How to leverage SMS marketing best practice to increase return visits
This guide details how venue operators - in hospitality, retail, stadiums, and public-sector environments - can build a compliant, high-performing SMS marketing programme using verified first-party data captured at Guest WiFi login. It covers the three-layer technical architecture (data capture, segmentation, automation), GDPR and TCPA compliance protocols, and proven strategies for driving measurable return visits. Purple Engage automates the entire campaign lifecycle, from consent capture on Cisco Meraki, HPE Aruba, Ruckus, and Juniper Mist hardware through to return-visit attribution via WiFi reconnection matching.
Listen to this guide
View podcast transcript
Executive summary
SMS marketing delivers a 98% open rate and a 45% response rate - numbers that email cannot approach [Infobip 2026 Messaging Trends; Business.com]. For venue operators, the channel's value is not just in those headline figures. It is in the quality of the underlying data. Phone numbers collected through a Guest WiFi captive portal are verified at the point of capture: the visitor typed their number, received a one-time passcode, and proved device ownership. That verification advantage is something a web form or loyalty card sign-up cannot replicate.
This guide covers the full technical stack - from captive portal configuration on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet hardware, through behavioural segmentation in Purple's WiFi Analytics platform, to automated campaign delivery via Purple Engage. It addresses GDPR and TCPA compliance in detail, provides two real-world implementation scenarios, and shows you how to measure return visit uplift rather than just click-through rates.
Purple has deployed Guest WiFi across 80,000+ live venues and processed 440 million logins in 2024. The patterns in this guide are drawn from that dataset.
Technical deep-dive: data capture architecture
The foundation of any SMS marketing programme is the data capture mechanism. A guessed number is worthless. A number from a purchased list is a compliance liability. The only number worth sending to is one that arrived with a verified consent event attached.
Purple's captive portal - the login screen your visitors see when they connect to your Guest WiFi - collects phone numbers as part of the authentication flow. The visitor enters their number, receives a one-time passcode (OTP) by SMS, and enters that passcode to complete login. This OTP step is the verification event. It proves the visitor owns the device and the number. Purple logs the consent event with a UTC timestamp, the venue ID, the visitor's profile identifier, and the specific opt-in language displayed at the time of capture. That log is the audit trail a regulator would ask for.
The consent checkbox for SMS marketing is displayed as a standalone, clearly worded opt-in, separate from the WiFi access terms. This is a conscious-choice opt-in - not a pre-ticked box, not consent bundled into a terms-and-conditions acceptance. Under GDPR Article 7 and Recital 32, consent must be freely given, specific, informed, and unambiguous. Purple's implementation satisfies all four criteria.
The architecture has three layers:
Layer 1 - Data capture. The captive portal runs as a cloud overlay on your existing hardware. Purple is hardware-agnostic: the same portal configuration deploys across Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet. No hardware replacement is required. The portal presents the login screen, captures the phone number and OTP confirmation, records the consent event, and passes the verified profile to Purple Engage.
Layer 2 - Segmentation. Purple's analytics engine builds behavioural segments from WiFi session data. The key dimensions are: visit frequency (how many times in a rolling period), recency (days since last visit), visit duration (dwell time), and - where indoor mapping is deployed - venue zone (which areas the visitor frequented). These dimensions let you build precise audiences: visitors who came once in the last 90 days and have not returned; guests who visited three or more times in a quarter and then went quiet; first-timers from the past 30 days who have not come back. Each segment gets a different message.
Layer 3 - Automation. Purple Engage fires SMS campaigns based on triggers you define. A guest who has not visited in 30 days receives a win-back message. A guest who visited last week receives an event reminder. A fan who attended a stadium fixture receives a pre-sale offer for the next match 48 hours before public sale. The automation runs without manual intervention once the trigger rules are configured.
Why SMS outperforms email for return-visit campaigns
The performance gap between SMS and email is not marginal. SMS carries a 98% open rate versus email's 20% [Infobip 2026]. The click-through rate for SMS is 18%, compared to 2.5% for email [Sender]. Critically, 90% of SMS messages are read within three minutes of delivery, versus approximately 90 minutes for email [Validity]. When you are trying to fill a table on a Tuesday evening or drive footfall to a flash sale, that speed of read is the operational difference between a full venue and an empty one.
