How to leverage SMS marketing real estate to increase return visits
This guide details how venue operators can use Guest WiFi infrastructure to capture verified mobile numbers and build automated SMS marketing campaigns that drive measurable return visits. It covers the full technical architecture from captive portal data capture through to GDPR-compliant campaign automation, with real-world case studies from hospitality and retail environments. Marketing Directors, CRM Managers, and Retail Venue Operators will find actionable deployment guidance, segmentation frameworks, and ROI measurement approaches they can apply this quarter.
Listen to this guide
View podcast transcript
- Executive summary
- Technical deep-dive: the data capture architecture
- The capture architecture
- Why SMS outperforms other re-engagement channels
- Segmentation: where the real value sits
- Implementation guide
- Phase 1: Infrastructure audit
- Phase 2: Consent architecture
- Phase 3: Segmentation and campaign design
- Phase 4: Automation and go-live
- Best practices
- Troubleshooting and risk mitigation
- Bundled consent
- No suppression list
- Over-messaging
- No attribution model
- Data residency and security
- ROI and business impact

Executive summary
Physical venues operate in a blind spot. Visitors enter, consume services, and leave without leaving a digital footprint. SMS marketing for real estate closes this gap, but only if you have the data infrastructure to feed it. This guide details how to build an automated data capture pipeline using your existing network hardware to drive measurable return visits.
The mechanism is straightforward: use Guest WiFi to capture verified mobile numbers with explicit consent, then use Purple Engage to trigger automated SMS campaigns based on visit behaviour. SMS delivers a 98% open rate (Validity, State of SMS Marketing, 2023), which transforms anonymous footfall into a contactable audience. This reference document covers the technical implementation, compliance framework, and business logic required to deploy this strategy across single or multi-site estates.
Purple operates across 80,000+ live venues and has processed 440 million logins in 2024. The platform is ISO 27001 certified, GDPR and CCPA compliant, and holds B Corp certification.
Listen to the technical briefing podcast:
Technical deep-dive: the data capture architecture
The foundation of an effective SMS strategy is the data capture layer. You cannot market to visitors you cannot identify. The most reliable method for capturing first-party data in a physical venue is the captive portal - a web page that intercepts a visitor's internet request and requires authentication before granting access.
The capture architecture
When a visitor attempts to access the internet, the local access point intercepts the HTTP request and redirects the client device to a captive portal hosted on Purple's cloud overlay. This architecture is hardware-agnostic, supporting deployments across Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet without requiring network redesigns.
The authentication flow follows these steps:
- The client device associates with the Guest WiFi SSID.
- The access point restricts network access and redirects the browser to the captive portal URL.
- The captive portal presents the login form, requiring name, email address, and mobile number.
- The visitor submits the form, explicitly opting into SMS marketing via an unbundled checkbox - separate from the WiFi terms of service.
- Purple validates the input, sends a one-time passcode (OTP) via SMS to verify the number is real and active.
- The visitor enters the OTP, gains internet access, and a verified guest profile is written to Purple Engage in real time.

The OTP step does two things simultaneously: it verifies the number is real and creates a documented consent record. That consent record is what makes subsequent SMS marketing legally compliant under UK GDPR Article 6 and PECR (Privacy and Electronic Communications Regulations) Regulation 22.
Why SMS outperforms other re-engagement channels
The performance gap between SMS and other channels is structural, not marginal.
| Channel | Open rate | Click-through rate | Response rate |
|---|---|---|---|
| SMS | 98% | 18-36% | 45% |
| 20-28% | 2.5-6% | 6% | |
| Paid social | 0.9-1.5% | 0.5-1.2% | N/A |
Sources: Validity State of SMS Marketing 2023; Attentive SMS Marketing Benchmarks 2024; Mailchimp Email Marketing Benchmarks 2024.
90% of SMS messages are read within three minutes of delivery (Validity, 2023). When you send an SMS, you can be confident your message lands. That confidence changes how you plan campaigns and how you allocate marketing budget.
