or form registration	Name, email, optional profile fields	One short form on first visit	Separate, unticked marketing opt-in	Fashion, beauty and department stores building a CRM base
Social login	Profile fields the social network releases	Two to three taps	Separate opt-in plus the network's permission screen	Brands with a younger, social-first audience
SMS verification	Verified mobile number	Enter a code from a text	Separate SMS marketing opt-in under PECR	Retailers that run SMS campaigns
OpenRoaming or Passpoint	Identity from the roaming provider	None after first setup	Captured at enrolment, not each visit	Shopping centres and high-footfall estates wanting automatic reconnection

Ask every vendor:

• Is marketing consent a separate, unticked choice? GDPR requires a clear affirmative act, and Recital 32 rules out pre-ticked boxes. Purple calls this approach conscious-choice opt-ins.
• Can one splash page design run across all stores, with regional or per-store variations?
• Do returning shoppers reconnect without registering again, and for how long?
• Can you export consent records with the timestamp and the exact wording each shopper saw?

Content filtering: what is blocked and where

Retail guest networks are public spaces, often used by children. Filtering protects your brand and stops your connection being used to reach illegal content.

In the UK, Friendly WiFi is a voluntary accreditation for public WiFi. It requires blocking of pornography and of child sexual abuse content on the Internet Watch Foundation (IWF) list. Ask whether filtering comes from the platform, your in-store hardware or a third-party DNS service, and who maintains the category lists.

Where filtering runs	How it works	Strength	Limitation	Who it suits
DNS filtering service	Blocks domains when a device looks them up	One policy across mixed hardware	Sees domains, not full URLs on HTTPS sites	Mixed-vendor estates wanting one rulebook
Store firewall or gateway	Category filtering on an appliance such as Cisco Meraki MX or Fortinet FortiGate	Filters applications as well as domains	Mixed estates run one rulebook per vendor	Single-vendor estates with security appliances in store
TLS inspection	Decrypts HTTPS traffic to read full URLs	Most granular control	Needs a certificate installed on each device	Staff networks, never guest networks
No filtering	Open internet	Nothing to configure	Brand and safeguarding exposure, fails Friendly WiFi	Not suitable for public retail space

Ask every vendor:

• Where is the policy enforced, and does it apply identically on every hardware vendor you run?
• Which categories are blocked by default, and can you change them per site?
• How do you prove filtering is on during an audit or accreditation check?
• Can you allow-list services your stores depend on, such as your own app or click-and-collect pages?

Do not accept "yes, we filter" without a named enforcement point.

Footfall reporting: what operations actually asks for

Heads of operations ask four questions:

• How many people came in?
• How long did they stay?
• How many came back?
• How does this store compare with the others?

Guest WiFi answers them from two data sources. Connected data comes from shoppers who join the network. Presence data comes from nearby devices with WiFi switched on, even if they never connect.

Metric	Data source	Who uses it	What to check
Visitors by hour and day	Presence and connected	Store and area managers planning rotas	Reconcile against door counters in the pilot
Dwell time	Presence and connected	Operations and space planning	Exclude staff devices and set a minimum dwell threshold
Capture rate (walk-ins as a share of passers-by)	Presence	Property and window display teams	Needs access point coverage near the entrance
Return-visit rate	Connected, logged-in shoppers	CRM and operations	Randomised MAC addresses break presence-based return counts
Store comparison table	Presence and connected	Regional and head office operations	Normalise for store size and access point count

Device privacy changes matter here. iOS 14 and Android 10 onwards use a private, randomised MAC address for each network by default, and newer versions can rotate it. Reports that count devices by MAC address will overcount visitors and undercount returns. Return-visit figures are reliable only when they come from logged-in shoppers. Ask each vendor for their written method.

The ICO's guidance on WiFi location analytics treats device MAC addresses as personal data where they can single out an individual. To meet that standard:

• Display clear signage at store entrances.
• Pseudonymise identifiers.
• Set a retention period.

Purple's WiFi Analytics brings visitor and connection data from every venue into one view. Operations can then compare stores on the same measures. Confirm that any platform can export to your business intelligence (BI) tools by API or scheduled file.

Security and compliance

If guest WiFi shares a network with card terminals, the guest network can fall inside PCI DSS scope. PCI DSS treats segmentation as the way to reduce scope.

Isolate guest traffic from the cardholder data environment with firewall rules and a separate VLAN, a virtual LAN that keeps traffic logically apart. Turn on client isolation so guest devices cannot see each other. Confirm card terminals never join the guest SSID, the network name shoppers see.

Open guest networks send traffic unencrypted over the air. Enhanced Open, based on Opportunistic Wireless Encryption (OWE, RFC 8110), encrypts each device's connection without a password. WPA3 makes Protected Management Frames (IEEE 802.11w) mandatory. Protected Management Frames: A Practical Guide for 2026 covers the device compatibility checks.

