City council public WiFi providers: procurement routes and what to specify

US local governments usually buy public WiFi in two parts. The cloud platform, meaning captive portal, filtering and reporting, often comes through FedRAMP and GSA Schedule. Access points, installation and backhaul come through a network framework or a contract RFP. Your specification should set coverage, peak concurrency, IWF filtering, Section 508 accessibility and a CCPA/CPRA lawful basis.

Which procurement route should your council choose?

Most city public WiFi projects contain two different purchases. Treating them as one is the most common cause of delay.

The first purchase is a cloud software service. It covers the captive portal, which is the web page a visitor sees before getting online. It also covers authentication, content filtering and reporting. The second purchase is physical: access points on light poles and buildings, power, backhaul, installation and maintenance.

FedRAMP and GSA Schedule fit the first purchase. They cover cloud hosting, cloud software and cloud support. The physical build usually needs a contract vehicle that covers hardware and installation services, or your own competitive bidding process.

A third model sits apart. The supplier funds the build and operation in return for access to city assets and the right to sell advertising or sponsorship. That arrangement may be a concession contract, which carries its own rules. Involve your legal team before you go to market.

Review local and federal procurement regulations before starting a new procurement. Check which regime applies before you write a single requirement.

Where the procurement routes genuinely differ

The table compares the four routes US local governments use most for downtown WiFi procurement.

Route	Covers the cloud platform	Covers access points and installation	Competition required	Time to contract	City control over data and branding	Best suited to
GSA Schedule	Yes	No, cloud services only	No: search, shortlist, direct award	Fastest of the four	High	Replacing the platform on city-owned access points
Cooperative purchasing framework	Yes, within a managed service	Yes	Further competition among framework suppliers	Moderate	High	A full build of a new downtown network
Open RFP procedure	Yes, as specified	Yes, as specified	Full public competition	Slowest, plus required standstill	High	Bundling WiFi with security cameras, sensors or other assets
Vendor-funded concession	Yes, vendor-provided	Yes, vendor-funded	Yes, above the concession threshold	Slow, similar to a RFP	Lower: the vendor monetizes the splash page	Municipalities with no capital budget that accept advertising

Framework lots and expiration dates change. Confirm the current contract structure and end date on the GSA Schedule or FedRAMP websites before you plan a timeline around any purchasing vehicle. Regional purchasing consortia also run contracts with networking lots, so check those against your requirements too.

When FedRAMP and GSA Schedule is the right call

FedRAMP and GSA Schedule suit you when the radio network already exists or you are buying it separately. A typical case is a city government that owns access points from an earlier project and whose platform contract is ending. You need a new captive portal, filtering and reporting layer on top of the existing hardware.

How a GSA Schedule purchase runs

1. Write down your requirements before you search, including filtering, ADA and Section 508 accessibility, and reporting needs.
2. Search the purchasing portal with keywords that match those requirements, such as "guest WiFi" and "captive portal".
3. Save and export your search results. They form your audit trail.
4. Filter and shortlist against your requirements, asking vendors clarification questions where a service description is unclear.
5. Evaluate the shortlist on price and quality, then direct award using the contract schedule.

You buy each service as its vendor describes it on the portal. You cannot add requirements after award. If IWF filtering, ADA and Section 508 conformance or US data hosting matter to you, check that the service description states them in writing.

Why hardware compatibility decides the shortlist

A platform that only works with one vendor's access points forces a hardware swap you did not budget for. Purple's Guest WiFi runs as a hardware-agnostic cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. A platform change therefore leaves the radio estate in place. For the full case, read why your next WiFi upgrade doesn't need new hardware. If your downtown area runs on FortiGate firewalls, see our guide to FortiGate captive portal setup with an external portal server.

When a network contract or your own RFP is the right call

A new build involves light pole surveys, power connections, DOT permits, backhaul and a maintenance regime. FedRAMP and GSA Schedule cover none of that. A competitive bidding process under a network contract lets you set your own specification and evaluation weighting among pre-qualified vendors.

Run your own procedure when no framework fits. The same applies when you want to combine WiFi with CCTV, smart city sensors or small cell infrastructure on shared street assets. Under federal and local procurement standards, you publish a solicitation notice on SAM.gov or state procurement portals. You then assess bids against published award criteria and send each bidder an assessment summary. A standstill period follows before you sign.

