What could a guest WiFi privacy failure cost you?
See the maximum fine for your size, what the law asks of a captive portal, and the staff time that self-service access requests save.
Opt-in consent, 72-hour breach reporting, and rights of access and erasure.
That is 25,000 logins a month, each needing a consent record you can produce on request.
Up to €20 million or 4% of worldwide annual turnover, whichever is higher (UK GDPR: £17.5 million or 4%). A lower tier of €10 million or 2% covers failings such as security and record-keeping.
- Marketing consent is a separate, unticked opt-in, never a condition of getting online (Articles 6 and 7)
- Personal data breaches reported to the regulator within 72 hours (Article 33)
- Access and erasure requests answered within one month (Articles 15 and 17)
- Portal forms collect only what the stated purpose needs (Article 5, data minimisation)
Purple holds ISO 27001, Cyber Essentials and B Corp certification. This tool is guidance, not legal advice.
Guest WiFi data privacy and regulatory compliance evaluator
Select your primary operating region and network scale to inspect mandatory captive portal consent rules, maximum non-compliance penalties, and how Purple automates lawful data collection.
⚖️ Mandatory Captive Portal Requirements
- Unambiguous, active opt-in consent for marketing (no pre-ticked boxes)
- Granular consent unbundled from basic network terms and conditions
- 72-hour notification to the regulator for reportable personal data breaches
- Designated Data Protection Officer (DPO) for large-scale systematic monitoring
Enforceable visitor (data subject) rights:
- Right of access, answered within one month (extendable in complex cases)
- Right to rectification and erasure (Right to be Forgotten)
- Right to data portability in machine-readable format
- Right to withdraw consent at any time without network denial
🛡️ How Purple Enforces Compliance
- Granular splash page checkboxes separated from network access acceptance
- Automated MyData self-service portal for instant subject access and erasure requests
- Real-time CRM webhook synchronisation to halt marketing upon consent withdrawal
- ISO 27001 certified AWS infrastructure with full EU data residency guarantees
| Privacy feature | Legacy captive portals | Purple cloud compliance engine |
|---|---|---|
| Consent capture | Bundled T&Cs, pre-ticked opt-in boxes (non-compliant) | Unbundled, freely-given consent checkboxes |
| Right to erasure (DSAR) | Manual database queries taking weeks | Automated MyData self-service portal (instant) |
| CRM synchronisation | Static CSV exports with orphaned opt-outs | Real-time two-way webhooks & consent suppression |
| Security certifications | Unverified local server storage | ISO 27001, ISO 9001 & SOC 2 Type II certified |
Build privacy compliance into your guest WiFi
Deploy Purple's ISO 27001 certified captive portal with native GDPR, CCPA, and LGPD consent management across your venues.
What is data protection and data privacy?
The concept of the right to privacy emerged in 1948 when the Universal Declaration of Human Rights was adopted by the UN. This states that “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence”. By 1978, the first marketing email had been sent out to 400 recipients and in 1994, the first banner ad appeared on the internet. By the year 2000, many banks started offering online banking services. In 2006, Facebook was created and social media took off exponentially, becoming an integral part of our everyday lives.
Currently, 137 out of 197 countries have put some level of legislation in place to secure the protection of data and privacy. Some of the biggest names on the planet have been subject to fines as a result of violations such as Google, Whatsapp, and Facebook, with one of the biggest ever data protection fines being awarded to Amazon for $877 million in 2021.
In this blog, we'll examine three of the major data privacy laws in the world, the GDPR, CCPA, and LGPD. We'll give you a short summary of the law, what happens if you don't comply and how the Purple Platform can enable you to collect data from visitors to your venue compliantly.
Europe: General Data Protection Regulation (GDPR)
What is CCPA/CPRA?
Perhaps the most well-known data protection law in the world, the GDPR was created by the European Union and came into effect on 05/25/2018. The legislation imposes legal obligations on any organization that gathers and holds data related to people in the EU and EU citizens, even if the organization itself is not EU-based.
