How to leverage SMS marketing service to increase return visits
This technical guide details how venue operators can use an SMS marketing service to drive measurable return visits by capturing verified first-party phone data at the Guest WiFi captive portal. It covers the full deployment architecture, GDPR and TCPA compliance requirements, location-based audience segmentation, and real-world case studies from hospitality and retail environments. Marketing Directors, CRM Managers, and Retail Venue Operators will find concrete implementation steps and ROI benchmarks to justify and execute an SMS programme.
Listen to this guide
View podcast transcript
- Executive summary
- Technical architecture: from access point to SMS gateway
- Double opt-in verification flow
- Hardware integration and RADIUS authentication
- Compliance frameworks: GDPR and TCPA
- GDPR requirements (UK and EU)
- TCPA requirements (United States)
- Segmentation strategy: using location analytics to drive relevance
- Timing and frequency rules
- Implementation guide: step-by-step deployment
- ROI and business impact
- Troubleshooting and risk mitigation
- References

Executive summary
SMS marketing delivers a 98% open rate, with 90% of messages read within three minutes of delivery [Sakari, 2025]. For venue operators running Guest WiFi across hotels, retail estates, or stadiums, the data capture infrastructure already exists. The missing step is converting that anonymous network traffic into a verified, consented SMS subscriber list. Purple Engage captures phone numbers at the captive portal, enforces a double opt-in verification flow, and automates campaign dispatch based on physical presence analytics. The result: conversion rates between 21% and 30%, and an ROI of $21 to $41 for every $1 spent on SMS. This guide covers the end-to-end architecture, from access point to SMS gateway, the compliance requirements under GDPR and TCPA, and the segmentation strategies that separate relevant offers from spam. Two worked examples show exactly how a hotel group and a retail chain deploy this in practice.
Technical architecture: from access point to SMS gateway
The data pipeline for an SMS marketing service begins at the wireless controller. Whether you deploy Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, or Fortinet access points, the mechanism is consistent: the controller intercepts unauthenticated HTTP traffic and redirects the device to the captive portal hosted by Purple.
The captive portal is the data capture layer. To build an SMS subscriber list, you configure the portal to present a phone number field alongside the standard email or social login options. The critical architectural decision here is the verification method.
Double opt-in verification flow
A single opt-in, where the user enters a number and taps connect, is insufficient for two reasons. First, it allows users to enter fictitious numbers to bypass the login screen, polluting your CRM with unreachable contacts. Second, it does not satisfy the "prior express written consent" standard required by the TCPA for US venues, nor the "unambiguous indication" standard under GDPR for UK and European venues.
The double opt-in flow resolves both problems:
- The visitor enters their mobile number and selects the SMS marketing opt-in checkbox (unchecked by default).
- Purple Engage triggers a POST request to the SMS gateway API (e.g., Twilio or Infobip).
- The gateway sends a one-time password (OTP) to the device via SMS.
- The visitor enters the OTP on the portal. A successful entry confirms the device is in the visitor's possession.
- Purple logs the consent record, including the timestamp, IP address, portal version, and the exact consent text displayed.
- The RADIUS server authenticates the session and grants network access.
This flow ensures every phone number in your database is reachable, verified, and accompanied by an auditable consent record.

Hardware integration and RADIUS authentication
Purple operates as a cloud overlay on top of your existing hardware. The captive portal redirect is configured at the wireless controller level using standard RADIUS change of authorisation (CoA) messages. When the OTP is validated, Purple sends a RADIUS CoA packet to the controller, which moves the device from the unauthenticated VLAN to the internet-access VLAN. This is hardware-agnostic and does not require firmware changes to the access points.
For venues running Guest WiFi across multiple sites, the Purple platform centralises the subscriber database, meaning a guest who opts in at a Manchester location is identifiable when they visit a London site.
Compliance frameworks: GDPR and TCPA
Running an SMS marketing service without a well-structured compliance architecture exposes your organisation to substantial fines. The Information Commissioner's Office (ICO) can issue fines of up to £17.5 million or 4% of global annual turnover under UK GDPR. In the US, TCPA violations carry statutory damages of $500 to $1,500 per unsolicited text.