Federal and state procurement guidelines require you to consider economic, social, and environmental wellbeing when procuring services above the threshold. Give community value a weighting and ask for measurable commitments, not statements.

Worked scenario: splitting a downtown precinct purchase (illustrative figures)

Situation. A town council wants free public WiFi along a 600-meter pedestrianized main street and inside its covered market hall. It owns municipal CCTV fiber along the street but has no access points. Its own people counters show around 8,000 visitors in the zone on a peak Saturday.

What was done. The council split the purchase in two. It bought access points, mounting, and installation through a framework further competition, with a post-installation validation survey as a payment milestone. It then bought the cloud platform through FedRAMP and GSA Schedule and made hardware compatibility a pass or fail shortlist criterion. To size capacity, it assumed 25% of peak visitors would connect, and that 60% of those would be online at the same moment.

Outcome. The arithmetic gave a written capacity requirement: 8,000 x 25% x 60% = 1,200 concurrent devices at peak. Every bidder priced against the same 1,200-device figure, so bids were directly comparable. Because the two purchases were separate, the council could replace the platform later without touching the radio network.

What should a council public WiFi specification include?

A good specification states outcomes you can test at handover. Avoid vendor model numbers. Specify what the network must do and how you will measure it.

Coverage

Define the coverage zone on a map and mark the indoor spaces, such as market halls, libraries, and bus stations. Require a predictive design survey before installation and a validation survey afterwards, both against a minimum signal level agreed in the design. Our guide to WiFi site surveys explains what each survey should deliver. Specify outdoor-rated access points with an ingress protection rating under IEC 60529 that suits street mounting. Require structural assessment of any light pole used.

Specify WiFi 6 (IEEE 802.11ax) or later. It handles dense crowds better than older standards, which matters on market days and at events.

Concurrency and capacity

State peak concurrent devices per zone, as in the worked scenario above. Set a minimum per-device throughput and an event-day uplift for parades, markets and festivals. Specify backhaul capacity that matches the peak, not the average. Require per-device bandwidth limits so one visitor cannot saturate a zone.

Content filtering and safe browsing

Every US public WiFi network should block malicious domains and explicit content. Ensure url filtering updates automatically multiple times a day. Make it a mandatory requirement on every SSID, with no visitor-side opt-out.

Go further and require family-friendly filtering certification. As a minimum, it requires blocking of adult and pornographic content. Add any further categories your city or county decides, such as malware and phishing sites. Require a documented process for reviewing sites blocked in error.

Accessibility

The ADA and Section 508 cover public sector web properties. Your captive portal is a municipality-branded web page, so specify WCAG 2.2 level AA conformance and a published accessibility statement. Require the portal to work with screen readers and at 400% zoom. It should not depend on a CAPTCHA, and it should offer at least one login route that needs no social media account.

Consider Passpoint (also called Hotspot 2.0) and OpenRoaming. Both are industry standards that let a device join a WiFi network automatically, using credentials it already holds. Returning visitors then skip the portal entirely, which helps anyone who finds web forms difficult.

Compliance, CCPA/CPRA, and the TCPA and CAN-SPAM

Under state privacy laws like CCPA/CPRA, public entities must ensure transparent data collection practices. For running the WiFi service itself, establish clear terms of service. Your data privacy officer or legal counsel should confirm it. Any electronic marketing needs opt-in consent under the TCPA and CAN-SPAM. That means unchecked boxes and conscious-choice opt-ins, kept separate from the terms of use.

State privacy regulations require a privacy risk assessment for systematic monitoring of a publicly accessible area on a large scale. Traffic reporting across a downtown area falls squarely within that description. Complete the privacy impact assessment before you award the contract.

In most models, the municipality is the business (data controller) and the supplier is its service provider (data processor). Specify retention periods, US data hosting, and data return on exit. If a sponsor will receive any data, map the business relationship before launch. Purple holds ISO 27001 and Cyber Essentials certification, is GDPR and CCPA compliant, and is a certified B Corp.

Security and service levels

Most public WiFi runs as an open network behind a captive portal. Specify client isolation, so devices on the network cannot reach each other. Where the access points support it, specify Opportunistic Wireless Encryption (OWE), certified as Enhanced Open, which encrypts traffic on open networks without a password.

Set a platform uptime target with service credits, plus response times by fault severity. Purple's platform runs at 99.999% uptime. Require an exit plan that returns your data in a standard format and leaves the access points usable with another platform.