Brands that integrate SMS into their omnichannel strategy see a 47.7% lift in customer engagement compared to those using a single channel [Omnisend]. SMS does not cannibalise email. Brands using both see a 97% higher click rate than those using email alone [Mailchimp combined channel data]. The two channels are complementary: email for longer-form content and nurture sequences; SMS for time-sensitive, high-urgency re-engagement.
The ROI case is direct. SMS delivers between $21 and $41 return for every $1 spent [Upcity 2023]. Businesses that send SMS to customers are 683% more likely to report digital marketing success than those that do not [Simple Texting 2024].
SMS marketing best practice: the operational framework
The difference between an SMS programme that drives return visits and one that burns out its list in six months comes down to three disciplines: segmentation, timing, and attribution.
Segment before you send. Sending the same message to your entire database is the fastest route to high unsubscribe rates. A guest who visited yesterday does not need a win-back message. A first-timer from last month needs a different message than a regular who visits every fortnight. Purple's segmentation tools let you define these audiences with precision. The three core segments for most venue operators are: lapsed visitors (no visit in 30-90 days), regular visitors (three or more visits in the last quarter), and first-timers (single visit, no return). Each segment gets a triggered message calibrated to their behaviour.
Time your sends correctly. Sends between 10am and noon, and between 5pm and 7pm on weekdays, consistently outperform other windows across hospitality and retail verticals - this is based on Klaviyo's 2024 SMS benchmark report covering over three billion messages. Avoid sending after 9pm or before 8am. Some jurisdictions have regulatory quiet hours requirements; beyond compliance, late-night sends damage brand perception and drive opt-outs.
Measure return visits, not just clicks. The metric that matters for a venue operator is whether the recipient came back - not the click-through rate on the SMS link. Purple's analytics platform closes this attribution loop by matching subsequent WiFi logins against your SMS send list. When a visitor who received your win-back message reconnects to your WiFi three days later, that is a confirmed return visit attributed to the campaign. That is the number you take to your board.
GDPR and TCPA compliance protocols
Compliance is where teams often stall. The requirements are clear; the implementation is straightforward if you build it correctly from the start.
Under GDPR (UK and EU), the lawful basis for SMS direct marketing is explicit consent under Article 6(1)(a), combined with the ePrivacy Directive's requirement for prior consent for electronic direct marketing. The consent must be: freely given (not conditional on WiFi access), specific (named for SMS marketing, not bundled), informed (the visitor must understand what they are consenting to), and unambiguous (an affirmative action - a tick - not a pre-ticked box). Purple's captive portal satisfies all four criteria. The consent record - including the exact opt-in language displayed, the timestamp, and the visitor profile - is stored and exportable for audit.
Every SMS must include a clear opt-out mechanism. Append "Reply STOP to unsubscribe" to every message. Purple Engage handles this automatically and suppresses opted-out numbers from all future sends. An unsubscribe rate above 3% on any single send is a signal that your segmentation or message relevance is off. Investigate before sending again.
For US venues, the Telephone Consumer Protection Act (TCPA) requires prior express written consent for marketing messages sent to mobile numbers. Application-to-Person (A2P) senders must complete 10DLC (10-digit long code) registration with US carriers. Purple's platform supports 10DLC compliance workflows. The California Consumer Privacy Act (CCPA) adds data subject rights obligations - access, deletion, opt-out of sale - that Purple's data management tools address.
Purple holds ISO 27001, GDPR, CCPA, and Cyber Essentials certifications, and is B Corp certified. These are not marketing claims; they are audited standards that your procurement and legal teams can verify.
Implementation guide
Deployment follows a consistent sequence regardless of hardware platform.
Step 1: Audit your current WiFi login flow. Confirm whether SMS consent is currently being captured and logged. If your captive portal does not include a standalone SMS opt-in checkbox, this is the first configuration change to make. In Purple's platform, this is a portal template setting - no network reconfiguration required.
Step 2: Configure OTP verification. Enable one-time passcode delivery for phone number capture. This is the verification step that distinguishes your list from a guessed or purchased database. OTP delivery requires an SMS gateway integration; Purple Engage includes this natively.
Step 3: Define your three core segments. Build audience definitions for lapsed visitors (no WiFi login in 30 days), regular visitors (three or more logins in 90 days), and first-timers (single login, no return). These are the starting segments; refine them once you have 90 days of data.
Step 4: Build triggered message templates. Write one message per segment. Keep each message under 160 characters to avoid multi-part SMS charges. Include a clear call to action (a link, a code, a date), your venue name as the sender ID, and "Reply STOP to unsubscribe" at the end. Test each template on a small sample before full deployment.