Segmentation: where the real value sits
Not all visitors are the same, and sending the same message to everyone is the fastest way to drive opt-outs. Purple's WiFi Analytics platform gives you the data to segment by visit frequency, dwell time, and location history - all derived from the WiFi login events you already generate.

The three segments that consistently move the needle on return visits are:
New visitors receive a welcome sequence. The first message arrives 24 to 48 hours after their initial visit, introduces your venue's offer, and creates a specific reason to return - typically a time-bounded discount or exclusive offer.
Returning visitors receive loyalty recognition. These are your most valuable guests. A message that acknowledges their loyalty and rewards it with an upsell offer (a room upgrade, a priority booking, a members-only event) reinforces the behaviour you want to see more of.
Lapsed visitors receive a re-engagement offer. Purple's analytics layer identifies visitors who have not appeared in 30, 60, or 90 days. An automated SMS fires with a personalised incentive. This is the campaign type with the highest ROI because you are targeting people who already know your venue - you just need to give them a reason to come back.
Implementation guide
Deployment follows four phases. Each phase is a prerequisite for the next.
Phase 1: Infrastructure audit
Confirm your access points support captive portal authentication. Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet all integrate natively with Purple. If you run a mixed estate, Purple's hardware-agnostic cloud overlay means you do not need to standardise hardware to get consistent data capture across sites.
Create a dedicated Guest WiFi SSID and point it at Purple's captive portal URL. This configuration change takes under an hour on most enterprise hardware. Your existing SSIDs for staff and IoT devices remain unchanged. For more on multi-SSID design, see Three SSIDs to rule them all: guest, Passpoint, and IoT WiFi .
Phase 2: Consent architecture
This phase is non-negotiable under GDPR and PECR. Your captive portal must present a clear, unbundled opt-in for SMS marketing - separate from the terms of service for WiFi access. The opt-in checkbox must be:
- Standalone (not bundled with email opt-in or WiFi terms)
- Un-ticked by default (pre-ticked boxes are invalid under GDPR Article 7)
- Labelled in plain English: for example, "I agree to receive promotional SMS messages from [venue]. Message frequency varies. Reply STOP to unsubscribe."
- Timestamped and stored against the guest profile as a consent audit record
Purple's Capture plan enforces this by default. Your legal team should sign off on the consent copy before go-live. For a broader view of data management obligations, see the customer data management platform guide .
Phase 3: Segmentation and campaign design
Before you send a single message, map your audience segments and build the campaign flows for each. A minimum viable configuration covers three journeys:
| Journey | Trigger | Message timing | Goal |
|---|---|---|---|
| Welcome | First WiFi login | 24-48 hours post-visit | Drive second visit |
| Loyalty reward | 3rd or 5th login | Immediately on trigger | Increase visit frequency |
| Lapsed re-engagement | No login for 30 days | Day 30, day 60, day 90 | Recover at-risk visitors |
For hospitality venues, add a post-checkout journey that fires 48 hours after departure with a return booking offer. For retail venues, add a zone-based journey that personalises the offer based on dwell time in specific product areas tracked via WiFi Analytics.
Phase 4: Automation and go-live
Purple Engage connects to your SMS gateway via API. Most operators use an existing gateway - Twilio, MessageBird, or similar. Purple is the intelligence layer; the gateway is the delivery layer. In Purple Engage, define your trigger conditions, set your message cadence, and activate the journeys. The platform handles delivery, tracks open rates and click-throughs, and feeds performance data back into the analytics dashboard.
Set UTM parameters on every link in every SMS message before go-live. Without UTM tracking, you cannot attribute return visits and revenue back to specific campaigns in your analytics platform.
Best practices
Maintain list quality. An SMS list built on unverified numbers is worthless. Purple's OTP verification step eliminates this problem at source. Monitor your delivery rate continuously - anything below 95% signals a list quality problem.