Ask for certificates, not statements. Purple holds ISO 27001 and Cyber Essentials certification, is a certified B Corp, and is GDPR and CCPA compliant. Ask every vendor where shopper data is hosted and which sub-processors handle it.

Many stores still share one staff WiFi password, and the same tender can replace it. IEEE 802.1X is the standard for authenticating each device individually against an identity source. Purple's Identity-Based Networks give each colleague their own credential from Microsoft Entra ID, Okta or Google Workspace. Purple revokes access automatically when a colleague leaves.

Estate fit: hardware, management and integrations

A multi-site retailer rarely runs one hardware vendor. Purple is hardware-agnostic and runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You keep your access points. What changes is where the splash page, authentication and reporting come from.

Ask every vendor:

• Can head office push one change to every store from a single pane of glass?
• Can store managers see their own store without editing the others?
• Does the platform integrate with your CRM and marketing platforms?
• What are the support hours, and do they cover your trading hours?

For wider design guidance, see Network Best Practices for Venues and Enterprises in 2026.

The master checklist

Area	Question to ask every vendor	What a pass looks like
Guest access	Is marketing consent a separate, unticked choice?	Shown on the live splash page, with wording stored against each record
Guest access	Do returning shoppers reconnect automatically?	Reconnection without a form for a period you set
Content filtering	Where is the filter enforced?	Named enforcement point, same policy on every vendor you run
Content filtering	Can you prove it to an auditor?	Blocked-category tests pass in the pilot, with a policy export
Footfall reporting	How do reports handle MAC randomisation?	Written method, with return visits based on logged-in shoppers
Footfall reporting	Can operations compare stores?	One exportable report ranking all stores on visitors, dwell and returns
Security	Is guest traffic segmented from card terminals?	Separate VLAN, firewall rules and client isolation documented per site
Security	Which certifications are current?	Certificates supplied, such as ISO 27001 and Cyber Essentials
Estate fit	Does it run on every access point vendor you own?	Live reference on each vendor in your inventory
Estate fit	Can head office push one change to every store?	Template change applied to all pilot stores from one dashboard
Data rights	Can you export and delete a shopper's data on request?	Access and erasure requests completed during the pilot

How do you check a shortlisted platform works?

Pilot in three to five stores that cover your formats, such as a flagship, a high street store, a retail park unit and a concession. Run these seven tests and record the results against the master checklist.

1. Connection: on current iOS and Android devices, the captive portal appears, completes and reaches the internet.
2. Consent: register test accounts with opt-in on and off. Confirm your CRM receives only the opted-in records.
3. Filtering: try to reach test pages in each blocked category. Confirm your own app and allow-listed pages still load.
4. Footfall: compare daily visitor counts against door counters. Expect a consistent gap, but the daily trends should move together.
5. Segmentation: from a guest device, try to reach payment and back-office subnets. The test passes only if every attempt fails.
6. Data rights: submit an access request and an erasure request, and time the response.
7. Coverage: walk the shop floor, fitting rooms and tills. Weak signal often traces to channel planning, covered in The Ultimate Guide to WiFi Channels: 2.4GHz vs 5GHz Explained.

The same pilot discipline applies in transport. Airport WiFi platform providers: what to require in the RFP shows how it adapts to passengers.

What does this look like across a real estate?

The two scenarios below are illustrative. They show the method, and the figures are worked assumptions, not reported results.

Scenario 1: a 160-store fashion chain after an acquisition

Situation. A fashion chain runs 120 stores on Cisco Meraki and has just acquired a 40-store brand on HPE Aruba. It holds two guest WiFi contracts and two consent formats. Door counters cover only 70 stores, so operations cannot compare the whole estate.

What was done. The retailer weighted estate fit at 30% and scored every vendor on the master checklist. It chose a hardware-agnostic cloud overlay and migrated store by store outside trading hours. Before switching, it exported both sets of consent records. One splash page now runs everywhere, and return visits come from logged-in shoppers only.

Measurable outcome. The planned refresh of 160 access points across the acquired stores, four per store, came out of the budget. Consent records now sit in one format. Operations compares all 160 stores in one report, up from 70 with door counters alone.

Scenario 2: a landlord-run shopping centre with 85 units

Situation. The asset manager wants dwell time by zone to support leasing conversations. The centre draws a family audience, so management wants Friendly WiFi accreditation.

What was done. Access points were mapped to four zones. DNS filtering applied the IWF list and the pornography category across the whole centre. OpenRoaming let repeat visitors reconnect without a splash page. Signage at every entrance explained the data collected and linked to the privacy notice.

Measurable outcome. The leasing team now quotes monthly dwell time for each of the four zones. It could not produce that figure before. Filtering is documented and testable for the accreditation check.

What goes wrong in retail WiFi procurement, and how do you fix it?

The tender scores features nobody owns

Long feature lists reward vendors who tick boxes, not ones that fit your estate. Fix it by naming an owner for each area before tender. Score only requirements an owner will use in the first year.