GDPR requirements (UK and EU)
Under GDPR, consent for SMS marketing must be:
- Freely given: The opt-in cannot be a condition of accessing the WiFi. The checkbox must be optional.
- Specific: The consent must explicitly state that the user agrees to receive SMS marketing messages from the named organisation.
- Informed: The privacy policy must be accessible from the portal and must explain how phone data is stored and used.
- Unambiguous: Pre-ticked checkboxes do not constitute valid consent. The user must take an active, conscious-choice opt-in.
Purple stores the full consent record, including the version of the privacy policy displayed at the time of opt-in. When a user replies STOP, Purple automatically updates the profile and suppresses future messages, maintaining a synchronised suppression list.
TCPA requirements (United States)
The TCPA requires "prior express written consent" for automated marketing texts. The FCC's 2025 one-to-one consent rule further tightens this: consent obtained for one business cannot be shared with or sold to another. For multi-brand venue operators, this means each brand requires its own consent record.
Every SMS you send must include:
- The sender's identity.
- A clear opt-out instruction (e.g., "Reply STOP to opt out").
- Disclosure that message and data rates may apply.
For a detailed review of data platform architecture underpinning these requirements, see our customer data platform guide .
Segmentation strategy: using location analytics to drive relevance
Batch-and-blast SMS campaigns produce high opt-out rates. The 53% of subscribers who unsubscribe cite over-frequency as their primary reason [Sakari, 2025]. The antidote is relevance, and relevance requires segmentation.
Purple's WiFi Analytics platform tracks device MAC addresses across the venue network, building a behavioural profile for each visitor:
| Behavioural signal | Segment | Campaign trigger |
|---|---|---|
| First Guest WiFi connection | New visitor | Welcome offer with return incentive |
| 3+ visits in 30 days | Loyal visitor | Loyalty reward or exclusive preview |
| 45+ minutes in a specific zone | High-intent shopper | Zone-specific discount code |
| No visit in 60 days | Lapsed visitor | Win-back offer |
| Visit on weekdays only | Weekday regular | Weekend event invitation |
Using Purple Engage, you configure these segments as dynamic rules. When a visitor's behaviour matches a rule, the platform automatically dispatches the pre-configured SMS. No manual intervention is required.
Timing and frequency rules
SMS campaigns require tighter frequency controls than email. Industry data shows that 49% of subscribers prefer receiving promotional SMS no more than once every two weeks [Sakari, 2025]. Configure the following guardrails in Purple Engage:
- Minimum gap between messages: 14 days per subscriber.
- Quiet hours: No messages between 21:00 and 09:00 local time.
- Post-visit delay: Wait at least two hours after a visitor disconnects before sending a return-visit offer. Sending while they are still on-site is poor timing.
- Opt-out suppression: Immediately suppress any subscriber who replies STOP, and do not re-add them unless they explicitly opt back in.
Implementation guide: step-by-step deployment
The following steps apply to a venue operator deploying SMS marketing for the first time using Purple Engage on an existing Guest WiFi network.
Step 1: Audit the captive portal. Review the current login flow. Confirm the portal is hosted by Purple and that you have access to the portal editor. Identify which login methods are currently active (email, social, phone).
Step 2: Add the phone number field. In the Purple portal editor, add a phone number input field with country code selector. Set the SMS marketing opt-in checkbox to unchecked by default. Write the consent language in plain English, naming your organisation and the type of messages the user will receive.
Step 3: Configure the SMS gateway. In Purple Engage, connect your SMS gateway account (Twilio, Infobip, or a compatible provider). Configure the OTP message template and the verification timeout (recommend 10 minutes).
Step 4: Update the privacy policy. Ensure the privacy policy linked from the portal explicitly covers SMS marketing data. State the retention period, the third-party processors involved, and the opt-out mechanism.
Step 5: Build your first segment. Start with the simplest segment: visitors who connected more than 30 days ago and have not returned. This win-back segment has the clearest business case and the lowest risk of over-messaging active visitors.
Step 6: Create the campaign. Write a message under 160 characters. Include the offer, a short URL (use a UTM-tagged link for tracking), and the opt-out instruction. Test the message by sending to a seed list of internal numbers before activating.
