Paid WiFi monetisation: vouchers, tiered access and payment gateways compared

A venue can charge for WiFi in five ways. It can sell vouchers at a till, run a free tier with paid upgrades, or take card payment through a hosted gateway. Hotels can post to the room folio, and sponsors can fund access. Choose by where money changes hands: that sets PCI DSS scope, refunds and staff effort.

Which paid WiFi model should your venue choose?

Start with the money flow you already run.

Guests already pay staff. At a reception desk, harbour office or park shop, sell vouchers through your existing point-of-sale (POS) system. This adds WiFi revenue without adding a payment system.

You run a hotel with an interfaced PMS. If your property management system (PMS) is interfaced, posting the charge to the room folio is the lowest-friction way to bill a guest.

Visitors never meet staff. Passengers in an airport arrive unannounced and leave without speaking to anyone. For them, card payment through a hosted payment gateway is the route that scales.

Tiered WiFi access sits across all three. It is a bandwidth policy, not a payment method. You offer a free tier for messaging and email, and a paid premium tier for video calls and streaming. You still choose how the premium tier is paid for.

Then ask the harder question. Would free WiFi, exchanged for a conscious-choice opt-in, earn more through repeat visits and direct bookings than the fee would? Hotels should test this first, because a WiFi fee competes with rivals who include it in the room rate. The worked scenario later in this guide shows how to find the break-even.

Marinas, holiday parks and long-dwell transport hubs face a different calculation. Their backhaul is often expensive and stays are long, so a paid premium tier can recover the cost of the bandwidth it consumes.

How do vouchers, tiers, gateways, PMS posting and sponsorship differ?

The options differ most on three axes: who touches card data, how refunds flow and what the network must support. Each charging route starts at the captive portal, the login page a visitor sees before they get online.

Model	How the visitor pays	PCI DSS scope for the WiFi system	Refund route	What the network needs	Best fit
Printed or printable vouchers	Cash or card at your existing POS, or bundled into a booking	None: card data stays in your existing POS	Refund at the till or reissue a code	Voucher field in the captive portal, RADIUS session timer	Holiday parks, marinas, campsites, conferences
Tiered access (free plus premium)	Free tier at login; premium bought by voucher, card or folio	Same as the payment route used for the premium tier	Same as the payment route used for the premium tier	Per-tier bandwidth policy returned by RADIUS	Hotels, holiday parks, marinas, long-dwell hubs
Card payment via hosted gateway	Card entered on the gateway's hosted page, reached from the captive portal	Reduced, typically SAQ A, if the gateway hosts every card field	Gateway dashboard; disputes arrive as chargebacks	Walled garden entries for gateway and 3-D Secure domains	Airports, unattended sites, transient visitors
PMS posting	Charge posted to the room folio after a room number and surname check	None: the hotel settles the folio through its existing payment process	Folio adjustment at the front desk	Interface between the WiFi platform and the PMS	Hotels with an interfaced PMS
Sponsored access	Sponsor pays; visitor views branded content or answers a survey	None: no card payment taken	None needed: visitor pays nothing	Walled garden entries for sponsor media	Airports, stadiums, transport hubs, city centres
Free with first-party data	Visitor opts in to marketing at login	None: no card payment taken	None needed: visitor pays nothing	Captive portal with CRM integration	Hotels, retail, hospitality groups

RADIUS (Remote Authentication Dial-In User Service) is the protocol access points use to ask an authentication server whether to admit a device. Every model in the table relies on it to start, limit and end sessions.

How do WiFi vouchers work, and when are they the right call?

A WiFi voucher is a pre-generated access code with its rules attached. Each code carries a duration, such as 24 hours or seven days, a device allowance and a bandwidth tier. The guest types the code into the captive portal. The platform validates it and tells the access point, over RADIUS, to admit the device for the purchased time.

Printed vouchers are batches you produce in advance, then sell or hand out. Printable vouchers are generated on demand at the front desk. Printing on demand avoids running out mid-season and leaves no unsold stock.

Vouchers suit sites where visitors already pay staff. Typical examples:

• Holiday parks taking payment at check-in.
• Marinas charging at the harbour office.
• Conference centres bundling access into delegate packs.

Payment runs through your existing POS, so the WiFi platform never touches card data.

Three controls stop vouchers leaking revenue:

• Cap devices per code. Allow two devices on a solo pass and more on a family pass, so one code cannot serve a whole pontoon.
• Start the clock at first login, not at print. Otherwise unsold stock expires on the shelf.
• Let reception look up and reissue codes. Lost codes are the most common voucher support call, and a reissue costs nothing.

