Airport and transit hub guest WiFi platforms: Passpoint roaming and multilingual portals compared

Most airports should run both. Passpoint, including OpenRoaming and airline loyalty profiles, connects returning passengers automatically over an encrypted link. A multilingual captive portal serves everyone else and captures consented first-party data. Three factors decide which side leads: your passenger mix, your data goals and whether your access points support Hotspot 2.0.

Which airport guest WiFi platform model should you choose?

Choose a hybrid, then decide which side leads. A Passpoint-led design puts automatic, encrypted connection first. A portal-led design puts consented first-party data and multilingual messaging first. Both run on the same access points, so this is an operating decision rather than a hardware one.

Three terms frame any airport guest WiFi platform comparison:

• Passpoint is an industry certification built on IEEE 802.11u, also called Hotspot 2.0. A device with a stored credential finds a Passpoint network and joins it without a login screen.
• OpenRoaming is a federation run by the Wireless Broadband Alliance (WBA). It uses Passpoint so one credential, from a phone maker, carrier or app, works at every participating venue.
• A captive portal is the web page a passenger sees on an open network before getting online.

Passpoint authenticates with IEEE 802.1X, the port-based access control standard behind enterprise WiFi. Credentials travel inside EAP (Extensible Authentication Protocol) to a RADIUS server. RADIUS is the protocol that checks credentials and returns session rules, such as time and bandwidth limits.

Purple delivers Guest WiFi as a cloud overlay on access points from Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. The same platform supports OpenRoaming and multilingual captive portals. It runs across 80,000+ live venues in over 90 countries and handles 500 million users and logins a year. Transport customers include AGS Airports and Manchester Airports Group.

Where do Passpoint roaming and multilingual portals genuinely differ?

The two models differ on the axes that matter in a terminal: friction, encryption, data, interface obligations and hardware. The table sets them side by side, alongside the hybrid most terminals end up running.

Axis	Passpoint and OpenRoaming	Multilingual captive portal	Hybrid (both)
How the passenger connects	Automatically, no screen, after a one-time profile install	Joins an open SSID and completes a login page	Profile holders join automatically; everyone else uses the portal
Over-the-air encryption	WPA2-Enterprise or WPA3-Enterprise via 802.1X	None on open SSID; per-session with Enhanced Open (OWE)	Enterprise on Passpoint SSID; OWE on portal SSID
First-party data returned	Identity provider realm only, no marketing consent	Email, language preference, conscious-choice opt-ins	Consented data from portal passengers; session data from both
Language handling	None needed, no interface shown	Accept-Language detection plus manual switcher	Portal handles languages; Passpoint needs none
Accessibility exposure	No interface to audit	Full Section 508 and ADA audit and statement	Portal audit only
Core standards	IEEE 802.11u, Passpoint, 802.1X, EAP, RadSec (RFC 6614)	RFC 8910, RFC 8908, Section 508, CCPA/CPRA, the TCPA and CAN-SPAM	All of the above
Access point requirement	Hotspot 2.0 support in AP and controller firmware	External captive portal redirect	Both capabilities on one estate
Analytics identifier quality	Stable for the session, tied to an authenticated credential	Stable for the session; randomized MAC between visits	Widest coverage of connected devices
Who it suits	Hubs with many frequent flyers on app-equipped airlines	Leisure, charter and first-time international traffic	Most airports and major rail interchanges

Three differences drive most decisions.

Data. Passpoint tells you which identity provider authenticated a device, such as an airline realm or an OpenRoaming provider. It returns no email address and no marketing consent. If your commercial team needs consented first-party data for concession campaigns, only the portal delivers it.

Encryption. Passpoint runs on WPA2-Enterprise or WPA3-Enterprise, so it encrypts every session from the first frame. An open portal SSID carries no over-the-air encryption unless you enable Enhanced Open, also called Opportunistic Wireless Encryption (OWE, RFC 8110). Use OWE transition mode so older devices still connect.

Obligations. A Passpoint connection shows no screen, so you have nothing to translate or audit. A portal is a public-facing web page and carries both duties in full.

How do airports combine OpenRoaming, airline Passpoint profiles and a fallback portal?

The two-SSID pattern

A common terminal design broadcasts two passenger networks. The first is a Passpoint SSID secured with WPA2-Enterprise or WPA3-Enterprise. The second is an open or Enhanced Open SSID that redirects to the captive portal. Devices holding a matching profile join the first automatically, and every other device sees the second.

The Passpoint SSID advertises several identifiers at once. A Roaming Consortium Organisation Identifier (RCOI) names a federation such as OpenRoaming. A Network Access Identifier (NAI) realm names a single identity provider, such as an airline's domain. The device queries these through the Access Network Query Protocol (ANQP) before it associates. It joins only if it holds a matching credential.

