How to leverage SMS message marketing to increase return visits
This technical reference guide explains how venue operators and IT teams can use their existing Guest WiFi infrastructure to capture verified phone numbers and deploy automated SMS message marketing campaigns that drive measurable return visits. It covers deployment architecture on hardware from Cisco Meraki to Fortinet, GDPR-compliant consent capture, audience segmentation using presence analytics, and closed-loop attribution to prove ROI. Purple Engage automates the full campaign lifecycle, from first-party data capture at the captive portal to triggered outreach and return-visit tracking.
Listen to this guide
View podcast transcript
Executive summary
SMS message marketing delivers a 98% open rate and conversion rates between 21% and 40% [Infobip, 2026; Sakari, 2025]. For venue operators running hotels, retail estates, stadiums, or conference centres, those numbers translate directly into measurable return visits. The prerequisite is a reliable source of verified, consented phone numbers. Your Guest WiFi network is that source.
Purple Engage captures guest phone numbers and explicit marketing consent at the point of WiFi login, across 80,000+ live venues. The platform then automates segmented SMS campaigns based on real presence data - visit frequency, dwell time, and recency - so every message reaches the right person at the right moment. This guide covers the deployment architecture, the compliance requirements, and the campaign strategies that turn network access into repeat footfall.
Technical deep-dive
The data capture architecture
The foundation of any effective SMS message marketing programme is a clean, verified database of consented phone numbers. Email lists degrade over time and suffer from address changes. Phone numbers are far more stable, and the consent captured at a physical venue is demonstrably first-party.
When a guest connects to the venue SSID, the access point - whether Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, or Fortinet - redirects the unauthenticated session to the Purple captive portal (also called a splash page) via a standard DNS redirect. The Purple cloud overlay handles this redirect without requiring changes to the underlying network hardware. This is the hardware-agnostic architecture that allows Purple to deploy across mixed-vendor estates.
At the portal, the guest is presented with a login form. The form requests their mobile number. The system validates the format in real time. Crucially, the form also presents a separate, unchecked checkbox for marketing consent. The guest must actively tick this box. This is the conscious-choice opt-in that satisfies GDPR Article 6(1)(a).
Once the guest submits the form, the Purple platform:
- Validates and stores the mobile number.
- Records the consent timestamp, IP address, and the exact wording of the consent statement.
- Associates the phone number with the device's MAC address.
- Grants network access via the RADIUS authentication flow.
The MAC address association is the technical mechanism that enables closed-loop attribution. When the guest returns to the venue and their device reconnects to the network, the platform recognises the MAC address and logs the return visit. If that guest received an SMS in the intervening period, the return can be attributed to the campaign.
GDPR and TCPA compliance architecture
SMS message marketing is subject to strict regulatory requirements in the UK and EU under GDPR, and in the United States under the Telephone Consumer Protection Act (TCPA). Failure to comply carries significant financial penalties. The architecture must enforce compliance automatically, not rely on manual processes.
Purple Engage automates the following compliance controls:
Consent capture: The splash page presents the marketing opt-in as a separate, unchecked checkbox. The consent statement is version-controlled. If the wording changes, the system records which version each user consented to.
Opt-out processing: If a guest replies "STOP" to any SMS, the platform immediately sets their marketing consent flag to false and halts all further outbound messages. This processing happens in real time, not in a nightly batch job.
Consent records: Every consent event is stored with a timestamp, IP address, device identifier, and the exact consent statement text. These records are exportable for regulatory audits.
Data retention: The platform enforces configurable data retention policies. Phone numbers can be automatically purged after a defined period of inactivity.
For venues operating across multiple jurisdictions, the platform supports per-region consent configurations. A hotel group operating in the UK and the US can apply GDPR-compliant consent flows to UK properties and TCPA-compliant flows to US properties from a single management console.
Presence analytics and segmentation
The WiFi Analytics layer is what separates SMS message marketing built on Guest WiFi from a generic bulk-text service. The platform accumulates a behavioural dataset for every consented guest: when they visit, how long they stay, how frequently they return, and which areas of the venue they spend time in.
