TL;DR / Key Takeaways
- Guest WiFi is the visitor-facing wireless surface of a venue. Distinct from staff WiFi (managed devices, strong authentication) and multi-tenant WiFi (long-term residents with device discovery).
- Four delivery models: software overlay on existing access points, fully managed, MSP-bundled, ISP-bundled. The software-overlay model is the most common in mid-market and enterprise.
- The captive portal is the join surface, the marketing capture, and the analytics anchor. The five companion pillar guides cover each layer in depth.
- Compliance posture is part of the platform, not an afterthought. CCPA consent, PCI DSS network segmentation, lawful-intercept logging, and WCAG 2.2 accessibility all ship as defaults.
- Choosing a provider is six tests: hardware compatibility, CRM integration, analytics depth, compliance posture, support SLA, transparent pricing. The 80,000-venue platform is a different question to the single-venue one.
Guest WiFi sits at an awkward crossroads. IT owns the connectivity, marketing owns the capture, operations owns the experience, finance owns the procurement, and the visitor just wants to get online - the same simple goal behind World WiFi Day, the global celebration of connectivity for everyone. Most platforms in the category were designed to address one of those buyers and tolerated the rest. The result is a procurement conversation that often misfires.
This guide is the master reference. The five sibling pillar guides cover the layers in depth - captive portal mechanics, marketing program design, analytics methodology, enterprise security, and multi-tenant residential. This page is the connecting tissue, the one a buying committee can read together to agree what they are actually procuring.
The structure: what guest WiFi is (and is not), the four delivery models, how it relates to the rest of the platform, the compliance shape that actually works, the choice criteria, and an honest set of FAQs for the procurement conversation.
What guest WiFi is - and what it is not
Three things in the same building, all called WiFi, all doing different jobs.
| Dimension | Guest WiFi | Staff WiFi | Multi-tenant WiFi |
|---|---|---|---|
| Audience | Transient visitors | Known employees and contractors | Long-term residents |
| Authentication | Captive portal (email, social, SMS, click-through) | 802.1X, EAP-TLS, iPSK against IdP | iPSK per resident, ongoing |
| Session length | Minutes to hours | Persistent on managed devices | Years |
| Device discovery | Isolated by default | Per-role segmentation | Per-resident WiFi-bubble |
| Internal access | Never | Yes, scoped by role | No (private to resident) |
| Marketing capture | Primary purpose | Not applicable | Not applicable |
Most venues need at least two of these in parallel. A typical retail estate runs guest WiFi for shoppers and staff WiFi for the back-of-house team on the same access points, segmented by SSID and VLAN. A residential building adds multi-tenant for residents and runs guest WiFi for delivery drivers and contractors. The architectural rule is one platform, multiple SSIDs, each with its own authentication model.
The four delivery models
How guest WiFi is bought, paid for, and operated. The right model depends on the existing AP estate, the in-house IT capability, and the marketing ambition.
Software overlay (BYO hardware)
Purple software runs on the access points you already own. The most common model in mid-market and enterprise. Per-site or per-AP subscription.
Fully managed
Purple-supplied access points plus software plus support, billed per site per month. Operational simplicity at the price of a longer commitment.
MSP-bundled
Your IT services partner resells Purple inside a broader managed-IT contract. Day-to-day operations and support sit with the MSP.
ISP-bundled
A basic captive portal included with a broadband contract. Limited analytics, limited marketing, limited integrations. Usually the lowest cost and the lowest ceiling.
The five layers on top of the connectivity
Guest WiFi as connectivity is solved. The value of the platform is in what sits on top of it: how the visitor signs in, what marketing program runs against the captured records, what analytics the venue gets, how the staff network is authenticated next door, and how the residential variant is run in residential buildings. Each has its own pillar guide.
Pricing models and ROI framing
Guest WiFi pricing splits into three honest models. Per-site subscription (Purple, most predictable), per-AP subscription (some competitors, scales with venue size), and per-sign-up or per-MAC pricing (legacy and usually punitive). The marketing program that runs on top is a separate cost line, and a separate ROI conversation.