The GDPR provides a framework for data controllers (and processors), through, seven principles, which include minimizing how much data is collected and timeframes for storing data. It also imposes specific rules, such as the 72-hour reporting requirement for data breaches.
The GDPR also clearly imposes rights on data subjects (individuals) with regard to the information an organization collects about them, for example, the right to be informed about the data being processed. In some circumstances, the data subject may need to give unambiguous consent to process the data, such as opting into your marketing email list whereas there are other situations where data can be processed without consent (such as life-threatening situations or on public interest grounds).
What happens if you don't comply with CCPA/CPRA?
Fines for non-compliance are substantial. Less severe infringements could result in a fine of up to €10 million ($9.8M) or 2% of the firm's worldwide annual revenue from the preceding fiscal year. For more serious infringements, including going against the principles of the right to privacy and right to be forgotten, fines can be up to €20 million ($19.7M) or 4% of the firm's worldwide annual revenue from the preceding fiscal year, whichever amount is higher.
North America: California's California Consumer Privacy Act (CCPA)
What is the CCPA?
The California Consumer Privacy Act of 2018 (CCPA) aims to give consumers more control over the data that businesses collect about them and includes new privacy rights for California consumers. These rights include the right to know what data is being collected about them, the right to delete it, the right to opt out of the sale of their personal information, and the right to non-discrimination for exercising their CCPA rights.
In order to comply with the CCPA, websites need to inform their users at the point of data collection about the personal information it collects and for what purposes. Websites should feature a "do not sell my personal information" link to opt out of third-party data sales and should the consumer request the data you hold about them, this should be provided free of charge.
What happens if you don't comply with the CCPA?
If your business is non-compliant with the CCPA, consumers can file a private right of action giving the business 30 days to put the violation right. The business then has to show that the “violation has been cured and no further violations will occur”. If the business fails this, the consumer has the right to file the right of action with the Attorney General. The Attorney General can take civil action and impose an injunction and a penalty of $2,500 per violation. If the violation was deemed intentional then this could rise to $7,500 per violation. This is considered to be per consumer, therefore if 1,000 of your customers were affected, your business would be fined $7.5 million!
South America: Brazil's Lei Geral de Proteção de Dados (LGPD)
What is the LGPD?
The Lei Geral de Proteção de Dados (LGPD) came into effect in 2020 and affects any business or organization that processes the personal data of people in Brazil, regardless of whether that is where the business or organization is located.
The LGPD specifies that you can only process personal data for legitimate, specific, and clearly communicated purposes. Similar to GDPR, the LGPD principles include transparency and data minimization, in other words, tell your customers what data you are collecting, and what you will use it for, and only collect the data you need. Businesses are required to appoint a DPO (Data Protection Officer) in order to comply with the law.
What happens if you don't comply with the LGPD?
If you fail to comply with the LGPD, you may face fines of up to 2% of your company's annual turnover, up to a maximum of 50 million Brazilian Reais, about €8 million or $9 million. There are other corrective actions for violators, including publicizing the infringement and blocking or deleting the processing activities or personal data that caused the issue. This means the offending data controller could lose the entire associated email list and the database related to the incident could be suspended for up to 6 months.
How the Purple Platform can help businesses collect and manage data compliantly with major data protection laws
Captive Portal for visitor consent
Purple's customizable splash pages allow for links to terms and conditions at login as well as optional opt-in checkboxes for marketing materials and communications or an opt-out box for personal data sales for those that need to be compliant with CCPA.
As well as this, Purple's captive portal can ensure that customers who log in have agreed to the terms and conditions as well as the privacy policy.
MyData portal for complete data transparency
Through Purple's My Data Portal which can be found on the Purple website, data subjects can view the data that the business has collected about them through the Purple Portal completely free of charge and withdraw consent should they wish.
Automated WiFi marketing
If you're collecting customer contact data through the Purple Platform and a customer opts out of marketing communications then this would prevent you from emailing them through our automated WiFi marketing tools. Even if you've got an integration on the Purple Platform to an external CRM system, you can map the data there using Purple's built-in software in order to update your database with this information which keeps your database compliant.