This dataset feeds the segmentation engine in Purple Engage. You can build audience segments based on:
| Segment type | Definition | Use case |
|---|---|---|
| First-time visitors | Connected once, no prior history | Welcome message with return incentive |
| Lapsed regulars | Visited 3+ times, not seen in 30 days | Re-engagement offer |
| High-frequency guests | Connected 5+ times in 60 days | Loyalty reward |
| Dwell-time segment | Stayed 2+ hours in a single session | Survey or upsell message |
| Time-of-day segment | Consistently visits at lunchtime | Lunchtime promotion |
Segments update dynamically. A guest who was in the "lapsed regular" cohort moves out of it automatically when they reconnect to the network.
Implementation guide
Step 1: Configure the captive portal
Log into the Purple management console and navigate to the splash page editor. Select the template that matches your brand. Add the mobile number field and the marketing consent checkbox. Ensure the consent statement is specific: it must name the types of communications the guest will receive and the approximate frequency.
For Hospitality operators, the statement might read: "I agree to receive promotional SMS messages from [Hotel Name], including special offers and event notifications, up to twice per month. Reply STOP to unsubscribe at any time."
For Retail operators: "I agree to receive SMS promotions from [Brand Name], including sale alerts and new arrivals, up to twice per month. Reply STOP to unsubscribe."
Keep the form short. Every additional field reduces completion rates. Mobile number and consent checkbox is the minimum viable capture.
Step 2: Define your segmentation strategy
Before you send a single message, define the segments you will target and the offers you will attach to each. Work backwards from the business outcome. If the goal is to increase midweek footfall, the relevant segment is guests who visit at weekends but not during the week. The offer must be compelling enough to change behaviour - a generic "we miss you" message will not move the needle.
Document the segment definition, the trigger condition, the message content, and the success metric for each campaign. This discipline prevents the most common failure mode: sending irrelevant messages to large audiences and burning through your opt-in list.
Step 3: Build and test the automated campaign
In Purple Engage, navigate to the campaign builder. Select "SMS" as the channel. Define the audience segment using the filters available. Set the trigger: this can be time-based (send at 4:00 PM on Tuesdays), event-based (send two hours after the guest disconnects from the network), or behaviour-based (send when a guest has not connected in 30 days).
Write the message. Keep it under 160 characters to avoid multi-part SMS charges. Lead with the offer, include a trackable short link, and end with the opt-out instruction. Example: "Hi [First Name], enjoy 20% off your next visit to [Venue]. Valid this week only. Show this text at the till. Reply STOP to opt out."
Send a test message to your own number before activating the campaign. Confirm the personalisation tokens resolve correctly and the link works.
Step 4: Monitor and optimise
Track the following metrics weekly:
- Delivery rate: Percentage of messages successfully delivered. Below 95% suggests number quality issues.
- Opt-out rate: Percentage of recipients who reply STOP. Above 2% indicates the messages are not relevant or the frequency is too high.
- Return visit rate: Percentage of SMS recipients who reconnect to the network within the campaign window. This is your primary success metric.
- Offer redemption rate: If the message includes a trackable code or link, measure the redemption rate separately.
For Transport hubs and Healthcare venues, the segmentation logic may differ - passengers and patients have distinct visit patterns - but the measurement framework is the same.
Best practices
Value beats frequency. 23% of consumers will abandon a brand that sends too many marketing messages [SAP Engagement Cloud, 2026]. SMS sits alongside messages from family and friends. Every text you send competes with that context. Two promotional messages per month is a sensible ceiling for most venue types. If you have nothing genuinely valuable to offer, do not send the message.
Timing is a variable, not a constant. The optimal send time depends on the venue type and the guest's behaviour pattern. For a pub or restaurant, 4:00 PM on a weekday targets the dinner-decision window. For a retail estate, Saturday morning targets the pre-shopping planning phase. Use the WiFi analytics to identify when your specific audience is most receptive, rather than applying a generic rule.
Personalise beyond the first name. Addressing the guest by name is table stakes. The real personalisation is in the offer itself. A guest who always visits on Sundays should receive a Sunday-specific offer. A guest who spends three hours in the venue should receive a different message to one who visits for 20 minutes. Purple Engage supports dynamic content tokens that pull from the guest's behavioural profile.