The honest ROI conversation is in the WiFi marketing pillar, where the three measurable numbers are cost per captured opted-in record (median £0.28 / $0.35 across Purple deployments), return-visit lift on segmented audiences (12-18% in retail and hospitality), and basket-size delta on triggered journeys. Avoid the trap of attributing every subsequent visit to the WiFi capture; run a hold-out test for the marginal effect.
The paid-WiFi calculator models the revenue case for venues running paid premium tiers alongside free capture - common in airports, ferries, and conference centres.
Compliance and legal posture
Guest WiFi sits at the intersection of four regulatory regimes. None of them prohibit guest WiFi. All of them shape how it is operated.
Not sure about the guest network regulations in your region? Use our free Guest WiFi Compliance Check to generate localized legal checklists and customizable terms of service templates.
CCPA / CPRA
Lawful basis at the captive portal: consent for marketing capture under the TCPA and CAN-SPAM, legitimate interest with DPIA for analytics presence. Unticked checkboxes and granular consent.
Reference ›PCI DSS 4.0
Guest WiFi must be segmented from any cardholder data environment. Authenticated wireless access to the CDE prohibited via shared passwords; guest SSIDs always separate.
Reference ›Lawful intercept (UK IPA, US ECPA)
Venues providing public WiFi have logging obligations, with a retention window for your jurisdiction - set by your sector rather than a single federal rule - one year under PCI DSS for card environments, six years of HIPAA documentation for healthcare. A modern platform produces the required log retention and export format without the venue having to engineer it.
Reference ›Accessibility (WCAG 2.2 / EAA)
The captive portal is a publicly accessible service, so it falls under the ADA and Section 508. WCAG 2.2 AA conformance is required in the UK and EU; the EAA has made it enforceable across the EU since June 2025.
Reference ›How to choose a guest WiFi provider
Six tests, applied in order. The honest comparison is total cost including the marketing program the platform enables - not the platform line on the invoice.
Planning a guest network deployment? Use our free Access Point Calculator (from our free WiFi tools library) or download our free native Netforge desktop app for one-click network health checks, path analysis, and speed testing.
Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, Fortinet. Confirm the platform supports the access points you own and the ones on your refresh roadmap.
Native connectors into HubSpot, Salesforce, Mailchimp, Klaviyo, Bloomreach, Marketo, Iterable, and Twilio - not webhook-only. Identity resolution across visits.
Both presence (anonymous, MAC-randomisation-corrected) and engagement (identified, consented). Live dashboards and BI export to S3, BigQuery, Snowflake.
GDPR, PECR, CCPA, TCPA, PCI DSS 4.0. A platform that ships DPIA templates and venue signage, not one that hands you the law and a manual.
A support model matched to your venue type. Hospitality and stadiums need different escalation than retail. 99.9%+ platform uptime is table stakes.
Per-site or per-AP pricing that scales predictably. Per-MAC or per-sign-up pricing distorts the marketing programme and penalises success.
Guest WiFi by industry
The platform is the same; the deployment profile changes by venue type.
- Hospitality: hotels, restaurants, QSR, bars, cafés.
- Retail: high-street retail, big-box retail, shopping malls.
- Travel hubs: airports, trains, ferries.
- Sports and attractions: stadiums, attractions, museums, theatres.
- Workplace: corporate offices, coworking.
- Education: higher education, colleges, schools.
- Healthcare and public: healthcare, care homes, libraries, local government.
Each industry page covers the sector-specific WiFi challenge, the deployment pattern, named same-industry customers - Sweetgreen, Chase, and Eastern Michigan University among them - and the relevant compliance frame.
Frequently asked questions
What is guest WiFi?
+
Guest WiFi is the wireless network a venue offers to visitors, separate from the staff network. It is identified at sign-in (anonymously or with consent), session-bounded, isolated from the venue's internal systems, and typically branded to the host. It is not the same as multi-tenant WiFi (which serves long-term residents) or staff WiFi (which authenticates managed devices).