Step 7: Measure and iterate. Track click-through rate, redemption rate (via POS or booking system), and opt-out rate. A click-through rate below 5% indicates the offer is not relevant enough. An opt-out rate above 2% indicates the frequency is too high.
For broader context on how Guest WiFi fits into your venue's first impression strategy, see our guide on making a great first impression with your guest WiFi .
ROI and business impact

SMS marketing consistently outperforms email in direct response scenarios. The performance gap is not marginal.
| Metric | SMS | |
|---|---|---|
| Open rate | 98% | 28% |
| Click-through rate | 18-35% | 2.5-3.5% |
| Response rate | 45% | 6% |
| Conversion rate | 21-30% | 10-15% |
| Time to read | 3 minutes | 6.4 hours |
| ROI per $1 spent | $21-$41 | $36-$42 |
Source: Sakari SMS Marketing Statistics 2025-2026; Textedly Email vs SMS Marketing 2025.
For venue operators using Purple, the acquisition cost of building the SMS subscriber list is near zero, because the data is captured as a by-product of providing Guest WiFi. This pushes the effective ROI significantly above the industry benchmark.
Purple operates across 80,000+ live venues and has collected 29 billion data points. Venues on the Engage plan that activate SMS campaigns report measurable uplift in return visit frequency within the first 90 days of deployment (Purple internal data).
Troubleshooting and risk mitigation
High failed delivery rate: If more than 5% of your SMS messages fail to deliver, the most likely cause is invalid numbers in the database. Audit your portal configuration to confirm the double opt-in OTP flow is active. Numbers that fail OTP verification should not be added to the marketing list.
High opt-out rate: An opt-out rate above 2% per campaign indicates a relevance or frequency problem. Review your segmentation rules. If you are sending the same offer to all subscribers regardless of behaviour, the messages are not relevant enough. Tighten the segment criteria.
RADIUS authentication failures after OTP: If users complete the OTP but do not receive network access, check the RADIUS CoA configuration on the wireless controller. The Purple platform sends a CoA packet to the controller's management IP on UDP port 3799. Confirm the shared secret matches and the firewall permits inbound CoA traffic.
Consent record gaps: If a data subject access request (DSAR) reveals missing consent timestamps, the portal may have been updated without versioning the consent text. Purple logs the consent text version at the time of opt-in. Ensure you increment the version number in the portal settings whenever you change the consent language.
International number formatting: If your venue attracts international visitors, ensure the phone number field uses E.164 formatting (e.g., +44 7700 900123). Incorrect formatting causes silent delivery failures at the gateway level. Validate the format server-side before triggering the OTP.
For multi-SSID network design considerations that affect how Guest WiFi is segmented from staff and IoT networks, see our guide on three SSIDs to rule them all .
References
[1] Sakari. (2025). SMS Marketing Statistics: Data-Backed Insights for 2025-2026. https://sakari.io/blog/sms-marketing-statistics-data-backed-insights-for-2025-2026
[2] Textedly. (2025). Text vs. Email Marketing: Which Channel Gets Better Results? https://www.textedly.com/blog/email-vs-sms-marketing-when-to-use-which
[3] Infobip. (2026). 2026 Guide to TCPA Compliance for SMS in the US. https://www.infobip.com/blog/tcpa-compliance-sms
[4] Purple. (2024). Purple Engage product data. Internal data. 80,000+ live venues, 29 billion data points collected.
Key Definitions
Double opt-in
A two-step consent process where the user first submits their phone number and then confirms their subscription by responding to a verification message (OTP or reply YES). This creates an auditable consent record and verifies the device.
Required for TCPA compliance in the US and strongly recommended for GDPR compliance in the UK and EU. Critical for database hygiene.
Captive portal
A web page presented to a device before it is granted access to a public network. The portal intercepts HTTP traffic and redirects the browser to a login or registration page.
The primary data capture mechanism for venue operators. Every Guest WiFi deployment uses a captive portal; the question is whether it is configured to capture phone numbers.
TCPA (Telephone Consumer Protection Act)
US federal legislation that restricts telemarketing calls and automated text messages. Requires prior express written consent for marketing SMS, with statutory damages of $500 to $1,500 per violation.
