Airport WiFi platform providers: what to require in the RFP

An airport WiFi RFP should demand evidence in seven areas. Vendors must prove concurrency at your busiest departure wave and support Passpoint and OpenRoaming. They need a multilingual captive portal meeting WCAG 2.2 AA, plus UK GDPR and EU GDPR data handling. Add zone-level dwell-time analytics, documented APIs for your airport app and an uptime SLA with service credits.

Which airport WiFi platform provider model should you choose?

Airport WiFi platform providers fall into three commercial models. Each model decides who owns the access points, who controls passenger data and how easily you can change direction later. Settle the model before you write scoring criteria, because it changes what you can reasonably ask each vendor to prove.

	Hardware-agnostic cloud overlay	Bundled managed service	Concession operator (revenue share)
Hardware needed	Your existing access points	New access points supplied by the provider	Provider-owned access points and backhaul
Contract tied to	Software licence term you set	Provider's hardware refresh cycle	Concession agreement with the airport
Route to first live terminal	Configuration on installed access points	Survey, cabling and installation	Survey, build and commercial negotiation
Who controls passenger data	You, as controller, with the provider as processor	You, if the contract names you as controller	The operator, unless the concession reserves it to you
Passpoint and OpenRoaming	Platform feature, confirmed against your AP firmware	Bundled with the provider's hardware	Set by the operator's roaming agreements
Exit cost	Low: access points stay in place	High: hardware removal or buyback	High: rebuild or transfer of network assets
Suits	Airports with a current WiFi 6 or 6E estate	Airports with end-of-life access points and a small network team	Airports wanting zero capex and accepting less data control

Purple runs as a hardware-agnostic cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. If your access points are less than a refresh cycle old, read Why your next WiFi upgrade doesn't need new hardware before you scope a rip and replace.

Where airport WiFi platform providers genuinely differ

Most vendors tick every line on a feature checklist. Six areas separate them once you ask for evidence rather than a yes or no.

Throughput and concurrency at peak departures

Average load tells you nothing useful. The test is the departure wave, when security releases hundreds of passengers airside within minutes. Many of them reach for a phone at once.

Two numbers matter. The first is concurrent sessions per zone. The second is new authentications per second through the captive portal, the web page a passenger sees before getting online. Raw throughput depends mostly on your access points and backhaul. The platform's job is to authenticate the burst without a queue.

Ask each vendor for:

• The highest concurrent session count the platform has handled at a single venue, with the venue type and date.
• Authentications per second sustained in load testing, with the test method written down.
• What happens to login when your CRM or app integration responds slowly, and whether the portal fails open or closed.
• Per-device bandwidth caps and fair-use controls by SSID (the network name a passenger sees) and VLAN, a virtual LAN that separates traffic on shared infrastructure.
• Support for 6 GHz clients. In the UK, Ofcom opened 5925-6425 MHz for licence-exempt WiFi in July 2020.

The evidence to request is a load-test report, a reference venue with a comparable peak and an architecture diagram showing where authentication runs. As a reference point, Purple processed 440 million logins in 2024 across 80,000+ live venues in over 90 countries.

Passpoint and OpenRoaming for returning passengers

Passpoint, also called Hotspot 2.0, builds on IEEE 802.11u. It lets a device discover a network and join it automatically using a stored credential, with no captive portal. The connection uses 802.1X, the IEEE standard for authenticating a device before it joins, so traffic is encrypted with WPA2-Enterprise or WPA3-Enterprise. A RADIUS server, the system that checks each credential, sits behind it.

OpenRoaming is a federation run by the Wireless Broadband Alliance. It uses Passpoint and a shared certificate framework, so a credential from one identity provider works on any participating network. For an airport, that means frequent flyers and business travellers connect on arrival without re-registering.

Which airports use Passpoint or OpenRoaming? No public register lists every Passpoint airport deployment, and the picture changes quickly. Ask vendors to name live references instead of trusting a feature list.

Put these questions in the RFP:

• Is the vendor an OpenRoaming identity provider, an access network provider, or both?
• Can the captive portal issue a Passpoint profile after first login, on both iOS and Android?
• Which named airport or transport venues run Passpoint live today, with a reference contact?
• How do Passpoint passengers appear in analytics when they never see the portal?
• Which access point models and firmware versions in your estate support Passpoint? Confirm this with your hardware vendor.