Do I need guest WiFi?
+
For any customer-facing venue with dwell time over a few minutes, the answer is almost always yes. For QSR, retail, and hospitality, guest WiFi is now a baseline expectation - venues without it lose foot-traffic share and forgo the marketing capture. The exception is venues where the dwell is too short for the sign-in to be worth it (queue-only retail, drive-throughs).
How is guest WiFi delivered?
+
Four models: bring-your-own hardware with a software overlay (Purple, most common), fully managed (Purple + access points provided), MSP-bundled (an IT services partner), or ISP-bundled (the broadband provider includes a basic captive portal). The software-overlay model is the most flexible and the most common in mid-market and enterprise.
What does guest WiFi cost?
+
It varies by model and venue size. The software-overlay subscription typically sits in the £25-£150 per site per month range depending on feature tier (analytics, marketing automation, hardware integrations). Hardware, where new, adds £200-£800 per access point. ISP-bundled is usually 'free' but with no analytics or marketing layer. The honest comparison is the total cost including the marketing program it enables.
How is guest WiFi different from multi-tenant WiFi?
+
Guest WiFi serves transient visitors who are isolated from each other by default; sessions are short and the relationship ends at logout. Multi-tenant WiFi serves long-term residents who need their own devices to recognise each other (Chromecast, smart home, gaming) while staying isolated from other residents. Different sessions, different authentication models, different operational expectations. See the multi-tenant pillar for the full distinction.
How is guest WiFi different from staff WiFi?
+
Staff WiFi authenticates known users on known devices against the organization's identity provider, with strong authentication (EAP-TLS, 802.1X) and access to internal systems. Guest WiFi authenticates unknown visitors through a captive portal with weak authentication (email, social, click-through) and never grants access to internal systems. They run on the same access points but should always be separate SSIDs.
Is open guest WiFi legal?
+
In most jurisdictions, yes - but with obligations. Venues have logging and lawful-intercept obligations, with a connection-log retention window for your jurisdiction - set by your sector rather than a single federal rule - one year under PCI DSS for card environments, six years of HIPAA documentation for healthcare. Family-friendly venues are expected to apply content filtering. Most venues are better served by a captive portal even on otherwise free WiFi, both for the data capture and for documentary evidence of the venue's policy on acceptable use.
How do I choose a guest WiFi provider?
+
Six tests in order: hardware compatibility with what you own; data-capture and CRM integration with what your marketing team uses; analytics depth versus what your operations team will actually use; compliance posture for your jurisdiction; support model and SLA against your venue type; and pricing transparency. We publish direct comparisons against Cloud4Wi, IronWiFi, Stampede, Spotipo, JumpCloud, Portnox, SecureW2, and RADIUSaaS for the head-to-head detail.
Does guest WiFi support compliance with CCPA, PCI, and the FTC and state attorneys general guidance?
+
It must. The captive portal is the consent moment for visitor data capture under CCPA; the network segmentation between guest and cardholder-data environment is the PCI requirement; the data-handling and retention posture is the FTC and state attorneys general concern. A modern guest WiFi platform ships compliance-defensible defaults and provides the DPIA, signage, and policy templates the venue needs.
How does guest WiFi connect to marketing and analytics?
+
Guest WiFi is the surface; marketing and analytics are the layers built on top. The captive portal captures consented identity for the marketing program. The presence and engagement streams produce footfall, dwell, and journey data for the analytics program. The two are the same dataset, framed differently, sitting on the same connectivity foundation.
Is Passpoint replacing guest WiFi?
+
Not replacing - extending. Passpoint and OpenRoaming let devices join trusted WiFi automatically without a captive portal interaction. For known returning visitors, that's the better experience; for first-time and one-off visitors, the captive portal remains the right join surface. Most large venues will run both: Passpoint for known carriers and federated identities, captive portal for everyone else.