Integrate with your CRM. The WiFi data is most powerful when it flows into your existing CRM. Purple provides API integrations that sync captured phone numbers, consent status, and presence data with major CRM platforms. This allows your marketing team to use the WiFi data alongside purchase history, loyalty points, and other first-party signals to build richer segments.
Test message length. A single SMS is 160 characters. Messages that exceed this are split into multiple parts and charged accordingly. Keep messages concise. If the offer requires more context, use a short link to a landing page.
Troubleshooting and risk mitigation
Low opt-in rates at the portal
If fewer than 20% of connecting guests are providing their mobile number, the value exchange is not compelling enough. Review the splash page. Is the benefit of providing the number clearly stated? Consider offering an immediate tangible benefit - a discount code delivered by SMS on the spot - rather than a vague promise of future offers. Also check the form design on mobile. If the number field is hard to use on a small screen, completion rates will suffer.
High opt-out rates
An opt-out rate above 2% is a signal that the messages are not relevant or the frequency is too high. Audit the last three campaigns. Were the offers specific to the recipient's behaviour, or were they generic blasts to the full database? Reduce frequency and tighten the segmentation before the next send.
Delivery failures
If delivery rates drop below 95%, the most likely cause is number formatting errors. Ensure the portal enforces E.164 format validation (the international standard for phone numbers). Numbers entered without a country code will fail to deliver. Configure the portal to auto-prepend the country code based on the venue's location.
Data integration failures
If the WiFi data is not flowing into the CRM, check the API credentials and the webhook configuration in the Purple management console. Verify that the CRM's rate limits are not being exceeded during high-traffic periods. Purple's support team can provide integration logs to diagnose the specific failure point.
Regulatory audit
If you receive a subject access request under GDPR, Purple Engage allows you to export all data associated with a specific phone number, including the consent record, all messages sent, and all presence events. This export is available from the guest profile view in the management console.
ROI and business impact
SMS message marketing delivers between $21 and $41 return for every $1 spent [Upcity, 2023]. For venue operators, the more relevant metric is the incremental revenue generated per return visit. A hotel that drives 50 additional midweek stays per month at an average room rate of £120 generates £6,000 in incremental revenue from a single campaign segment.
The closed-loop attribution model that Purple enables makes this calculation straightforward. You know exactly how many guests received the SMS. You know exactly how many of those guests reconnected to the network within the campaign window. The difference between the return rate of the SMS cohort and the baseline return rate of non-messaged guests is the incremental lift attributable to the campaign.
For a retail operator, the same logic applies. Track the MAC addresses of guests who received the SMS and subsequently connected to the in-store network. Compare their average basket value to the baseline. The delta, multiplied by the number of returning guests, is the campaign's revenue contribution.
This level of attribution is not available to operators using third-party SMS lists or purchased data. It is only possible when the data originates from your own physical infrastructure. That is the strategic advantage of building your SMS programme on Guest WiFi.
Case study: hospitality
A mid-scale hotel group with 40 properties across the UK deployed Purple Engage on their HPE Aruba network. Within six months, they had captured verified mobile numbers from 38% of connecting guests. They configured a lapsed-guest campaign targeting anyone who had not connected in 45 days, sending a personalised SMS with a 15% discount on their next direct booking. The campaign achieved a 31% return visit rate among the targeted cohort, compared to a 12% baseline return rate for non-messaged guests. The incremental bookings generated covered the cost of the Purple Engage subscription within the first campaign cycle.
Case study: retail
A national fashion retailer deployed Purple on their Cisco Meraki network across 120 stores. They used the presence data to identify shoppers who visited once but did not return within 30 days. An automated SMS was sent on day 31, offering a 10% discount valid for the following two weeks. The opt-in rate at the portal was 44%. The SMS campaign achieved a 28% redemption rate, with redeemers spending an average of 22% more than their first visit basket. The retailer attributed a 7% increase in repeat visit frequency across the SMS cohort over the following quarter.