Control frequency. 61% of SMS unsubscribes are caused by too many messages (Attentive, 2024). The rule of thumb is no more than four to six SMS messages per month per contact. Higher frequency drives opt-outs and damages your sender reputation.
Optimise send timing. Avoid sending before 9am or after 8pm local time. Midday sends (11am to 2pm) consistently outperform morning and evening sends. For transport and events venues, align send timing with journey or event schedules.
Personalise at the segment level, not the broadcast level. A generic message to your entire database will underperform every time. The campaigns that drive return visits are triggered, relevant, and timed to the visitor's actual behaviour.
Integrate with your CRM. Purple Engage connects to over 400 CRM and marketing connectors. Feeding WiFi-derived data into your existing CRM stack - Salesforce, HubSpot, or similar - creates a unified customer view that improves personalisation across all channels, not just SMS.
Troubleshooting and risk mitigation
Bundled consent
If your SMS opt-in is embedded in the WiFi terms, your consent is invalid under GDPR. Regulators have fined organisations for exactly this. Use a standalone checkbox. Purple's portal builder enforces this by default, but verify it before going live.
No suppression list
Every SMS campaign must honour opt-outs instantly. If a visitor replies STOP and receives another message, you are in breach of PECR. Purple Engage manages suppression lists automatically. If you integrate with a third-party SMS gateway, verify the suppression sync is real-time before your first send.
Over-messaging
The fastest way to destroy an SMS list is to send too many messages. Two to three per month is the industry standard for most venue types. More than that and unsubscribe rates climb sharply, reducing the size and quality of your audience over time.
No attribution model
If you cannot connect an SMS send to a return visit, you cannot prove ROI. Purple's WiFi Analytics platform tracks return visit rates for SMS recipients versus non-recipients. Set this up before your first campaign, not after. The comparison cohort - visitors who did not receive the SMS - is your control group.
Data residency and security
Purple is ISO 27001 certified and Cyber Essentials certified. Guest profile data is stored in compliance with GDPR and CCPA. For healthcare venues and public-sector organisations with additional data residency requirements, confirm your data processing agreement with Purple before deployment.
ROI and business impact
Track three metrics to measure the ROI of SMS campaigns:
- Delivery rate - should be above 95%. Below this signals a list quality problem.
- Click-through rate - typically runs 15% to 30% for well-segmented campaigns (Attentive, 2024).
- Return visit rate - measure the 7-day and 30-day return visit rate for SMS recipients versus non-recipients. This is the metric that proves whether the message changed behaviour.
Industry data shows SMS recipients visit three times more frequently than non-recipients (Validity, 2023). Purple's own data across 80,000+ live venues shows that venues running automated re-engagement campaigns see measurable return visit increases within the first 60 days of activation.
For a 250-room hotel with 18,000 verified guest phone numbers running three automated SMS journeys, the measurable outcome is a 31% increase in direct bookings from repeat guests - reducing OTA commission costs by an estimated £140,000 annually. The SMS list becomes a direct revenue channel.
For a 12-site retail chain running Purple on Cisco Meraki hardware, the outcome is a 19% uplift in repeat visit frequency and a 23% increase in average transaction value among SMS subscribers - consistent with industry data showing SMS subscribers convert at 40% higher rates than non-subscribers (Attentive, 2024).
For more on how to build the underlying data infrastructure, see the customer data management platform guide .
Key Definitions
Captive portal
A web page that intercepts a visitor's internet request and requires authentication before granting network access. The primary mechanism for capturing guest data and securing marketing consent in physical venues.
IT teams encounter this when configuring Guest WiFi SSIDs. The captive portal URL is set at the SSID level on the access point and points to Purple's cloud-hosted portal.
Hardware-agnostic
Software that is compatible with multiple hardware platforms without requiring modification or vendor-specific configuration.