Step 5: Set up return-visit attribution. In Purple's analytics dashboard, configure the campaign attribution window - typically 7 days. Any WiFi login from a number in your SMS send list within that window is counted as a return visit attributed to the campaign.
Step 6: Monitor and adjust. Review unsubscribe rates, return visit rates, and send-time performance after each campaign. Adjust segment definitions and send windows based on the data. A well-tuned programme typically reaches steady state within 90 days.
For hospitality venues, the win-back trigger at 30 days post-stay is the highest-performing campaign type. For retail venues, a time-limited offer sent to lapsed visitors on a Thursday afternoon (ahead of weekend footfall) consistently outperforms other formats. For transport hubs and stadiums, event-triggered messages - sent 48 hours before a fixture or departure window - drive the strongest return engagement.
Real-world implementation scenarios
Scenario 1: Premier Inn - post-stay re-engagement
Premier Inn and Whitbread properties use Purple Engage to automate post-stay SMS sequences. When a guest connects to Guest WiFi during their stay and opts in to SMS marketing, Purple logs the visit. Thirty days after check-out, if no subsequent WiFi login is recorded at any Whitbread property, the guest enters the win-back segment and receives a personalised SMS with a direct booking link and a rate incentive. The message references the property name and the approximate stay period to increase relevance. Whitbread has reported measurable increases in repeat booking rates through this automated post-stay messaging workflow (Purple internal data).
The technical configuration: Purple Engage deployed on HPE Aruba access points across the property estate; captive portal with OTP phone verification and standalone SMS consent; 30-day lapse trigger; message template with dynamic property name field; return-visit attribution window set to 14 days to account for the typical booking-to-stay lead time.
Scenario 2: Retail estate - lapsed shopper reactivation
A mid-size retail chain with 40 locations across the UK uses Purple to capture shopper phone numbers at WiFi login across all sites. The analytics platform identifies shoppers who visited two or more times in a 60-day window and then stopped visiting. This segment - lapsed loyalists - receives a triggered SMS on Thursday afternoons with a weekend-specific offer. The message is sent from a named sender ID matching the brand, includes a short URL to the nearest location's weekend event page, and appends the standard opt-out instruction.
The chain measures success by comparing WiFi login rates in the 7 days following each send against a non-messaged control group drawn from the same lapsed-loyalist pool. Across six months of operation, the messaged group showed a 22% higher return visit rate than the control group (Purple internal data). The list grew at approximately 180 new consented numbers per day across the estate, reaching 16,000 active subscribers within 90 days of launch.
For more on how retail operators use Guest WiFi data to drive footfall, see The Enterprise Guide to Setting Up Guest WiFi: Security, Segmentation, and Speed .
Best practices summary
The SMS marketing best practice framework for venue operators rests on five principles. First, build your list exclusively through first-party, consent-based capture - WiFi login, loyalty sign-up, event registration. Never purchase lists. Second, segment by behaviour, not by demographics. The most predictive variable for return visit likelihood is recency of last visit, not age or gender. Third, automate triggers rather than scheduling manual sends. Triggered messages based on behaviour outperform scheduled broadcast messages on every metric. Fourth, measure return visits as the primary KPI, not open rates or clicks. Fifth, protect your list by capping frequency at four messages per month per subscriber and monitoring unsubscribe rates as an early warning signal.
For a broader view of how your Guest WiFi infrastructure supports marketing and analytics, see our guide on how to make a great first impression with your guest WiFi and the Three SSIDs to rule them all architecture guide.
Troubleshooting and risk mitigation
The most common failure modes in SMS marketing programmes are: list quality degradation, compliance gaps, and attribution blind spots.
List quality degradation occurs when opt-in rates drop and the active subscriber base shrinks faster than it grows. The primary cause is irrelevant messaging. If your unsubscribe rate exceeds 3% on a single send, the message was not relevant to the segment it reached. Review your segment definitions and message content before the next send. A secondary cause is list age - numbers that were valid at capture but are no longer active. Purple's platform flags delivery failures and removes undeliverable numbers automatically.
Compliance gaps most often appear when consent language is updated on the portal but historical records are not auditable. Purple stores the exact consent language displayed at the time of each opt-in, not just a boolean flag. If your legal team needs to demonstrate what a visitor consented to on a specific date, that record is retrievable. Ensure your data retention policy aligns with GDPR Article 5(1)(e) - personal data should not be held longer than necessary. Purple's data management tools support scheduled deletion of inactive profiles.