-
For related reading, see How to make a great first impression with your guest WiFi and Three SSIDs to rule them all: guest, Passpoint, and IoT WiFi . For the companion guide, see How to leverage SMS in marketing to increase return visits .
-
Key Definitions
Captive portal
A web page that intercepts a device's network session before granting internet access, used to present terms of service, collect user data, and capture marketing consent.
The primary data capture point in a Guest WiFi deployment. IT teams configure the portal via the Purple management console. The design and content of the portal directly affects opt-in rates.
MAC address
A Media Access Control address is a unique 48-bit hardware identifier assigned to a network interface. It is used at the data link layer to identify devices on a local network.
Purple uses MAC addresses to track device presence across visits, enabling closed-loop attribution between SMS campaigns and return visits. Note that iOS 14+ and Android 10+ randomise MAC addresses by default; Purple's platform accounts for this via session-level correlation.
RADIUS
Remote Authentication Dial-In User Service. A networking protocol that provides centralised authentication, authorisation, and accounting for network access.
The protocol used between the venue's access points and the Purple cloud platform to manage session authentication. When a guest completes the portal form, RADIUS grants the session access to the internet.
First-party data
Data collected directly from a person by the organisation that will use it, with the person's knowledge and consent.
Phone numbers captured at the Guest WiFi portal are first-party data. They are more accurate, more compliant, and more valuable than third-party data purchased from list brokers. As third-party cookies are deprecated, first-party data from physical venues becomes a primary competitive asset.
Conscious-choice opt-in
A consent mechanism where the user must actively select an option to agree to marketing communications, as opposed to a pre-ticked box or implied consent.
Required under GDPR for SMS marketing. The opt-in checkbox on the Purple splash page is unchecked by default. The user must actively tick it. This is the mechanism that makes the consent legally valid.
Presence analytics
The measurement and analysis of visitor behaviour within a physical space using data from wireless network connections, including visit frequency, dwell time, and movement patterns.
The Purple platform accumulates presence data for every consented guest. This data feeds the segmentation engine, allowing venue operators to build behavioural audience segments without requiring a separate loyalty card or app.
Dwell time
The duration of a visitor's continuous connection to the network within a venue, used as a proxy for time spent on-site.
A guest with a high dwell time is more engaged with the venue than one who connects briefly. Dwell time is used to trigger specific campaigns - for example, a survey sent to guests who have been on-site for two hours, or an upsell message sent to guests who spend more than 90 minutes in a specific zone.
Closed-loop attribution
A measurement methodology that connects a marketing action (sending an SMS) to a business outcome (a return visit) through a continuous data loop, without relying on self-reported data or probabilistic matching.
Purple enables closed-loop attribution by linking the SMS send event to the MAC address of the recipient's device, then detecting that MAC address when the device reconnects to the network. This provides definitive proof of campaign-driven return visits.
E.164
The international standard for phone number formatting, specifying a maximum of 15 digits including the country code, with no spaces, dashes, or parentheses.
SMS delivery requires phone numbers in E.164 format. The Purple portal should be configured to validate and auto-format numbers at the point of capture to prevent delivery failures.
Worked Examples
A 200-room hotel wants to increase food and beverage revenue from staying guests. They have HPE Aruba access points deployed across the property and no existing SMS marketing capability.
The IT team configures the HPE Aruba network to route unauthenticated sessions to the Purple captive portal via DNS redirect. The portal is branded to the hotel and requests the guest's mobile number with a marketing consent checkbox. The consent statement specifies: 'I agree to receive SMS promotions from [Hotel Name], including restaurant offers and spa promotions, up to twice per month. Reply STOP to opt out.' Once deployed, the marketing team configures a trigger in Purple Engage: when a guest connects to the network between 3:30 PM and 5:00 PM, they receive an SMS at 4:00 PM offering a complimentary glass of wine with any main course at the hotel restaurant that evening. The offer is valid only for that evening, creating urgency. The system tracks whether the guest's MAC address is detected near the restaurant access point later that evening.
A stadium with 60,000 capacity wants to reduce post-event congestion at transport hubs and increase merchandise sales in the final 20 minutes of an event.