How realm routing works

When a device authenticates, the RADIUS layer reads the realm in its outer identity and routes the request. OpenRoaming requests travel over RadSec, which is RADIUS over TLS (RFC 6614), to the federation's identity providers. An airline realm routes to the airline's own authentication server under a bilateral agreement. You never see the passenger's password or certificate. You receive an accept or reject, plus the session rules.

This is how an airline loyalty profile works in practice. The airline's app installs a Passpoint profile through Apple's NEHotspotConfiguration or Android's PasspointConfiguration interfaces. The profile carries the airline's realm and a credential, often a certificate for EAP-TLS. EAP-TLS is mutual certificate authentication, the strongest widely deployed EAP method. At any airport advertising that realm, the cell phone joins without a prompt.

Turning first-time passengers into Passpoint passengers

The portal is also the on-ramp. After a passenger completes the portal login, offer an optional profile download so the next visit is automatic. Explain the offer in plain language. Signpost help-desk staff to a general explainer such as How do I get on WiFi: Home, hotel and work networks for passengers who struggle.

Devices that support RFC 8910 learn the portal address from DHCP or router advertisements. They then query the Captive Portal API defined in RFC 8908. This replaces fragile redirect tricks with a standard signal, so implement it where your access points allow.

Keep staff off passenger networks

Airline, retail and airport staff should never share passenger SSIDs. Purple Staff WiFi authenticates employees against Microsoft Entra ID, Okta or Google Workspace. It places them on separate VLANs, virtual LANs that isolate traffic. Contractors and visiting crew bring unmanaged devices, covered in BYOD WiFi Onboarding: Managing Unmanaged Devices in Hotels and Retail.

When is a Passpoint and OpenRoaming-led design the right call?

Lead with Passpoint when automatic connection is worth more to you than a captured email address. Four situations point that way:

• Frequent flyer share. A large share of your passengers fly one or two hub carriers whose apps can install profiles.
• Short connection windows. Transfer passengers and rail interchanges leave little time for forms. The same logic applies to stations and onboard networks, covered on our Trains page.
• Security posture. Your IT team requires every passenger session encrypted over the air, with no open SSID traffic.
• Portal friction at peak. Help desks field login complaints during morning departure banks.

Airport hotels extend the benefit. A hotel advertising the same OpenRoaming RCOI lets guests stay connected from gate to room without a second login. Our Hotels page and the Hotel guest WiFi platforms: PMS integration, Passpoint and tiered bandwidth compared guide cover that side.

Watch profile adoption. OpenRoaming reach depends on which identity providers ship credentials on your passengers' cell phones. Measure the share of sessions arriving via Passpoint each month. Do not retire the portal on assumptions.

When is a multilingual captive portal-led design the right call?

Lead with the portal when reach and first-party data matter more than zero-touch connection. Four situations point that way:

• Leisure and charter traffic. Many first-time and international passengers hold no matching profile.
• Commercial objectives. Concessions, parking lots and duty-free teams want consented contacts gathered through conscious-choice opt-ins.
• Operational messaging. You want to show gate information, wayfinding or assistance booking in the passenger's language at the moment of connection.
• Hardware limits. Your access points lack Hotspot 2.0 support. The portal works now, and Passpoint can follow at refresh.

Design the portal for a terminal, not a café. Keep login to one step and offer free access without requiring marketing consent. CCPA/CPRA rules treat consent tied to a service as unlikely to be freely given. Portals often open in a restricted mini-browser, so keep pages light and avoid third-party scripts and pop-ups.

What session-timeout, language-detection and accessibility standards apply to terminal passenger WiFi?

No single standard sets airport WiFi session lengths. Three bodies of rules shape the design: RADIUS attributes for session control, web standards for language, and accessibility law for the portal.

Session timeouts

RFC 2865 defines the RADIUS Session-Timeout and Idle-Timeout attributes. Session-Timeout caps total session length. Idle-Timeout ends a session after a period of inactivity. Set both against measured dwell, not habit. With 90 minutes of airside dwell and a 30-minute session, every passenger logs in three times.

On the Passpoint SSID, re-authentication is silent, so a shorter session costs nothing in friction. Use it to refresh policy and bandwidth limits. On the portal SSID, recognize returning devices for a defined window. A passenger reconnecting after security should not repeat the form. State any time or data limits on the portal before the passenger connects.

Language detection

Every browser sends an Accept-Language header listing the device's preferred languages, defined in RFC 9110. Use it to select the portal language automatically. Do not infer language from IP address or SIM country: a Spanish speaker roaming on a US SIM still wants Spanish. Always show a visible language switcher, with each language named in its own script.

W3C internationalization guidance advises against flags in switchers, because flags represent countries, not languages. Declare the page language in HTML, as Section 508 and WCAG success criterion 3.1.1 require. Support right-to-left layouts for Arabic and Hebrew. Choose languages from your route network and passenger data, not a generic list.