Purple supports OpenRoaming and cloud RADIUS. Our transport deployments include AGS Airports, Manchester Airports Group, c2c Rail and Avanti West Coast. See how the same approach works on Trains.

Multilingual and accessible captive portals

An airport portal serves passengers from dozens of countries, often on their first minutes in the UK. It should detect the browser language and offer a visible language switcher. Every element needs translating, including the terms of use and privacy notice, not just the login button. Right-to-left scripts such as Arabic and Hebrew must render correctly.

Accessibility is a legal question as well as a service one. Require conformance with WCAG 2.2 at level AA, which the W3C published in October 2023. Where you operate in the EU, the European Accessibility Act has applied since 28 June 2025, and air passenger transport services fall within its scope. A publicly owned UK airport may also fall under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018.

Ask for an independent accessibility audit of the live portal, not a design mock-up. Test it yourself inside the captive network assistant, the small pop-up browser iOS and Android open on connection. Many portals that pass in a desktop browser break in that window.

Data protection for international travellers

A UK airport processes guest WiFi data under UK GDPR and the Data Protection Act 2018. EU GDPR applies where you operate airports in the EU, or where processing otherwise falls within its Article 3 scope. Groups with airports in both jurisdictions need a platform that handles both regimes without separate builds.

Require each vendor to answer these points in writing:

• Roles. Confirm you are the controller and the vendor is your processor, under an Article 28 processing agreement.
• Location and transfers. Name where passenger data is stored and processed. Any transfer outside the UK or EEA needs the UK International Data Transfer Agreement or EU standard contractual clauses.
• Lawful basis. Separate network access, analytics and marketing. In the UK, email marketing also falls under the Privacy and Electronic Communications Regulations 2003.
• Consent design. Marketing opt-ins should be unticked and specific. Purple calls these conscious-choice opt-ins.
• Age. The UK sets 13 as the age of digital consent. EU GDPR defaults to 16, and member states may lower it to 13.
• Retention and requests. State retention periods per data type, and how the vendor supports subject access requests in multiple languages.
• Assurance. Request the ISO 27001 certificate and its scope, plus the sub-processor list.

Purple is ISO 27001, GDPR, CCPA, Cyber Essentials and B Corp certified. Ask the vendor to contribute to your data protection impact assessment, which Article 35 requires for high-risk processing.

Dwell time analytics by zone

Airports measure WiFi dwell time by grouping access points into zones: landside, security, airside central, retail, gate piers and lounges. Dwell is the time between a device's first and last association within a zone. Aggregated across thousands of passengers, it shows where time is spent between security and boarding.

MAC address randomisation complicates this. Apple introduced private WiFi addresses in iOS 14, and Android 10 randomises by default per network. Counts of unauthenticated devices therefore overstate unique visitors. Authenticated sessions give a stable identity, so they produce the most reliable dwell figures.

Ask vendors whether you can define and edit zones yourself, and whether a minimum dwell threshold filters out passers-by. Confirm reports show medians as well as averages, and that data exports to your business intelligence tools by API. WiFi Analytics shows how Purple reports dwell by zone. Commercial teams use these figures for concession planning, gate staffing and cleaning schedules.

Integration with your airport app

Your app and your WiFi should recognise the same passenger. Ask whether app members can sign in to WiFi with their existing app account, using single sign-on through SAML or OAuth. SAML is the Security Assertion Markup Language, a standard for passing a sign-in between systems.

Require documented REST APIs, webhooks on login events and named CRM connectors. Ask whether portal content can change by terminal or zone, so a gate pier can promote different offers from landside. Purple integrates with CRM and marketing platforms through the Guest WiFi product.

What service levels should an airport WiFi provider offer?

An outage during a departure wave means queues at information desks and missed retail revenue. Write service levels into the contract with measured evidence behind them.