The venue deploys Purple on their Cisco Meraki network, segmenting the SSID by seating zone. During the event, the platform builds a real-time picture of which zones are most densely populated. At 15 minutes before the scheduled end of the event, Purple Engage sends a segmented SMS to all connected devices in the premium seating zones: 'Exclusive offer for premium guests: 20% off all merchandise at the club shop for the next 60 minutes. Show this text at the till. Avoid the rush - shop before the final whistle.' The offer incentivises early departure from seats, reducing the post-event congestion spike at the main exits and transport connections.
Practice Questions
Q1. A retail chain wants to send an SMS discount to shoppers the moment they walk into any of their 50 stores. What technical and data prerequisites must be in place before this is possible?
Hint: Consider what data must exist before the system can identify the returning shopper, and what network event triggers the message.
View model answer
Three prerequisites must be in place. First, the shopper must have previously connected to the Guest WiFi, provided their mobile number, and granted marketing consent. Without this prior capture event, the system has no phone number to send to. Second, the venue's access points must be configured to report device association events to the Purple platform in real time, so the system can detect when a known MAC address connects. Third, the campaign trigger in Purple Engage must be set to fire on the 'device connected' event for the relevant segment, not on a time-based schedule. The message should be sent within two to three minutes of connection to feel contextually relevant.
Q2. You are the IT director of a conference centre. Your SMS opt-out rate has risen to 4.5% over the last three campaigns. What are the most likely causes and how do you diagnose them?
Hint: An opt-out rate above 2% is a signal. Think about the two main variables that drive opt-outs: relevance and frequency.
View model answer
A 4.5% opt-out rate is more than double the acceptable threshold of 2%. The two most likely causes are excessive frequency and low relevance. To diagnose, review the send cadence of the last three campaigns. If messages were sent more than twice per month to the same individuals, frequency is the primary driver. Next, review the segmentation. If all three campaigns targeted the full database rather than specific behavioural cohorts, the messages were almost certainly irrelevant to a large proportion of recipients. The remediation is to reduce frequency to a maximum of two messages per month per individual and to tighten the segmentation so each message is sent only to guests for whom the offer is genuinely relevant. Pause campaigns until the opt-out rate returns below 1%.
Q3. A hotel group's marketing director wants to prove to the CFO that the SMS campaign drove 200 incremental room nights last quarter. How do you construct that attribution case using the Purple platform?
Hint: Think about the difference between the return rate of the SMS cohort and the baseline return rate of guests who were not messaged.
View model answer
The attribution case requires a control group comparison. Export two datasets from Purple Engage: the return visit rate for guests who received the SMS campaign, and the return visit rate for guests who were eligible for the campaign (i.e. they met the segment criteria) but were not messaged, either because they had not yet opted in or because they were excluded from a split test. The incremental return rate is the difference between the two. Multiply the incremental return rate by the total number of SMS recipients to get the number of attributable return visits. If the SMS cohort had a 31% return rate and the control group had a 12% return rate, the incremental lift is 19 percentage points. Applied to 1,050 SMS recipients, that is approximately 200 incremental return visits. Present this alongside the average room rate to calculate the revenue contribution.
Q4. Your legal team has flagged that your current SMS consent capture may not satisfy GDPR because the opt-in checkbox is pre-ticked on the splash page. What is the risk and how do you remediate it?
Hint: GDPR requires consent to be freely given and unambiguous. Consider what a pre-ticked box implies about the nature of the consent.
View model answer
A pre-ticked checkbox does not constitute valid consent under GDPR Article 7 and Recital 32, which explicitly state that silence, pre-ticked boxes, or inactivity do not constitute consent. The risk is that any SMS marketing sent to guests who 'consented' via a pre-ticked box is unlawful processing of personal data, exposing the organisation to enforcement action by the ICO and potential fines of up to 4% of global annual turnover. The remediation has two parts. First, update the splash page in the Purple management console to ensure the marketing consent checkbox is unchecked by default. Second, identify all guests in the database whose consent was captured via the pre-ticked mechanism and suppress them from all future SMS campaigns. You cannot retroactively obtain valid consent by sending them a message; you must wait until they connect again and provide fresh consent via the corrected portal.