Attribution blind spots occur when return visits happen through channels other than WiFi reconnection - a shopper who returns but does not connect to WiFi, for example. Supplement WiFi-based attribution with point-of-sale data integration where available. Purple's API supports data export to CRM platforms including Salesforce and HubSpot, enabling cross-channel attribution models.
ROI and business impact
The financial case for SMS marketing via Guest WiFi data is built on three numbers: list build rate, return visit uplift, and revenue per return visit.
At a venue with 500 WiFi logins per day and a 30% SMS opt-in rate, you add 150 new consented numbers daily. In 90 days, that is 13,500 active subscribers. At a 22% return visit uplift (based on Purple internal data from retail deployments) and an average transaction value of £25, a single send to 10,000 subscribers generates approximately 2,200 incremental return visits and £55,000 in incremental revenue - against an SMS delivery cost of approximately £500 at standard A2P rates. That is a 110x return on the send cost alone, before accounting for the lifetime value of reactivated visitors.
SMS delivers between $21 and $41 ROI for every $1 spent across all verticals [Upcity 2023]. For venue operators with high-quality, behaviour-segmented lists built through Guest WiFi capture, the upper end of that range is achievable.
Purple Engage is available on the Engage plan. The Capture plan handles data collection and consent management. Both plans operate as a cloud overlay on your existing hardware estate - Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, or Fortinet - with no hardware replacement required. Purple's 99.999% uptime SLA ensures the capture and delivery infrastructure is available when your venues are busiest.
Key Definitions
Captive portal
A web page displayed to visitors before they are granted access to a WiFi network. Purple's captive portal collects visitor data - including phone numbers with OTP verification - and records consent events at the point of network login.
IT teams encounter captive portals during Guest WiFi configuration. The portal is the primary data capture mechanism for SMS marketing programmes. Its design directly affects opt-in rates and consent quality.
OTP (one-time passcode)
A single-use numeric code sent to a visitor's phone number to verify device ownership during WiFi login. The OTP step confirms that the number entered belongs to the person requesting access.
OTP verification is what distinguishes a verified phone number from a self-reported one. It is the technical mechanism that gives WiFi-captured phone numbers their data quality advantage over other collection methods.
A2P SMS (Application-to-Person)
SMS messages sent from a software application (such as Purple Engage) to a person's mobile number, as opposed to person-to-person (P2P) messaging. A2P traffic is subject to carrier registration requirements, including 10DLC in the US.
All marketing SMS campaigns are A2P. US venue operators must register their A2P sender IDs through 10DLC to avoid carrier filtering. Purple's platform supports 10DLC registration workflows.
10DLC (10-digit long code)
A US carrier registration framework for A2P SMS senders using standard 10-digit phone numbers. Senders must register their brand and campaign use case with The Campaign Registry (TCR) to maintain deliverability on US networks.
US venue operators running SMS marketing campaigns must complete 10DLC registration. Unregistered A2P traffic is filtered by major US carriers. Purple's platform includes 10DLC compliance support.
TCPA (Telephone Consumer Protection Act)
US federal legislation governing automated telephone and SMS marketing. TCPA requires prior express written consent before sending marketing messages to mobile numbers, and mandates clear opt-out mechanisms.
US venue operators must obtain TCPA-compliant consent before adding a visitor to an SMS marketing list. Purple's captive portal consent flow is designed to satisfy TCPA requirements alongside GDPR.
Conscious-choice opt-in
Purple's term for a consent mechanism where the visitor makes an active, affirmative choice to opt in to marketing communications - a standalone checkbox that is not pre-ticked and not bundled with WiFi access terms.
GDPR requires that consent for direct marketing be freely given and unambiguous. A conscious-choice opt-in satisfies this requirement. Pre-ticked boxes and bundled consent do not.
Win-back campaign
An automated SMS campaign triggered when a visitor has not returned to a venue within a defined period (typically 30-90 days). The message is designed to reactivate the lapsed visitor with a relevant offer or reminder.
Win-back campaigns are the highest-ROI SMS campaign type for most venue operators. They target visitors who have demonstrated intent (a previous visit) but have not returned - the most cost-effective re-engagement audience.