Service level	What to require	Downtime this allows	Evidence to request
Portal and authentication availability	99.95% monthly minimum	About 22 minutes a month	12 months of measured availability
Platform availability, higher tier	99.999% annual	About five minutes a year	Public status page history
Priority 1 response	15 minutes, 24 hours a day	Not applicable	Support process document
Priority 1 restoration target	4 hours	Not applicable	Incident reports from the last 12 months
Planned maintenance	Outside 05:00-22:00 local time, 7 days' notice	Excluded from availability only with notice	Maintenance calendar for the past year
Breach notification to you	Within 24 hours of discovery	Not applicable	Incident response plan
Service credits	Percentage of monthly fee per breach	Not applicable	Draft contract clause

For comparison, 99.9% allows about 43 minutes of downtime a month, or nearly nine hours a year. Purple's platform runs at 99.999% uptime. The breach notification line protects your own 72-hour deadline to notify the regulator under Article 33.

When a hardware-agnostic cloud overlay is the right call

Choose an overlay when your access points are current and your network team wants to keep control of radio design. You change the captive portal and RADIUS configuration, not the hardware. That keeps exit costs low and lets you replace the platform without touching a ceiling tile.

An overlay also suits airport groups with mixed estates. One terminal might run HPE Aruba and another Cisco Meraki after an acquisition. A hardware-agnostic platform gives you one portal, one data set and one consent record across both.

When a bundled managed service or concession is the right call

Choose a bundled managed service when your access points are end of life and you lack the team to run a refresh. You buy coverage, hardware and support as one contract. Accept a longer term and higher exit cost in return.

A concession operator suits airports that want zero capital spend and treat WiFi as a utility. The trade-off is data. If the operator acts as controller, your commercial team may never see passenger dwell or opt-in data. If you take this route, reserve controller rights and a full data feed in the concession agreement.

What each model costs to run

Compare total cost over the same term, not the headline licence. Ask every vendor to price an identical three-year scope covering:

• Platform licences per venue or per terminal.
• Hardware capital spend, if any, and the refresh date it implies.
• Installation, cabling and survey work.
• Internet transit and backhaul.
• Support at your required service levels.
• Professional services for portal design, translation and integrations.
• Exit costs, including data export and hardware removal.

Then set revenue against cost. Premium speed tiers and time-limited passes generate direct income, as the guide to Paid WiFi monetisation: vouchers, tiered access and payment gateways compared explains. Portal media and first-party data can support car parking, fast-track and lounge sales. Purple licenses Guest WiFi in three plans, Connect, Capture and Engage, so you can add capability as the business case matures.

Worked scenarios: two airports, two RFP clauses

These scenarios are planning examples. The inputs are assumptions a buyer would replace with their own figures; the outputs are the RFP numbers those inputs produce.

Scenario 1: a council-owned regional airport sizes its concurrency clause

Situation. A regional airport owned by two local councils runs one terminal. Its peak morning wave puts 3,000 passengers airside within 90 minutes, alongside 400 staff and concession workers on a separate network. The previous RFP asked only for "high capacity", and the incumbent's portal stalled every summer Saturday.

What was done. The IT director modelled the wave with conservative inputs: 1.5 devices per passenger and 50% take-up. That gives 3,000 × 1.5 × 0.5 = 2,250 concurrent guest sessions. Adding 30% headroom raised the requirement to 2,925, rounded up to 3,000 sessions. The team assumed 40% of sessions start in the 15 minutes after a security surge. That is 900 new logins in 900 seconds, or one authentication per second sustained.

Because the airport is a public sector body, the team also required WCAG 2.2 AA and an independent audit.

Outcome. The RFP now states two testable numbers: 3,000 concurrent guest sessions and one authentication per second sustained for 15 minutes, with a burst test at triple that rate. Vendors without a load-test report covering those figures were removed at the first stage. The accessibility clause now names a standard and an audit, not an intention.

Scenario 2: an airside retail team defines dwell time before it buys

Situation. The commercial director at a mid-sized airport wanted to know whether passengers lingered in a walk-through duty-free zone or passed straight through. Concession rents were due for review. The previous WiFi reports counted devices, including unauthenticated ones, so randomised MAC addresses inflated every zone.