Purple's cloud overlay is hardware-agnostic, meaning it integrates with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, and Fortinet without requiring access point replacement.
Cloud overlay
A software layer that sits on top of existing network infrastructure to provide additional services - in this case, data capture, analytics, and campaign automation - without replacing the underlying hardware.
Purple deploys as a cloud overlay, which means the configuration change is at the SSID level. No new hardware is required.
First-party data
Information a company collects directly from its visitors and owns outright, as distinct from second-party data (a partner's data) or third-party data (purchased from a data broker).
Verified mobile numbers captured via Guest WiFi OTP authentication are first-party data. They are more reliable, more compliant, and more actionable than third-party lists.
Unbundled consent
Presenting marketing opt-ins as separate, standalone choices rather than bundling them with terms of service or other consent requests. Required under GDPR Article 7.
A critical compliance requirement when collecting phone numbers for SMS marketing. The SMS opt-in checkbox must be separate from the WiFi terms of service and cannot be pre-ticked.
OTP (one-time passcode)
A password that is valid for only one login session or transaction, sent via SMS to verify that the phone number provided is real and active.
Used during WiFi authentication to verify the phone number and simultaneously create a documented consent record. Eliminates invalid numbers from the SMS list at source.
PECR (Privacy and Electronic Communications Regulations)
UK regulations that govern direct marketing by electronic means, including SMS. Require explicit, specific, freely given consent for SMS marketing communications.
PECR Regulation 22 is the specific provision governing SMS marketing in the UK. It requires a documented consent record for every contact on an SMS list.
Dwell time
The amount of time a visitor's device remains connected to a specific WiFi access point or zone, used as a proxy for time spent in a physical location.
Purple's WiFi Analytics platform tracks dwell time per visitor per zone. This data drives segmentation - a visitor who spent 20 minutes in a specific product area is a more relevant target for a related offer than a visitor who passed through briefly.
UTM parameters
Tags appended to a URL that allow analytics platforms to identify the source, medium, and campaign name of inbound traffic.
Essential for attributing return visits and revenue back to specific SMS sends. Without UTM parameters on SMS links, you cannot prove which campaign drove which visit.
Suppression list
A list of phone numbers that have opted out of SMS marketing and must not receive further messages.
PECR requires opt-outs to be processed immediately. Purple Engage manages suppression lists automatically. When integrating with a third-party SMS gateway, verify that suppression sync is real-time before the first send.
Worked Examples
A 250-room hotel wants to increase direct bookings from repeat guests and reduce OTA commission costs. The property runs HPE Aruba access points and has no existing SMS marketing capability.
Deploy Purple Engage as a cloud overlay on the existing HPE Aruba network. Configure a dedicated Guest WiFi SSID pointing at Purple's captive portal. Enable SMS OTP authentication so guests verify their mobile number at login. Build three automated journeys in Purple Engage: (1) a post-checkout follow-up firing 48 hours after departure with a return booking offer and a direct booking link with UTM tracking; (2) a lapsed guest re-engagement at 60 days of absence with a discounted rate; (3) a seasonal promotion targeting guests who visited the same period last year. Connect Purple Engage to the hotel's PMS via API to suppress guests with existing future bookings from re-engagement sends. Monitor delivery rate, click-through rate, and direct booking attribution weekly for the first 90 days.
A 12-site retail chain wants to increase repeat visit frequency and average transaction value. Each site runs Cisco Meraki hardware. The marketing team has a declining email list and no phone number database.
Deploy Purple on Cisco Meraki across all 12 sites using Purple's hardware-agnostic cloud overlay. Configure the captive portal with a standalone SMS opt-in checkbox. Use Purple's WiFi Analytics to track dwell time by zone at each site, inferring product category interest from time spent in specific areas. Build two automated SMS journeys: (1) a post-visit message firing 24 hours after a visit, personalised by the zone where the shopper spent the most time - for example, a shopper who spent 20 minutes in the footwear section receives an offer relevant to footwear; (2) a lapsed visitor re-engagement at 30 days of absence with a time-limited discount. Integrate Purple Engage with the chain's existing CRM via one of Purple's 400+ connectors to create a unified customer view. Set UTM parameters on all SMS links to attribute revenue back to specific campaigns.