Worked scenario: a coastal marina (illustrative model)

Situation. A marina has 250 visitor berths and a season of 153 days, May to September. It offers free, uncapped WiFi over a constrained backhaul link. A handful of boats streaming video degrade the service for everyone else.

What was done. The marina introduces a free tier capped at 2 Mbps for messaging and email. It also sells a £15 stay voucher for a premium tier, through the harbour office's existing till.

Outcome (modelled). Assume 60% average occupancy, or 150 boats a night, and an average stay of three nights. That gives 7,650 visits a season. If 25% of visits buy a voucher, the marina sells about 1,910 vouchers, roughly £28,700 a season. The cap protects the backhaul, and PCI DSS scope stays with the POS the marina already secures. These figures are assumptions for modelling, not customer data. Substitute your own occupancy and uptake.

What is tiered WiFi access, and when does it make sense?

Tiered WiFi access gives every visitor a free baseline and sells a faster premium tier. The free tier covers messaging, email and browsing. The premium tier covers HD streaming and video calls.

Netflix's help centre recommends 5 Mbps for HD streaming and 15 Mbps for 4K. That gives you a defensible line between the two tiers.

Tiers make sense in two situations:

• Bandwidth costs you money. Examples include satellite or cellular backhaul at holiday parks and marinas, and shared links on Trains.
• A few heavy consumers degrade the experience for everyone else. A per-tier cap restores a fair share for the rest.

Three design rules decide whether tiers earn or annoy:

• Keep the free tier usable. If it cannot load a booking confirmation, you generate complaints, not upgrades.
• Price per stay, not per device, where you can. Families resent paying once per phone.
• Offer the upgrade at the moment of need. Show it on the captive portal and again when a free session ends.

When should you take card payment in the captive portal?

Take card payment in the portal when visitors never meet your staff. The flow runs in five steps:

1. The visitor joins an open network and the captive portal appears.
2. They choose a pass.
3. They are redirected to the gateway's hosted payment page.
4. The gateway confirms payment to the WiFi platform.
5. The platform authorises the session.

Before login, a device can reach only the walled garden. This is an allow list of domains that unauthenticated devices can open, and every gateway domain must be on it.

Two failure points cause most lost payments:

• 3-D Secure challenges. Under UK and EU Strong Customer Authentication rules, many card payments trigger a bank challenge. If the bank's domain is blocked by the walled garden, the challenge fails and so does the sale.
• The captive network assistant. iOS and Android open portals in a limited mini browser. Test the full payment flow inside it on both platforms, including digital wallets, before launch.

Worked scenario: a regional airport (illustrative model)

Situation. An airport handles 3 million passengers a year and offers a free 30-minute session. About 20% of passengers connect, giving 600,000 sessions a year.

What was done. The airport adds a £4.99 extended pass, paid on a gateway-hosted page reached from the captive portal.

Outcome (modelled). If 2% of connected passengers buy, the airport sells 12,000 passes, or £59,880 a year before gateway fees. That figure becomes the benchmark for the alternative. A sponsorship deal worth £60,000 a year would match it, with no refunds and no payment friction. Again, these are modelling assumptions, not customer data.

Does card payment in a captive portal bring PCI DSS scope?

Yes. Any card payment brings PCI DSS scope; the question is how much. PCI DSS applies to every entity that stores, processes or transmits cardholder data, and to systems that can affect its security. PCI DSS v4.0.1 is the current version.

A hosted payment page keeps scope smallest

The card number may be entered only on a page served by a PCI DSS compliant payment service provider, by full redirect or iframe. In that case you may be eligible for SAQ A, the shortest Self-Assessment Questionnaire. Your captive portal never sees card data.

The PCI Security Standards Council revised the SAQ A eligibility criteria in 2025. Confirm the current criteria with your acquirer before you assume you qualify.

Your own payment form widens scope sharply

Your captive portal might render the card fields itself, or load scripts that post card data to the gateway. Either way, you typically move to SAQ A-EP. That questionnaire carries far more requirements, including 6.4.3 and 11.6.1 on payment page scripts and tamper detection.

Vouchers, PMS posting and sponsorship stay out of WiFi scope

These three routes keep card data away from the WiFi platform:

• Vouchers sold through your POS sit inside a system you already secure.
• PMS posting sends a charge amount, not card data. The folio card is already in the hotel's scope.
• Sponsorship takes no card at all.

Before you sign with any paid WiFi monetisation platform, ask three questions:

• Who hosts the card fields?
• Can the gateway provide a current Attestation of Compliance?
• Which SAQ will your acquirer expect?

When is PMS posting the right call for hotels?

PMS posting is the right call when your hotel runs an interfaced PMS and most WiFi buyers are staying guests. The flow has three steps:

1. The guest enters a room number and surname.
2. The platform checks them against the PMS record and posts the charge to the folio.
3. The guest settles at check-out alongside everything else.

