Multi-site guest WiFi platforms compared: hardware-neutral overlays vs controller portals

Built-in controller portals cover the basics for one site on one vendor that only needs click-through access. Once an estate spans several sites, mixed access point vendors or a CRM connection, it needs a hardware-agnostic cloud overlay. Purple standardises splash pages, consent and reporting across Cisco Meraki, HPE Aruba, Ruckus and five other vendors from one dashboard.

Should you use a controller portal or a hardware-neutral overlay?

Choose the overlay if you run more than one access point vendor, or if you want guest data in your CRM. A controller portal works when the estate is one vendor, a handful of sites and terms acceptance only. That holds until a second vendor arrives or marketing asks for the data.

The terms matter, so here they are.

A captive portal is the web page a device is redirected to before it gets internet access. It is where a visitor accepts terms, logs in and, if they choose, opts in to marketing.

A controller portal is the captive portal built into your WLAN vendor's management platform. Examples include the splash page in Cisco Meraki Dashboard, HPE Aruba's internal captive portal and the guest access portal in Ruckus SmartZone. It comes with the hardware licence you already pay for. It only works on that vendor's access points. For one vendor's view of this trade-off, see Ruckus SmartZone and RUCKUS One guest WiFi vs external captive portal platforms.

A hardware-neutral overlay is an external captive portal service that sits above the network. Your access points redirect unauthenticated devices to it, and it returns an authorisation decision. That decision usually travels over RADIUS (Remote Authentication Dial-In User Service). RADIUS is the protocol access points use to ask a server whether a device may connect, defined in RFC 2865. Every major vendor supports external captive portals, so one overlay can serve an estate built from several brands.

This is not a choice between hardware and software. Your access points, switches and controllers stay in place either way. The real question is where the guest experience, the consent record and the reporting live. They can sit inside each vendor's silo, or in one place above all of them.

Where do controller portals and cloud overlays differ?

The table below is a multi-site guest WiFi platform comparison on the axes that decide total effort across an estate.

Axis	Controller portal	Hardware-neutral cloud overlay (Purple)
Hardware coverage	One vendor's access points only	Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, Fortinet
Splash page management	One build per vendor, edited per network or controller	One template library applied to every venue
Login methods	Click-through, vouchers, basic sign-in	Email, social and form-based logins with conscious-choice opt-ins
Consent records	Terms acceptance; no marketing consent ledger	Per-visitor consent record held centrally, as GDPR Article 7(1) expects
CRM and marketing connectors	None native; vendor API work or CSV export	Native connectors to CRM and marketing platforms
Reporting	Network metrics (clients, bandwidth, AP status) per vendor dashboard	Visitor counts, dwell time and repeat visits across every venue
Adding a new venue	Build or clone the portal on that site's network	Assign the venue to an existing template
Changing AP vendor	Portal, consent wording and history rebuilt	Repoint the new hardware; templates and data carry over
Licence model	Bundled in the AP or controller licence	Separate platform licence, per AP or per venue
Who it suits	Single vendor, few sites, access only	Mixed estates, multi-brand groups, data-led marketing teams

How an overlay standardises splash pages

On an overlay, you design the splash page once and apply it to every venue. Per-venue variables fill in the local detail: venue name, opening hours or a local offer. A brand refresh is one edit that reaches every site at once.

Controller portals differ by vendor in what you can customise. Each splash editor has its own limits on HTML, images and form fields. In a mixed estate, you build and test the same design once per vendor, then repeat for every change.

How an overlay connects guest data to your CRM

An overlay writes each login to one database across the estate. A guest who visits three of your hotels is one profile with three visits, not three rows in three exports. Purple then syncs those profiles to your CRM and marketing platforms. Only the visitors who opted in are passed on.

With controller portals, you build an integration against each vendor's API and maintain it as those APIs change. Many teams fall back to manual CSV exports. Exports lose the consent context, which is the part your data protection officer cares about most.

How reporting changes

Controller dashboards report network health: client counts, bandwidth and AP status. That is the right view for your network team. It does not tell operations how often visitors return or how long they stay.

WiFi Analytics reports visitor behaviour by venue, region or brand. It shows new against returning visitors, dwell time and visit frequency. Because the overlay sits above all your hardware, a Ruckus site and a Juniper Mist site appear in the same report.

Security and compliance stay where they belong

An overlay does not move radio security off your hardware. WPA3 and Opportunistic Wireless Encryption (OWE, RFC 8110) are access point features. OWE encrypts open guest networks without a password. Guest traffic should still sit on its own VLAN (virtual LAN, a logical network segment). Where you take card payments, PCI DSS v4.0 requirement 1.3.3 calls for network security controls between all wireless networks and the cardholder data environment.