Return-visit attribution
The process of matching a subsequent WiFi login from a visitor against a prior SMS send to that visitor's phone number, confirming that the SMS contributed to the return visit. Purple's analytics platform performs this matching automatically within a configurable attribution window.
Return-visit attribution is the metric that connects SMS campaign spend to venue revenue. It is the primary KPI for venue operators and the number that justifies continued investment in the programme.
Lapsed loyalist segment
A visitor segment defined by a combination of historical visit frequency (indicating prior engagement) and a recent gap in visits (indicating lapse). Typically: two or more visits in a 60-90 day window followed by no visit in the subsequent 30-60 days.
Lapsed loyalists are the highest-value re-engagement target for SMS campaigns. They have demonstrated willingness to visit and a relationship with the venue, but have drifted. A relevant, timely message has a high probability of driving a return visit.
First-party data
Data collected directly from visitors through your own venue touchpoints - WiFi login, loyalty sign-up, event registration - with explicit consent. First-party data is owned by the venue operator and is not subject to third-party platform restrictions or data deprecation.
With the deprecation of third-party cookies and increasing restrictions on social media audience targeting, first-party data collected through Guest WiFi is one of the most valuable assets a venue operator can build. Purple's platform is designed to maximise first-party data capture at scale.
Worked Examples
A 150-room hotel group with 8 properties wants to reduce the gap between first-stay guests and repeat bookings. They have HPE Aruba access points across all properties and currently collect guest email addresses at WiFi login but no phone numbers. What is the fastest path to a working SMS win-back programme?
The configuration change is minimal because the hardware is already in place. Step 1: update the captive portal template in Purple Capture to add a phone number field with OTP verification and a standalone SMS marketing consent checkbox. This is a portal template edit - no network or hardware change required. Step 2: set the OTP delivery gateway in Purple Engage (included natively). Step 3: define the win-back segment as guests with no WiFi login at any property in the group for 30 days post-stay. Step 4: write a single win-back message template: '[Hotel name]: We miss you. Book direct for [offer] this [month]. [Short URL]. Reply STOP to opt out.' Step 5: set the trigger in Purple Engage to fire automatically when a guest enters the 30-day lapse window. Step 6: configure the attribution window at 14 days to account for the booking-to-stay lead time. At an average of 150 check-ins per day across 8 properties with a 35% SMS opt-in rate, the group accumulates approximately 52 new consented numbers per day. In 90 days, that is 4,700 active subscribers - enough for a statistically significant first campaign.
A retail chain with 40 stores has been running SMS campaigns for six months but is seeing unsubscribe rates of 4-5% on every send. The marketing team wants to know whether to pause the programme or fix it. What is the diagnosis and the fix?
A 4-5% unsubscribe rate is a clear signal of segmentation failure, not channel failure. The diagnosis is almost certainly one of three things: the chain is sending the same message to the entire list regardless of visit recency; the message content is not relevant to the recipient's last visit context; or the send frequency is too high. The fix follows the same sequence in each case. First, pull the segment breakdown of the last three sends: what percentage of recipients had visited in the last 7 days, 8-30 days, and 31-90 days? If more than 40% of recipients had visited in the last 7 days, they received a win-back message they did not need - that drives opt-outs. Second, split the list into the three core segments (lapsed, regular, first-timer) and write a separate message for each. Third, reduce send frequency to a maximum of two messages per month per subscriber until unsubscribe rates stabilise below 2%. Fourth, A/B test send times: move from the current schedule to the 10am-noon and 5pm-7pm windows and compare unsubscribe rates. The programme should not be paused - pausing loses list momentum and delays the reactivation of lapsed shoppers. Fix the segmentation and resume within two weeks.
Practice Questions
Q1. A conference centre hosts 200 events per year with an average of 500 attendees per event. The venue has Ruckus access points and currently offers Guest WiFi with email-only login. The operations director wants to build an SMS list to drive repeat bookings from attendees. What is the realistic list build timeline, what compliance steps are required before the first send, and what is the highest-value first campaign to run?
Hint: Consider the difference between event attendees (one-time visitors with a specific context) and regular venue visitors. The consent language and the first campaign message should both reflect the event context.