Accessibility

The benchmark is WCAG 2.2 level AA, published by the W3C in October 2023. Two criteria new in 2.2 bite on portals. Success criterion 3.3.8, Accessible Authentication (Minimum), bars cognitive tests such as puzzle CAPTCHAs without an alternative. Success criterion 2.5.8, Target Size (Minimum), sets a 24 by 24 CSS pixel floor for tap targets. Body text needs a contrast ratio of at least 4.5:1 under criterion 1.4.3.

In the United States, the ADA and Section 508 apply to public sector entities and public accommodations. Publicly owned operators must meet them and publish an accessibility statement. In the EU, the European Accessibility Act (Directive (EU) 2019/882) has applied since June 28, 2025. It covers websites and mobile services for air, bus, rail and waterborne passenger transport. Ask your counsel whether your portal falls in scope, and design to WCAG 2.2 AA either way.

How does zone-level WiFi telemetry feed terminal queue and concession dwell dashboards?

From access points to zones

Every access point sees which devices associate with it, and many also see devices probing nearby. Group access points into zones that match operational areas: landside check-in, security entry, airside plaza, each pier and each gate cluster. Vendor interfaces such as the Cisco Meraki Scanning API expose presence data. WiFi Analytics turns it into zone counts, dwell times and movement between zones.

Queue time proxies

Take the interval between a device's last sighting in the pre-security zone and its first sighting airside. That interval approximates end-to-end security processing time. Aggregate intervals into rolling medians and the dashboard shows queue trend in near real time. Treat it as a trend indicator, not a lane-level measurement. Overhead sensors measure individual lanes more precisely. WiFi adds terminal-wide context without new sensors, because the access points already exist.

Concession dwell

Airside dwell is the time passengers have available to spend. Zone telemetry shows how long devices stay in the plaza versus moving straight to the pier. Join that with concession sales by hour to compare spend against available dwell. Purple applies the same approach in Retail, with zones mapped to departments instead of units.

Data quality and privacy

Since iOS 14 and Android 10, devices present a randomized MAC address by default, which differs per network. Counting probes alone therefore double-counts some devices and misses others. Associated sessions, and Passpoint sessions above all, give steadier identifiers for the length of a visit.

CCPA/CPRA regulations require a data protection impact assessment for large-scale systematic monitoring of publicly accessible areas. Complete it before go-live. Aggregate to zone level for dashboards and set short retention for device-level records. State the purpose on the portal and on terminal signage.

Worked scenarios: a regional airport and an airside concession estate

These examples use illustrative figures. Replace them with your own baseline before you build a business case.

Scenario 1: a city-owned regional airport

Situation. A city-owned regional airport handles 8,000 departing passengers a day. Assume 60% connect, so 4,800 devices a day. It ran one open SSID, an English-only portal and a 30-minute session timeout. Median airside dwell is 90 minutes. As a public sector body, it must adhere to the ADA and Section 508.

What the team did. The team added a Passpoint SSID advertising OpenRoaming and the realm of its largest based airline. It rebuilt the portal in six languages chosen from the route network, with Accept-Language detection and a manual switcher. An external auditor tested the portal against Section 508 standards. The team set a three-hour Session-Timeout and recognized returning devices for the rest of the day.

Outcome. Assume 25% of connecting devices move to Passpoint within a year. Portal logins fall from 4,800 to 3,600 a day, and 1,200 devices connect with no screen at all. The longer session removes two forced re-logins per passenger, which means 9,600 fewer login screens a day. The airport also demonstrates compliance with the ADA and Section 508 backed by an independent audit.

Scenario 2: an airside concession operator

Situation. A concession operator runs 14 units across an airside plaza and two piers. It could see sales by hour but not how long passengers had before boarding.

What the operator did. The operator mapped access points into four zones: security exit, plaza, Pier A and Pier B. It joined hourly zone dwell from WiFi Analytics with hourly register data. It defined one metric: transactions per 100 connected devices per zone per hour.

Outcome. In the morning bank, 1,200 devices clear security in an hour, with a median plaza dwell of 42 minutes. In the evening bank, 900 devices clear, with a median of 18 minutes. The operator moved two staff from table service to grab-and-go units for the evening bank. If evening transactions per 100 devices rise from nine to 12, that is a 33% lift on the same volume. The same dashboard measures it.

What does each model cost to run?

Neither model needs new access points on supported hardware, as Why your next WiFi upgrade doesn't need new hardware explains. The running costs sit elsewhere.