What was done. The team grouped access points into five zones: landside, security exit, walk-through retail, central food court and gate piers. They set a two-minute minimum dwell threshold to exclude passers-by. The RFP required dwell reports based on authenticated sessions only, with medians by zone and hour, exported daily by API.

Outcome. With an assumed 20,000 airside passengers a day and 35% logging in, the sample is 7,000 sessions a day. That is over 200,000 sessions a month, enough to compare zones week on week with confidence. The commercial team went into the rent review with a defined metric rather than a device count. See how Purple supports Retail venues with the same zone approach.

If your estate includes an airport hotel, the same platform and consent record can extend there. Purple's approach for Hotels applies directly.

How to score airport WiFi platform providers for your terminal estate

Weight each area by its effect on passengers and revenue, then score only against evidence. A vendor that answers "yes" without a document scores zero for that line.

Area	Weight	Question to ask	Evidence to request
Concurrency at peak	20%	What is your highest sustained authentication rate at one venue?	Load-test report and a reference venue
Data protection	20%	Where is passenger data stored, and under which transfer mechanism?	Article 28 agreement, sub-processor list, ISO 27001 certificate
Passpoint and OpenRoaming	15%	Which named transport venues run Passpoint live today?	Reference contact and a live returning-device demonstration
Dwell time analytics	15%	Can we define zones and export authenticated dwell data by API?	Sample report and API documentation
Multilingual and accessible portal	10%	Which languages ship, and who translates the legal text?	Independent WCAG 2.2 AA audit
App and CRM integration	10%	Can app members sign in to WiFi with their app account?	SSO documentation and named connectors
Service levels	10%	What availability did you measure over the last 12 months?	Status page history and incident reports

Shortlist two or three vendors on paper. Then run a proof of concept in one zone through at least one real peak departure wave. Make the reference calls yourself, and ask each reference what broke in the first month.

Frequently asked questions

How much does an airport guest WiFi platform cost?

A hardware-agnostic platform costs a software licence per venue, with no access point capex if your estate is current. Bundled managed services add hardware, installation and a longer term. Concession models can cost nothing upfront but trade away revenue and often data control. Ask every vendor to price the same three-year scope, including support and exit costs, so you compare like for like.

Can an airport WiFi platform run on our existing access points?

Yes, if the platform is hardware-agnostic. Purple runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Your access points, switching and backhaul stay in place. Check two things in the RFP: that your access point models and firmware support Passpoint, and that the captive portal handles your peak authentication rate.

How do we switch airport WiFi provider without disrupting passengers?

Run the new platform on one SSID or one zone first, then cut over terminal by terminal. With an overlay, you change captive portal and RADIUS settings rather than hardware, so rollback means restoring the old configuration. Schedule cutover outside your peak departure waves. Ask the incumbent for a data export and written confirmation of deletion under the existing processing agreement.

Does EU GDPR apply to a UK airport's guest WiFi?

UK GDPR and the Data Protection Act 2018 govern a UK airport's guest WiFi. EU GDPR applies where you operate airports in the EU, or where processing otherwise falls within its Article 3 scope. Many airport groups face both regimes. Require the vendor to support both, document data location, and use the UK IDTA or EU standard contractual clauses for transfers.

Which airports use Passpoint or OpenRoaming?

No public register lists every airport running Passpoint or OpenRoaming, and deployments change quickly. The Wireless Broadband Alliance publishes OpenRoaming announcements, and credible vendors name their live airport and transport references. In your RFP, ask each vendor for a named venue, a reference contact and a live demonstration of a returning device joining without a captive portal.

How do airports measure WiFi dwell time by zone?

Airports group access points into zones, such as landside, security, airside retail and gate piers. They then measure the time between a device's first and last association in each zone. Authenticated sessions give the most reliable figures, because MAC address randomisation on iOS and Android distorts unauthenticated counts. Report medians alongside averages, so a few long-stay devices do not skew results.

What uptime should an airport WiFi provider guarantee?

Require at least 99.95% monthly availability for the captive portal and authentication service, with service credits below that level. That still allows about 22 minutes of downtime a month. Purple's platform runs at 99.999% uptime, about five minutes a year. Ask for 12 months of measured availability, not just the contractual figure, and confirm how planned maintenance is treated.