Applies to any venue sending SMS to US mobile numbers. The FCC's 2025 one-to-one consent rule means consent cannot be shared across brands.
GDPR (General Data Protection Regulation)
EU and UK data protection legislation requiring that personal data, including phone numbers, is processed lawfully, fairly, and transparently. Consent must be freely given, specific, informed, and unambiguous.
Applies to all venues processing data of UK and EU residents. Fines of up to £17.5 million or 4% of global annual turnover for serious breaches.
MAC address (Media Access Control address)
A unique identifier assigned to a network interface controller. Used by WiFi access points to identify individual devices on the network.
Purple uses MAC addresses to track device movement, dwell time, and visit frequency across the venue. This is the foundation of location-based segmentation.
RADIUS CoA (Change of Authorisation)
A RADIUS protocol extension that allows the authentication server to dynamically change the authorisation state of an active session. Used to move a device from the unauthenticated VLAN to the internet-access VLAN after successful portal authentication.
The mechanism by which Purple grants network access after OTP verification. Requires UDP port 3799 to be open between the Purple cloud and the wireless controller.
First-party data
Information collected directly from customers by the organisation that owns the relationship. Not purchased from or shared by third parties.
Phone numbers captured via the Guest WiFi portal are first-party data. They are immune to third-party cookie deprecation and carry higher trust and accuracy than purchased lists.
Dwell time
The duration a device remains connected to or visible to the WiFi network within a defined physical zone.
A key behavioural signal used to infer purchase intent. A visitor who spends 45 minutes in a specific retail zone is more likely to respond to a zone-specific offer than one who passed through in two minutes.
SMS gateway
A telecommunications service that provides an API for sending and receiving SMS messages programmatically. Examples include Twilio and Infobip.
Purple Engage integrates with SMS gateways to dispatch OTP verification messages and marketing campaigns. Gateway selection affects international routing capability and per-message cost.
Opt-out rate
The percentage of subscribers who request removal from a marketing list after receiving a campaign message.
A leading indicator of campaign health. An opt-out rate above 2% per send indicates a frequency or relevance problem. Sustained high opt-out rates damage sender reputation with mobile carriers.
Worked Examples
A 150-site pub chain wants to increase Tuesday evening footfall. They currently offer free WiFi across all sites but do not capture phone numbers. How should they deploy an SMS marketing strategy?
Step 1: Update the captive portal across all 150 sites to include an optional SMS opt-in field with a double opt-in OTP verification flow. The consent language should read: 'Tick to receive exclusive offers and event updates from [Brand] by SMS. You can opt out at any time by replying STOP.'
Step 2: Run an in-venue promotion for the first four weeks: 'Sign up for texts and get a free soft drink on your next visit.' Display this on table cards and digital screens. This drives initial opt-in volume.
Step 3: In Purple Engage, build a segment: visitors who connected to the Guest WiFi on a Friday or Saturday in the past 60 days but have not visited on a Tuesday in the same period.
Step 4: Schedule an automated SMS to this segment every Tuesday at 14:00 local time: 'Hi [Name], midweek special at [Local Pub Name]. 20% off food tonight only. Show this text to your server. Reply STOP to opt out.'
Step 5: Track redemption by asking staff to log the promo code at the POS. Cross-reference with Guest WiFi login data to calculate incremental Tuesday visits attributable to the campaign.
Step 6: After four weeks, review the opt-out rate. If it exceeds 2%, reduce frequency to fortnightly. If click-through is below 5%, test a different offer (e.g., a quiz night invitation rather than a food discount).
A shopping centre with 80 retail tenants wants to send real-time SMS offers to shoppers who are currently on-site and near a specific anchor tenant running a flash sale. How should they architect this?
Step 1: Confirm the Cisco Meraki access points are deployed with sufficient density to provide zone-level location accuracy (typically one AP per 500 square metres for indoor positioning).
Step 2: In Purple, define a location zone corresponding to the anchor tenant's floor area. This uses the access point signal strength data to determine which devices are within approximately 20 metres of the store entrance.
Step 3: Configure a real-time trigger in Purple Engage: 'When a subscriber enters Zone: Anchor Tenant A, and has not received an SMS in the past 7 days, send the following message.'