Cost line	Passpoint and OpenRoaming	Multilingual captive portal	One-time or recurring
Access points	Hotspot 2.0 support confirmed per model and firmware	External portal redirect on existing APs	One-time compatibility check
Authentication	Cloud RADIUS with RadSec to federation and airline realms	Cloud RADIUS for session control	Recurring platform subscription
Certificates	OpenRoaming certificate under the WBA's PKI	TLS certificate for the portal domain	Recurring at each expiration
Partner agreements	Terms with each airline or identity provider	None	Recurring legal review
Translation	None, no interface	Every language, every content change	Recurring with each change
Accessibility	No interface to audit	Section 508 and WCAG 2.2 AA audit and published statement	One-time audit, retest after changes
Data protection	DPIA covering analytics	DPIA, consent records, retention schedule	Recurring annual review
Help desk load	Profile installation queries	Login and language queries at peak	Ongoing staff time

The portal carries more recurring content work, mostly translation and accessibility retesting after each change. Passpoint carries more partner and certificate administration. A hybrid carries both, but each side carries less load than it would alone.

How to decide for your transport hub portfolio

Map your situation to a lead model, then follow the steps below.

Your situation	Lead with	Why
Most passengers fly one or two hub carriers with loyalty apps	Passpoint, airline realms first	Apps already hold identity, so joining is automatic
Mostly leisure and first-time international passengers	Multilingual portal, OpenRoaming secondary	Few hold profiles; the portal reaches everyone in their language
Commercial team needs consented marketing contacts	Portal	Passpoint returns no consent
You are a public sector body under government accessibility regulations	Portal audited to Section 508 and WCAG 2.2 AA, plus Passpoint	Legal duty sits on the portal; Passpoint reduces its load
Rail interchange with short dwell	OpenRoaming with a one-step portal	Dwell is too short for long forms
Access points lack Hotspot 2.0 support	Portal now, Passpoint at refresh	Avoids early hardware spend

1. Measure your baseline. Record daily connections, dwell by zone and help-desk login queries.
2. Audit hardware. Confirm Hotspot 2.0 support on every access point model and controller firmware version.
3. Choose identity providers. Decide which federations and airline realms to accept, and start partner agreements early.
4. Set timeouts from data. Align Session-Timeout and Idle-Timeout with measured dwell.
5. Run compliance in parallel. Commission the accessibility audit and the privacy impact assessment alongside network configuration, not after it.
6. Review quarterly. Watch the Passpoint share of sessions and rebalance portal investment as it grows.

Purple is ISO 27001, Cyber Essentials and B Corp certified, compliant with CCPA/CPRA, and runs at 99.999% uptime.

Frequently asked questions

Does Purple work with the access points already installed in our terminal?

Yes, Purple runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet access points. You keep your existing hardware. For Passpoint and OpenRoaming, confirm with your vendor that your access point models and controller firmware support Hotspot 2.0. A captive portal needs external redirect support on those same platforms.

Do we have to join the Wireless Broadband Alliance to offer OpenRoaming?

No, venues can join OpenRoaming through a platform provider rather than directly. The provider holds the federation agreement and the certificates issued under the WBA's public key infrastructure. It also routes authentication over RadSec. You still decide which identity providers to accept and which OpenRoaming tiers to offer. Review the WBA's OpenRoaming policy with your legal team before launch.

What happens to passengers whose cell phones have no Passpoint profile?

They join the open or Enhanced Open network and see the captive portal, in their device language where you offer a translation. The portal can offer an optional profile download after the first login, so the next visit connects automatically. Keep free access available without marketing consent, because privacy regulations require consent to be freely given.

Is zone-level passenger WiFi analytics compliant with CCPA/CPRA?

Yes, when you design it for compliance from the start. Run a privacy impact assessment, because privacy regulations require special handling for large-scale systematic monitoring of publicly accessible areas. Aggregate dashboards to zone counts and dwell medians, and set short retention for device-level records. Publish a clear notice on the portal and terminal signage. Purple is ISO 27001 certified and CCPA/CPRA compliant.

Should we drop the captive portal and run a Passpoint-only network?

No, not at an airport. A Passpoint-only network excludes every passenger without a compatible profile, whatever their airline or country. It also removes your only route to consented first-party data and language-specific messaging at connection. Run Passpoint as the fast lane and keep the portal as the universal fallback. Review the balance each year as profile adoption grows.

How is Purple licensed for a transportation hub?

Purple licenses through three plans: Connect, Capture and Engage. The right plan depends on whether you need connection only, consented first-party data capture, or engagement with passengers after they connect. Because Purple is hardware-agnostic, you buy no new access points on supported Cisco Meraki, HPE Aruba, Ruckus or Juniper Mist estates. Ask Purple for a quote scoped to your terminals.

How much work is a terminal deployment?

Less than a hardware project, because you replace nothing. The work sits in four streams. You confirm Hotspot 2.0 support and configure the Passpoint SSID, and you agree realms with airline partners. You also build and audit the multilingual portal, then map access points to zones for analytics. Partner agreements and the accessibility audit usually set the timeline, not the network configuration.