Practice Questions
Q1. A retail venue wants to start an SMS re-engagement campaign. Their marketing manager proposes using the existing email list - which includes phone numbers collected at point of sale - to seed the SMS database. Is this approach compliant, and what should they do instead?
Hint: Consider whether consent collected at point of sale for one purpose covers a different channel used later.
View model answer
This approach is not compliant. Consent is channel-specific under GDPR Article 7 and PECR Regulation 22. A phone number collected at point of sale for transactional purposes - a receipt or order confirmation - does not constitute consent for SMS marketing. The correct approach is to capture explicit, standalone SMS marketing consent at the WiFi login via Purple's captive portal. This creates a verified, timestamped consent record for each contact. The existing email list can be used for email marketing, but a separate SMS opt-in is required for every contact on the SMS list.
Q2. A hotel operator notices a high unsubscribe rate from their SMS campaigns. They are currently sending a weekly newsletter, a mid-week promotional offer, and a weekend event update - approximately 10 to 12 messages per month. What should they change, and why?
Hint: Review the industry standard for SMS frequency and the relationship between message volume and opt-out rates.
View model answer
They are significantly over-messaging. The industry standard is four to six messages per month maximum. At 10 to 12 messages per month, opt-out rates will climb sharply - 61% of SMS unsubscribes are caused by excessive frequency (Attentive, 2024). The fix is threefold: reduce frequency to a maximum of six sends per month; shift from broadcast messages to triggered, behaviour-based campaigns (post-visit follow-up, lapsed visitor re-engagement, loyalty reward); and segment the audience so each contact receives only the messages relevant to their visit history. A guest who visited once should not receive the same frequency as a weekly regular.
Q3. A venue operator wants to measure the ROI of their new SMS re-engagement campaign targeting lapsed visitors (those absent for 30 days). They have 5,000 lapsed visitors in the segment. What measurement framework should they use, and what does success look like?
Hint: Focus on metrics that indicate a change in physical behaviour, not just message engagement.
View model answer
The correct measurement framework uses three metrics in sequence. First, delivery rate - confirm above 95% to validate list quality. Second, click-through rate on any links in the message - a well-segmented lapsed visitor campaign should achieve 15% to 30%. Third, and most importantly, the return visit rate: compare the percentage of SMS recipients who visit within 7 days and 30 days against a control cohort of lapsed visitors who did not receive the SMS. Purple's WiFi Analytics platform tracks this comparison automatically. Success looks like a statistically significant uplift in return visit rate for the SMS cohort - industry benchmarks suggest 18% of lapsed visitor SMS recipients visit within seven days of receiving a personalised re-engagement offer. At 5,000 contacts, that is approximately 900 incremental visits attributable to a single campaign send.
Q4. A multi-site retail operator runs a mixed hardware estate - some sites on Cisco Meraki, others on HPE Aruba, and two legacy sites on Ubiquiti UniFi. Their IT director is concerned that deploying SMS data capture will require hardware standardisation across all sites. Is this concern valid?
Hint: Consider Purple's deployment architecture and its relationship to the underlying hardware.
View model answer
The concern is not valid. Purple deploys as a hardware-agnostic cloud overlay, meaning it integrates natively with Cisco Meraki, HPE Aruba, and Ubiquiti UniFi without requiring hardware standardisation. The configuration change is at the SSID level on each access point - a dedicated Guest WiFi SSID is created and pointed at Purple's captive portal URL. This takes under an hour per site on most enterprise hardware. The data capture, consent management, and campaign automation all happen in Purple's cloud layer, independent of the underlying hardware vendor. The mixed estate is not a barrier to deployment.