There is no card entry and no separate receipt. The front desk handles a disputed WiFi charge exactly like a disputed minibar charge.

Plan for three gaps:

• Day visitors have no room. Restaurant diners or meeting delegates need a second route, such as vouchers or card payment.
• Groups often run more than one PMS. Each system needs its own interface.
• Sessions should end at departure. Otherwise checked-out guests keep premium access. Your vendor's interface documentation covers how departure events reach the WiFi platform.

For the wider hotel picture, see our Hotels page.

When does sponsored access beat charging?

Sponsored access beats charging when footfall is high and the audience is valuable to brands. Think airports, stadiums and city centres.

A sponsor pays, and the visitor sees a branded splash page, watches a short video or answers a survey. The visitor pays nothing, so you take on no PCI DSS scope and handle no refunds.

The work moves elsewhere:

• Selling. Someone has to sell the inventory and renew sponsors.
• Reporting. Sponsors expect impressions and completed views, which WiFi Analytics can report.
• Data protection. Sharing personal data with a sponsor needs a lawful basis under UK GDPR, plus clear transparency at the point of collection. Email marketing on the sponsor's behalf needs consent under the Privacy and Electronic Communications Regulations (PECR).

Conscious-choice opt-ins, where each consent is a separate, unticked choice, keep that defensible.

How do you enforce bandwidth per tier on the access points?

The platform decides the policy and the access points enforce it. When a login succeeds, the RADIUS Access-Accept message carries attributes that tell the access point what this device is allowed.

Time limits. The Session-Timeout attribute, defined in RFC 2865, ends a time-limited pass.

Bandwidth. Bandwidth is normally applied through a vendor policy:

• Cisco Meraki maps a RADIUS attribute such as Filter-Id to a group policy that sets per-client limits.
• HPE Aruba assigns a user role through the Aruba-User-Role attribute.
• Other vendors use equivalent role or policy mappings.

Data caps. Data-volume caps need RADIUS accounting, defined in RFC 2866, so the platform can count usage.

Mid-session upgrades. If your hardware supports RADIUS Change of Authorization (RFC 5176), a guest can upgrade without reconnecting. Without it, the device must rejoin to pick up the new tier.

Apply limits per client, not per network. A per-network cap still lets one premium guest consume the whole tier.

Purple's Guest WiFi is hardware-agnostic and runs as a cloud overlay on all eight major vendors:

• Cisco Meraki
• HPE Aruba
• Ruckus
• Juniper Mist
• Ubiquiti UniFi
• Cambium
• Extreme
• Fortinet

Configuration steps differ by vendor, so follow the integration article for your hardware rather than copying values between platforms. The reasoning is set out in Why your next WiFi upgrade doesn't need new hardware.

How do refunds work for paid guest WiFi?

Refund through the same route the guest paid:

• Vouchers: refund at the till.
• Card: refund from the gateway dashboard.
• PMS: adjust the folio at the front desk.

UK law sets the floor. Under the Consumer Rights Act 2015, a paid service must be performed with reasonable care and skill. Where it is not, the guest can ask for repeat performance or a price reduction.

The Consumer Contracts Regulations 2013 give online purchases a 14-day cancellation right. You can start the service immediately at the guest's express request. If the guest then cancels, they pay a proportionate amount. Build that request and acknowledgement into the purchase screen.

Three habits cut refund cost:

• Publish the refund policy on the captive portal.
• Let support staff extend a pass instead of refunding it.
• Refund quickly when coverage genuinely failed. A disputed card payment becomes a chargeback, which brings gateway fees and admin time.

What does each paid WiFi model cost to run?

The fee you collect is only half the sum; the running costs below decide what you keep.

Model	Direct cost	Staff time	Hidden cost to plan for
Vouchers	Printing, or a front-desk printer for on-demand codes	Selling codes, reissuing lost ones	Unsold printed stock; code sharing
Card via hosted gateway	Per-transaction fee set by your gateway	Monthly reconciliation	Chargeback fees; failed 3-D Secure payments
PMS posting	PMS interface licence, where your vendor charges one	Front desk folio queries	Interface re-testing after PMS upgrades
Sponsored access	Sponsor content production	Selling and reporting to sponsors	Empty inventory between sponsors
Free with first-party data	CRM and email platform	Campaign management	Consent management and data retention

Across every model, a premium tier earns only if your backhaul can deliver what you sell. Pricing a 15 Mbps tier on a link that cannot sustain it buys refunds, not revenue.

Is paid WiFi worth it compared with free WiFi?

Paid WiFi is worth it where bandwidth is scarce and visitors stay long. Free WiFi with data capture often wins where repeat business is the prize.