Return-visit numbers collapse after launch

MAC randomisation makes the same phone look like a new device. Fix it by reporting returns from logged-in shoppers. Treat presence data as a visitor count, not a loyalty measure.

The splash page fails on some phones

Captive portal mini-browsers block some scripts and pop-ups. The walled garden is the list of domains a device can reach before login. Social login fails if those providers' domains are missing from it. Fix it by testing on current iOS and Android builds and keeping the walled garden in the vendor's checklist.

Filtering blocks something you need

A category filter can catch your own app, a payment page or click-and-collect. Fix it by building an allow-list during the pilot and reviewing it after each app release.

Card terminals end up on the guest network

A store manager connects a temporary terminal to the only network they know the password for. Fix it by giving terminals their own segmented network and documenting it per site. Repeat the segmentation test whenever a store changes layout.

Consent records are lost in migration

Switching provider without exporting consent leaves contacts you cannot prove consent for. Fix it by exporting every record with its timestamp and wording before cut-over.

Concessions sit on someone else's network

Department stores and shopping centres often own the network your concession uses. Fix it with a contract clause that covers guest access, filtering and data ownership.

What does retail guest WiFi cost, and what do you get back?

Model the full cost, not only the licence.

Cost line	What drives it	How to reduce it
Platform licence	Number of venues, plan and term	Match the plan to each store format; Purple offers Connect, Capture and Engage
Access point hardware	Replacement versus reuse	Run a cloud overlay on the access points you own
Broadband	Bandwidth per store	Cap guest bandwidth per session
Content filtering	DNS service or appliance licence	Reuse firewall filtering licences in single-vendor estates
Implementation	Sites, vendors and integrations	Roll out from templates, store by store
Internal time	IT, marketing and data protection hours	Name owners before tender so scoring is fast

Return comes from four lines. Use your own figures in each formula.

• Avoided hardware: access points you do not replace, multiplied by your unit and installation cost.
• Consented contacts: new opt-ins per month, multiplied by revenue per marketable contact from your CRM.
• Labour planning: hours moved from quiet periods to visitor peaks, multiplied by your hourly labour cost.
• Staff WiFi support: password-related tickets eliminated, multiplied by your cost per ticket.

Ask every shortlisted vendor to price per venue, per plan, over the full term. Ask them to show hardware, filtering and implementation as separate lines so you compare like with like.

Frequently asked questions

Does Purple work with the access points we already own?

Yes, Purple runs as a cloud overlay on the access points in your stores today. It supports Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. A chain running two vendors after an acquisition can use one platform across both. You change where the splash page, authentication and reporting come from, not the hardware in the ceiling, so no rip and replace is required.

Can we switch guest WiFi provider without closing stores?

Yes, you can migrate store by store outside trading hours. On enterprise hardware, switching provider means repointing the guest network's splash page and authentication settings in your controller or cloud dashboard. Build a template first, then apply it site by site. Before you switch, export your consent records with timestamps and the wording shoppers agreed to. GDPR requires you to demonstrate consent for every marketing contact you keep.

Is collecting footfall data through guest WiFi GDPR compliant?

Yes, provided you have a lawful basis and are open with shoppers about it. Display signage at entrances, pseudonymise device identifiers and set a retention period. Complete a data protection impact assessment, which UK GDPR Article 35 requires for high-risk processing such as location monitoring. Marketing consent must be a separate, unticked choice. Purple is ISO 27001 certified and GDPR compliant, and uses conscious-choice opt-ins for every marketing contact.

Will guest WiFi bring our stores into PCI DSS scope?

No, not if you segment it correctly. PCI DSS treats network segmentation as the way to keep systems out of scope. Isolate guest traffic from the cardholder data environment with a separate VLAN and firewall rules, and turn on client isolation. Card terminals must never join the guest network. In your pilot, try to reach payment and back-office subnets from a guest device. The test passes only if every attempt fails.

Do retailers need content filtering on guest WiFi?

Yes, treat it as a requirement even where the law does not demand it. Your guest network is a public space used by families, and unfiltered access exposes your brand. In the UK, Friendly WiFi accreditation requires blocking pornography and child sexual abuse content on the Internet Watch Foundation list. Ask every vendor to name where filtering is enforced. Confirm the policy applies identically on every hardware vendor in your estate.

How does WiFi footfall reporting compare with door counters?

WiFi reporting complements door counters rather than replacing them. A beam or camera counter at the entrance gives the most direct count of entries. WiFi adds dwell time, return visits from logged-in shoppers, capture rate from passers-by and a like-for-like comparison across every store with WiFi. Run both during your pilot. Expect the daily trends to move together, even where the absolute counts differ.

How should we compare retail guest WiFi pricing?

Compare price per venue, per plan, over the full contract term. Purple offers three plans, Connect, Capture and Engage, so you can match features to each store format rather than buying the top tier everywhere. Ask every shortlisted vendor to show hardware, content filtering and implementation as separate lines. Then add broadband and internal time, so the total reflects what each store actually costs to run.