What city public WiFi costs to run, and who pays

Budget across three cost lines. Capital covers access points, mounting, backhaul installation and surveys. Recurring costs cover platform licenses, backhaul circuits, power, maintenance and support. Periodic costs cover the hardware refresh at the end of the access points' working life. Many projects fund the capital and forget the recurring line, and the network degrades within a few years.

Funding model	Who pays	Municipality control	Best when
City capital and revenue budget	The city	Full control of branding, data and filtering	You want WiFi as public infrastructure with no advertising
Business Improvement District (BID) levy	Levy-paying businesses through the BID	Shared with the BID board	A BID already funds main street improvements in the zone
Federal or State Grant allocation	Central government, through your local investment plan	Full, within grant conditions	Your investment plan covers downtown improvements
Splash page sponsorship	A named local sponsor	High: you approve sponsor content	A local employer or developer wants civic visibility
Supplier-funded concession	The supplier, recovered through advertising	Lower: the supplier controls monetization	You have no capital budget and accept advertising

Sponsor and advertising content on a portal falls under FTC advertising guidelines. Write approval rights into the contract. Grant-funded projects should check that recurring costs remain eligible, or that revenue funding exists once the grant ends.

How do cities measure downtown foot traffic with WiFi?

WiFi gives economic development teams two data sources, and they differ in reliability.

Connected sessions come from visitors who log in through the captive portal. They give accurate counts of visits, dwell time, time of day and, where a visitor has opted in, repeat visits. This is your most dependable foot traffic data.

Presence detection counts devices that search for WiFi without connecting. Since iOS 14 and Android 10, cell phones use randomized MAC addresses by default. A single cell phone can therefore appear as several devices. Treat presence counts as trend indicators, not headcounts, and calibrate them against fixed people counters where you have them.

The FTC and state attorneys general treat MAC addresses as potentially personal data. Put signage at the edge of the coverage zone and in your privacy notice explaining what you collect and why.

Report the measures a main street board can act on: weekly visits, average dwell time, return rate, evening economy activity, zone-by-zone comparisons and event uplift. Purple's WiFi Analytics presents these as dashboards your team can share with BIDs and traders. Purple recorded 440 million logins across its network in 2024, according to its own data. The same reporting model serves retail estates and shopping centers.

Worked scenario: measuring a festival weekend (illustrative figures)

Situation. A city center runs a two-day food festival. The economic development team needs to show traders and the BID whether the event drew people into the core shopping streets, and for how long.

What was done. The team took connected sessions from the four Saturdays before the festival as a baseline. They then compared the festival Saturday by zone, separating the festival site from the surrounding retail streets.

Outcome. On these illustrative numbers, the baseline averaged 2,400 connected visits and the festival Saturday recorded 3,600. That is a 50% uplift: (3,600 - 2,400) / 2,400. Average dwell time rose from 38 to 61 minutes. The zone split showed that most of the extra visits stayed inside the festival site, which shaped next year's route planning.

How should you judge public WiFi suppliers on evidence?

Score suppliers on what they can prove. A claim with no document behind it scores zero.

What they claim	Evidence to request	Red flag
Scale and experience	Live venue count, references at comparable public spaces	Only case studies with no named sites
Reliability	Uptime history and SLA with service credits	Uptime target with no credits attached
Security	ISO 27001 certificate and its scope, Cyber Essentials certificate	Certificate scope excludes the service you are buying
Content filtering	IWF list membership or Friendly WiFi accreditation	"We filter adult content" with no named list
Accessibility	ADA and Section 508 audit report and accessibility statement	No audit, or an audit of an older version
Data protection	Template DPIA, service provider terms, data hosting location	Marketing consent bundled into terms of use
Hardware compatibility	Named access point vendors, with integration documentation	Platform tied to one hardware vendor
Footfall reporting	Sample reports, explanation of how MAC randomization is handled	Presence counts sold as exact headcounts
Exit	Written exit plan and data export format	No data return commitment

Purple runs guest WiFi across 80,000+ live venues in over 90 countries. Our transport customers include c2c Rail and Avanti West Coast, covered on our trains page. For hospitality references, see hotels. To compare portal platforms side by side, read Cloud4Wi alternatives: captive portal platforms compared.

City public WiFi specification checklist

Copy these into your requirements document as testable statements.