Worked scenario: a 200-room city hotel (illustrative model)

Situation. A 200-room hotel runs at 80% occupancy and charges £10 a day for WiFi. If 10% of its 160 occupied rooms buy, it earns £160 a day, or £58,400 a year.

What was done. The hotel makes standard WiFi free in exchange for an opt-in at login. It sells a £6 premium streaming tier posted to the folio. At 5% uptake, premium earns £17,520 a year.

Outcome (modelled). The gap is £40,880 a year, and that becomes the break-even target. At an assumed £300 per two-night direct stay, the hotel needs about 136 extra direct stays a year, roughly 11 a month, won through its captured list. The general manager can measure that number through CRM attribution and WiFi Analytics. All figures are modelling assumptions.

In Retail, the case for charging is weaker still. Shoppers can fall back on mobile data, and the value of WiFi lies in what you learn about visits.

How to decide for your estate

Use this matrix to match your situation to a model, then validate it with your own occupancy and uptake figures.

If your estate looks like this	Choose	Why
Hotel with an interfaced PMS	Free tier with data capture, premium tier posted to the folio	No card handling; captured data supports direct bookings
Holiday park with a reception and constrained backhaul	Free capped tier plus vouchers sold at reception	Uses your existing till; the cap protects backhaul
Marina with a harbour office and seasonal visitors	Stay vouchers sold through harbour office POS	WiFi platform stays out of PCI DSS scope
Airport or transport hub with no staff contact	Free time-limited session, then hosted gateway or sponsor	The only routes that scale without staff
Stadium or events venue with sponsor inventory	Sponsored access	Sponsor revenue, no refunds, no card scope
Conference centre	Access codes bundled into delegate packages	Revenue sits inside the ticket price

If you bill members monthly rather than per visit, the tenant model in Managed WiFi for serviced offices and coworking: tenant isolation and billing fits better than any pass.

Purple has run Guest WiFi since 2012. Today it serves 80,000+ live venues, with 440 million logins in 2024 (Purple's own data). The platform is ISO 27001 certified, GDPR compliant and runs at 99.999% uptime. Guest WiFi captures first-party data through conscious-choice opt-ins and integrates with CRM and marketing platforms.

Frequently asked questions

Does taking card payment in a captive portal bring PCI DSS scope?

Yes, any card payment brings PCI DSS scope, but a hosted payment page keeps it small. If a PCI DSS compliant gateway serves every card field, by redirect or iframe, you may qualify for SAQ A. If your captive portal renders the card fields or loads scripts that post card data, you typically move to SAQ A-EP. That brings far more requirements. Confirm the expected questionnaire with your acquirer before launch.

Can I charge for WiFi on my existing access points?

Yes, paid tiers run on the access points you already own, provided they support external captive portals and RADIUS. Bandwidth per tier is applied through vendor policies, such as Cisco Meraki group policies or HPE Aruba user roles. Purple's Guest WiFi runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Check your vendor's integration documentation for per-tier attribute support.

Is paid WiFi worth it compared with free WiFi?

Paid WiFi earns most where backhaul is expensive and stays are long, such as marinas and holiday parks. Hotels should model the break-even first. Calculate the fee income you would give up, then the extra direct stays your captured list must win to replace it. If your CRM can attribute bookings to WiFi opt-ins, you can measure the result monthly.

How do WiFi vouchers work?

A WiFi voucher is an access code carrying a duration, a device allowance and a bandwidth tier. The guest enters it in the captive portal. The platform then tells the access point, over RADIUS, to admit the device for the purchased time. Vouchers sold through your existing till keep card data out of the WiFi platform entirely. Start the clock at first login, so unsold codes do not expire.

What is tiered WiFi access?

Tiered WiFi access gives every visitor a free baseline and sells a faster premium tier. A typical split keeps messaging, email and browsing free, then charges for HD streaming and video calls. Netflix recommends 5 Mbps for HD and 15 Mbps for 4K, which helps you set the line. Tiers are a bandwidth policy, so you still choose vouchers, card payment or folio posting.

Can hotels charge WiFi to the room bill?

Yes, hotels with an interfaced property management system can post WiFi charges directly to the room folio. The guest enters a room number and surname, the platform checks the PMS record and the charge appears on the bill. No card is entered in the portal, and the front desk handles disputes like any other folio item. Day visitors without a room need vouchers or card payment instead.

How should refunds work when paid WiFi fails?

Refund through the same route the guest used to pay: the till, the gateway dashboard or a folio adjustment. In the UK, the Consumer Rights Act 2015 requires paid services to be performed with reasonable care and skill. Where they are not, the remedy is repeat performance or a price reduction. Extending a pass often resolves complaints faster, and quick refunds avoid chargeback fees.