What the overlay changes is consent. GDPR Article 7(1) requires you to demonstrate that each person consented. Recital 32 states that pre-ticked boxes do not count. Article 7(4) weighs against making access conditional on marketing consent where it is not needed. Purple's conscious-choice opt-ins separate access from marketing, and the consent record sits in one place. Purple is ISO 27001 and Cyber Essentials certified, and GDPR and CCPA compliant.

For returning visitors, Purple supports OpenRoaming. OpenRoaming is a Wireless Broadband Alliance federation built on Passpoint, also called Hotspot 2.0. Passpoint is the standard that lets a device join a network automatically with a stored profile, no splash page needed.

When does a multi-site estate outgrow its controller portal?

Six triggers mark the point. If two apply, start the overlay evaluation now rather than at the next refresh.

1. A second access point vendor arrives. Acquisitions and staggered refreshes create mixed estates. Each new vendor means another portal build and another consent wording.
2. Marketing asks for the data. A controller portal holds no marketing consent records. There is nothing compliant to send to the CRM.
3. Site count makes manual edits risky. At 20 sites, a terms update means 20 manual edits. Each one is a chance to publish the wrong version.
4. Brands multiply. A group running three brands needs three looks, managed from one place.
5. Data requests cross sites. A request under GDPR Article 15 (access) or Article 17 (erasure) means searching every vendor's records.
6. The board wants estate-wide numbers. Cross-site visitor reporting needs one data set, not reconciled exports.

Where each option fits by vertical

Hotels. Guests move between properties and brands, so one profile per guest matters. Groups that refresh hotels on different cycles end up with mixed hardware. See Hotels.

Retail. Shoppers visit several stores, and store refits rarely happen in one year. An overlay keeps the splash page and data steady while the hardware changes underneath. See Retail.

Stadiums and events. Fans and attendees arrive in bursts, and branding changes per event. Swapping one template is faster than editing every controller between fixtures.

Transport. Passengers connect on trains and in stations, often on different hardware. Purple runs guest WiFi for c2c Rail and Avanti West Coast. See Trains.

Healthcare and public sector. Patients and visitors need clear acceptable-use terms, applied the same way at every site. See Healthcare.

Worked scenario: a 35-hotel group after an acquisition

Situation. A hotel group ran 22 hotels on Cisco Meraki, then acquired 13 hotels running Ruckus SmartZone. It now maintained two splash pages and two terms wordings. Each month, the team exported guest lists from both vendors, merged them by hand and uploaded them to the CRM.

What was done. The group kept every access point and controller. It pointed both vendors' guest SSIDs (network names) at Purple as the external captive portal. One template carried each hotel's name and local offer. One consent wording replaced two, and a CRM connector replaced the CSV merge.

Outcome. Splash page builds fell from two to one. A terms change became one edit instead of 35 network edits. The monthly two-export merge fell to zero, because profiles sync continuously. Subject access requests now run against one database, not two vendor systems.

Worked scenario: a council library and leisure estate

Situation. A council ran guest WiFi at 48 sites. Libraries used HPE Aruba and leisure centres used Ubiquiti UniFi. Each estate had its own acceptable-use page. Quarterly visit figures for cabinet meant reconciling two vendor dashboards by hand.

What was done. The council deployed Purple over both estates without replacing hardware. It published one acceptable-use page and grouped sites by service in reporting.

Outcome. Acceptable-use pages fell from two to one. The quarterly report now covers all 48 sites from one source, replacing two manual reconciliations.

How do per-AP and per-venue licensing compare over a three-year rollout?

Guest WiFi platforms price in one of two ways. Per-AP licensing charges for every access point. Per-venue licensing charges for every site, however many access points it holds. The right model depends on how your AP count will move over the rollout.

AP counts rarely stand still. 6 GHz signals attenuate faster through walls than 2.4 GHz or 5 GHz. As a result, WiFi 6E and WiFi 7 designs often add access points to keep coverage. Under per-AP licensing, that densification raises your guest platform bill. Under per-venue licensing, it does not.

Worked model: a 120-store retail chain

A retailer starts with 120 stores at an average of six APs each. In year 2, it densifies to eight APs per store. In year 3, it opens 15 new stores at the same density.

Year	Stores	Average APs per store	Per-AP licences	Per-venue licences
Year 1	120	6	720	120
Year 2	120	8	960	120
Year 3	135	8	1,080	135
Three-year total	120 to 135	6 to 8	2,760	375

Divide 2,760 by 375 to get 7.36. Over three years, per-venue licensing is cheaper whenever a venue licence costs less than 7.36 times an AP licence. In year 1 alone, the break-even ratio is six. By year 3 it is eight. Densification moves the break-even point in per-venue's favour every year.

Run the same sum on your own estate. Take total AP-years over the term and divide by total venue-years. Then compare that ratio with the quotes in front of you.