Procurement

• Cloud platform and physical build scoped as separate lots or purchases
• Regime confirmed: State or federal procurement guidelines and legacy rules
• Social value weighting and measurable commitments defined
• Contract term, renewal options and exit plan stated

Coverage and capacity

• Coverage zone mapped, indoor spaces marked
• Predictive design survey and post-installation validation survey required
• WiFi 6 (IEEE 802.11ax) or later, outdoor-rated access points
• Peak concurrent devices per zone stated, with event-day uplift
• Minimum per-device throughput and backhaul capacity stated

Filtering and security

• Content filtering URL List blocked on every SSID
• Friendly WiFi accreditation required
• Additional filter categories listed, with a process for reviewing sites blocked in error
• Client isolation enabled, OWE where supported

Accessibility

• Captive portal conforms to the ADA and Section 508
• Accessibility statement published
• Login route available with no social media account
• Passpoint or OpenRoaming support for automatic reconnection

Data protection

• Lawful basis documented for each processing purpose
• Risk assessment completed before contract award
• Marketing consent separate, unchecked and the TCPA and CAN-SPAM compliant
• Data processor terms, retention periods and US hosting or adequacy basis
• Coverage zone signage and privacy notice in place

Reporting and service

• Connected visits, dwell time, return rate and zone comparisons in standard reports
• Presence data labeled as estimates
• Uptime SLA with service credits and fault response times
• Data export in a standard format on exit

How to decide for your downtown area

Answer three questions in order. Do you already own working access points? If you do, FedRAMP and GSA Schedule is usually the fastest route to a new platform. Do you need a new physical network? Then use a framework further competition, or your own procedure if you are bundling other street assets. Do you lack capital funding? Weigh BID, grant and sponsorship options before you accept a concession, because a concession hands control of the splash page and its data to the supplier.

Whichever route you take, specify outcomes you can test at handover: coverage, concurrency, content filtering, the ADA and Section 508 and a documented lawful basis.

Frequently asked questions

How do local governments procure public WiFi?

Cities and local governments usually procure public WiFi in two parts. The cloud platform, covering captive portal, filtering and reporting, is often bought through FedRAMP and GSA Schedule. Access points, installation and backhaul are bought through cooperative purchasing agreements, state contracts, or an RFP process. Some municipalities use supplier-funded concessions instead, where advertising pays for the network.

Can public WiFi be bought through FedRAMP and GSA Schedule?

Yes, the cloud software part can be bought through FedRAMP and GSA Schedule. Captive portal, authentication, content filtering and reporting services are listed on federal schedules, and you can direct award after searching and shortlisting. Federal schedules do not cover physical access points, mounting, power or installation, so a new build needs a separate purchase. Check each service description carefully, because you cannot add requirements after award.

What content filtering does US public WiFi need?

US public WiFi should block the Internet Watch Foundation URL List and CIPA-compliant categories, which identify webpages hosting child sexual abuse imagery and inappropriate material. Most local governments also enforce strict pornography blocking as their minimum. You can add categories such as malware and phishing. Require a documented process for reviewing sites blocked in error, so legitimate services stay reachable for residents and visitors.

How do cities measure downtown footfall with WiFi?

Cities measure footfall through connected sessions and presence detection. Connected sessions from portal logins give accurate visit counts, dwell time and repeat visits where visitors opt in. Presence detection counts devices searching for WiFi, but MAC address randomization since iOS 14 and Android 10 makes those counts estimates. Report connected data as your primary measure and calibrate presence trends against fixed people counters.

Can we keep our existing access points if we change provider?

Yes, if the new platform is hardware-agnostic. Purple runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet access points. Changing platform then means reconfiguring the existing network to point at the new captive portal, not replacing hardware. Ask any bidder to name the vendors they support and provide integration documentation for yours.

What legal basis should a municipality use for public WiFi data?

Most municipalities align with state privacy regulations and CCPA/CPRA frameworks to run the WiFi service. Electronic marketing needs separate consent under the TCPA and CAN-SPAM, collected with unchecked boxes. Complete a Privacy Impact Assessment before launch, because downtown footfall reporting counts as systematic monitoring of a publicly accessible area.

Can sponsorship or advertising fund free public WiFi?

Yes, sponsorship and advertising can fund free public WiFi, with trade-offs. A named sponsor on the splash page keeps city council control high if you retain approval rights over content. A supplier-funded concession can cover build and running costs, but the supplier controls monetization of the portal. Advertising content must comply with FTC guidelines, and any data shared with a sponsor needs a clear controller relationship.