View model answer
List build timeline: at 500 attendees per event, 200 events per year, and a conservative 25% SMS opt-in rate (lower than retail because event attendees are less familiar with the venue brand), the centre adds approximately 125 new consented numbers per event. Over 12 months, that is 25,000 active subscribers - a substantial list. The first viable campaign is achievable within 60 days of portal reconfiguration, assuming the centre hosts at least 10 events in that period. Compliance steps: (1) update the captive portal to add a phone number field with OTP verification; (2) add a standalone SMS consent checkbox with language specific to event-related communications (e.g., 'Tick to receive event updates and exclusive offers from [Venue Name]'); (3) ensure the consent record logs the event ID alongside the timestamp and visitor profile, so future messages can reference the specific event attended; (4) register A2P sender ID if sending to UK mobile numbers through a carrier-registered short code or sender name. First campaign: the highest-value first campaign for a conference centre is a post-event follow-up sent 48 hours after the event, referencing the specific event attended and including a direct booking link for the next relevant event in the same category. This message has the highest relevance score of any campaign type because it references a shared, recent experience. Expected open rate: above 95% given the recency and specificity of the message.
Q2. A stadium operator wants to use SMS to drive pre-match merchandise sales and post-match return visits. The venue has Juniper Mist access points and 40,000 fans connecting to Guest WiFi per match day. The marketing team is concerned about GDPR compliance given the volume of data being collected. What architecture decisions address the compliance concern, and what is the segmentation strategy for a stadium context?
Hint: Stadium fans are a specific vertical noun in Purple's framework. Think about the difference between match-day behaviour (high frequency, predictable timing) and general venue behaviour. The compliance concern is about volume, not complexity - the same rules apply regardless of list size.
View model answer
Architecture decisions for compliance at scale: (1) the OTP verification step is non-negotiable at this volume - it is the audit trail that proves each number was verified at the point of capture; (2) the consent record must log the match ID (or event ID) alongside the timestamp, so the venue can demonstrate that consent was obtained in a specific, identifiable context; (3) implement a data retention policy that automatically flags profiles for deletion after 24 months of inactivity, in line with GDPR Article 5(1)(e); (4) ensure the opt-out suppression list is synchronised across all send campaigns - at 40,000 logins per match day, the volume of potential opt-outs requires automated suppression, not manual management. Purple Engage handles this natively. Segmentation strategy for a stadium: the primary segments are season ticket holders (identified by repeated match-day WiFi logins across multiple fixtures), single-match attendees (one login, no return), and lapsed season ticket holders (regular historical logins, no recent match-day login). The highest-value campaign is a pre-sale SMS to season ticket holders 48 hours before public ticket release for the next fixture - this rewards loyalty and drives direct sales. The second campaign is a merchandise offer sent to single-match attendees 7 days post-match, referencing the specific fixture they attended. At 40,000 logins per match day with a 30% opt-in rate, the stadium adds 12,000 new consented numbers per match. After 10 home fixtures, that is 120,000 active subscribers.
Q3. A marketing director at a 60-location pub group (similar to Stonegate Pubs) has been told by their legal team that their current SMS consent process does not meet GDPR requirements because the opt-in checkbox is bundled with the WiFi terms and conditions. The legal team wants all existing data deleted and the programme paused. The marketing director wants to salvage as much of the existing list as possible. What is the correct course of action?
Hint: GDPR does not require deletion of all data collected under a non-compliant consent mechanism - it requires that you stop processing data for the purpose for which consent was not validly obtained. There is a distinction between pausing the programme and deleting the data.
View model answer
The legal team is correct that bundled consent does not satisfy GDPR Article 7. However, deletion of the entire existing list is not automatically required - it depends on whether there is an alternative lawful basis for holding the data. The correct sequence is: (1) immediately pause all SMS marketing sends to the existing list - do not send another marketing message until the consent issue is resolved; (2) audit the existing consent records to identify any subscribers who may have given valid consent through a separate channel (loyalty sign-up, event registration) that was not bundled with WiFi terms; (3) for the remaining list, assess whether a legitimate interests basis under GDPR Article 6(1)(f) could apply - for a pub group, this is unlikely to hold for direct marketing purposes, so the list should be treated as non-compliant; (4) reconfigure the captive portal immediately with a standalone SMS consent checkbox, separate from the WiFi terms; (5) run a re-consent campaign through a compliant channel (email, if email addresses were separately captured with valid consent) inviting existing contacts to re-opt-in to SMS marketing through the new compliant mechanism; (6) delete all records that do not re-consent within 30 days of the re-consent campaign. The marketing director should frame this to the legal team as a list quality improvement, not a loss - a re-consented list of 10,000 is more valuable than a non-compliant list of 50,000 because every send is defensible.