The costs a controller portal hides

A controller portal carries no separate licence fee, so it looks free in a business case. The cost lands on your team's time instead:

• Building and testing the splash page once per vendor, then again for every change.
• Writing and maintaining a CRM integration against each vendor's API.
• Exporting and reconciling guest lists and consent records by hand.
• Rebuilding the portal, consent wording and history when you change vendor.

The last item hits hardest in a three-year rollout. If you change AP vendor mid-term, every site you migrate restarts with an empty database. On an overlay, the splash page, consent records and visit history survive the hardware change. For more on upgrading without replacing what works, read Why your next WiFi upgrade doesn't need new hardware. For the controller question itself, see What is a WLC (Wireless LAN Controller) and Do You Still Need One?.

How do you decide on the best guest WiFi platform for your multi-site venues?

Map your estate to the row that fits it best.

Your situation	Recommendation	Why
One vendor, a few sites, terms acceptance only	Deploy the overlay on existing hardware before the first data request	Avoids rebuilding the portal and consent wording later
One vendor, 20+ sites, marketing wants guest data	Overlay with CRM connector	Controller portals hold no marketing consent records
Two or more AP vendors	Overlay with one shared template	Removes one portal build per vendor
AP vendor change planned within three years	Overlay before the migration starts	Splash pages and data survive the hardware change
Several brands on one estate	Overlay with per-brand templates	One platform, distinct brand experiences
AP-dense venues such as stadiums or airports	Overlay on per-venue licensing	Licence cost stays flat as AP counts rise

Questions to put to every vendor

Use these in any enterprise captive portal comparison:

• Which access point vendors do you support today, by name?
• Where is consent stored, and can you export each record with the wording the visitor saw?
• Which certifications do you hold: ISO 27001, Cyber Essentials, GDPR and CCPA compliance?
• What uptime do you commit to?
• Do you license per AP or per venue, and what happens to price when we densify?
• What does migration from our current controller portal involve, site by site?

Purple's answers are on the record. Founded in 2012, Purple runs on 80,000+ live venues in more than 90 countries. It sees 500 million users and logins a year, with 99.999% uptime. It is hardware-agnostic across Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Brands including McDonald's, Harrods, Premier Inn and Stonegate Pubs run Guest WiFi on Purple.

Frequently asked questions

Does Purple work with the access points we already own?

Yes, Purple runs as a cloud overlay on your existing access points. It integrates with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You point each guest network at Purple as its external captive portal, and your hardware keeps handling the radio side. Mixed estates are the common case, so two or three vendors under one template is a standard deployment. Purple's support documentation covers the configuration for each vendor.

Do we need to replace our controller to use a hardware-neutral overlay?

No, your controller and access points stay in place. A hardware-agnostic guest WiFi platform sits above the network and handles the splash page, consent and reporting. Your controller keeps managing radios, VLANs and encryption. The only change on the network side is redirecting unauthenticated guests to the overlay instead of the built-in portal. That makes the overlay a configuration change, with no rip and replace required.

Is per-venue licensing cheaper than per-AP licensing?

Per-venue licensing is cheaper when your average venue holds more APs than the ratio of venue price to AP price. Over three years, divide total AP-years by total venue-years to find your break-even ratio. In our 120-store model, that ratio is 7.36. Densification for WiFi 6E and WiFi 7 raises AP counts without adding venues. That shifts the sum further towards per-venue licensing every year.

Can we migrate from controller portals one site at a time?

Yes, you can migrate site by site, because each guest network points at its captive portal independently. Sites still on the controller portal keep working while migrated sites run on the overlay. Most teams start with a pilot group, confirm the template and consent wording, then roll out in waves. Phasing lets you align the migration with hardware refreshes or quieter trading periods.

What happens to our guest data if we change access point vendor?

On an overlay, your guest data stays put when you change access point vendor. Profiles, consent records and visit history live in Purple, not in the hardware. You repoint the new access points at the same templates, and returning guests are still recognised. With a controller portal, the splash page and any stored records sit inside the old vendor's platform. You rebuild them on the new hardware.

How does a cloud overlay handle GDPR consent across many sites?

A cloud overlay holds one consent record per visitor across every site, which is what GDPR Article 7(1) asks you to demonstrate. Purple uses conscious-choice opt-ins, so marketing consent is separate from network access and never pre-ticked, in line with Recital 32. Access and erasure requests under Articles 15 and 17 run against one database. Purple is ISO 27001 certified and GDPR and CCPA compliant.

Does guest WiFi on an overlay affect our PCI DSS scope?

Guest WiFi stays out of PCI DSS scope when it is segmented from your cardholder data environment, whichever portal you use. PCI DSS v4.0 requirement 1.3.3 calls for network security controls between all wireless networks and that environment. Segmentation happens on your network, through VLANs and firewalls. The overlay handles the splash page and consent and never touches card data.