Step 4: Draft the SMS: 'Flash sale at [Tenant Name]: 30% off all footwear for the next 60 minutes. You are just 2 minutes away. Show this text in-store. Reply STOP to opt out.'
Step 5: Set a campaign cap: maximum 500 messages per hour to prevent gateway throttling and to ensure the tenant's staff can handle the footfall increase.
Step 6: After the campaign, pull the Purple analytics report showing how many triggered subscribers subsequently connected to the WiFi inside the tenant's zone within 90 minutes. This measures the direct footfall impact.
Practice Questions
Q1. Your marketing director wants to automatically send an SMS to every user the moment they connect to the WiFi in your stadium. As the network architect, what is your recommendation and why?
Hint: Consider the user experience during the captive portal authentication flow, and the timing relative to the user's current context.
View model answer
Advise against immediate dispatch. When a user connects to the WiFi, they are in the middle of completing the captive portal login. Sending an SMS at this exact moment interrupts the authentication flow and creates a poor first impression. More importantly, the user is already on-site, so a return-visit offer has zero relevance. Instead, configure a post-visit trigger: wait until the device disconnects from the network (indicating the visitor has left), then send the SMS two to four hours later with a return-visit incentive. Alternatively, use a dwell-time trigger: if the visitor spends more than 30 minutes in the merchandise zone, send a zone-specific offer. Both approaches are more relevant and more likely to convert.
Q2. A hotel operator wants to pre-tick the SMS marketing opt-in checkbox on the captive portal to increase subscriber numbers faster. How do you respond, and what alternative do you recommend?
Hint: Review the consent requirements under GDPR Article 7 and the TCPA's prior express written consent standard.
View model answer
Explain that pre-ticking the checkbox violates GDPR Article 7, which requires that consent be demonstrated by a clear affirmative act. A pre-ticked box does not constitute an affirmative act. It also fails the TCPA's prior express written consent standard. The ICO has issued enforcement notices specifically for pre-ticked marketing consent boxes. The risk is not theoretical. Instead, recommend a value-exchange approach to drive opt-ins: display a prominent message on the portal stating 'Opt in for SMS and receive a 10% discount at the hotel bar on your next visit.' This drives voluntary opt-ins from guests who are genuinely interested, producing a smaller but far more engaged and legally defensible subscriber list.
Q3. You notice that 12% of SMS messages dispatched from Purple Engage are failing to deliver, according to the Twilio delivery logs. The failures are concentrated on numbers that were added to the database in the past 30 days. What is the most likely cause and how do you fix it?
Hint: Consider the relationship between the double opt-in flow and database hygiene. What changed 30 days ago?
View model answer
The most likely cause is that the double opt-in OTP verification step was disabled or bypassed during a recent portal update. Without OTP verification, users can enter any number, including invalid or fictitious ones, to gain network access. Numbers added during this window were never verified against a real device. To fix this: first, re-enable the OTP verification flow in Purple Engage and confirm it is active on all portal instances. Second, quarantine the numbers added during the affected period and run a re-verification campaign: send a single SMS asking the user to reply YES to confirm their subscription. Remove any numbers that do not respond within 72 hours. Third, review the portal change log to identify who disabled the verification step and implement a change control process to prevent recurrence.
Q4. A retail chain operates in both the UK and the US. They want to run a single SMS campaign to their entire subscriber database. What compliance considerations must the IT team address before the campaign is dispatched?
Hint: GDPR and TCPA have different consent requirements. Consider whether a single consent record satisfies both.
View model answer
The IT team must segment the subscriber database by country before dispatch. UK and EU subscribers are governed by GDPR; US subscribers are governed by TCPA. The consent language required by each regulation differs. GDPR requires that the user was informed of the specific type of messages they would receive and that consent was freely given and separate from the WiFi access condition. TCPA requires prior express written consent and mandates that the consent was obtained for this specific sender, not a third party. If the portal used different consent text for UK and US visitors, the team must confirm that each subscriber's consent record matches the regulation applicable to their number's country code. Additionally, the TCPA's 2025 one-to-one consent rule means that if the retail chain operates multiple brands, consent obtained for Brand A cannot be used to send messages on behalf of Brand B. Segment by brand as well as by geography before dispatch.