Yes, but only with the right permission. Logging someone on to your WiFi and sending them marketing are two separate things. To email or text an individual, PECR normally needs a clear, unticked opt-in, and WiFi access mustn't depend on ticking it. The "soft opt-in" rarely fits a free WiFi login. Collect as little as you need, say why on the splash page, set a retention period and take extra care at family venues.
Two laws, two separate questions
UK GDPR asks whether you have a lawful basis to collect and use someone's personal data at all: their name, email address, phone number, and the device and session data your WiFi system records automatically.
PECR (the Privacy and Electronic Communications Regulations) asks whether you're allowed to send that person an electronic marketing message: an email, a text, a WhatsApp or a social media direct message.
You need to pass both. The Data (Use and Access) Act 2025 confirmed that direct marketing can be a legitimate interest under UK GDPR (ICO). That helps with the first question. It doesn't answer the second. PECR still decides whether you can press send, and for individuals that usually means consent.
Does the soft opt-in cover people who log in to WiFi?
Usually not. The soft opt-in lets you email or text existing customers about your own similar products without asking for consent first, as long as you collected their details "in the course of a sale or negotiations for a sale" and gave them a clear chance to opt out, both at the time and in every message.
The ICO's guidance says a person doesn't need to buy anything, but they "must actively express an interest in buying your products or services". Requesting a quote or signing up for a free trial can count. Simply using something you give away for free, like guest WiFi, is hard to fit within that. Someone connecting to check a train time hasn't negotiated to buy anything.
Where the soft opt-in does often fit a venue is at the real point of sale: a ticket purchase, a party booking or a membership sign-up in your booking system, where the customer can untick marketing there and then. That's a better place to build your marketing list than the WiFi splash page.
Can you make WiFi access conditional on marketing consent?
No. The ICO's consent guidance, quoting UK GDPR, says consent isn't freely given where a service "is conditional on consent to the processing of personal data that is not necessary for the performance of that contract". Pre-ticked boxes and silence don't count either, and people must be able to refuse "without detriment".
In practice, your splash page needs a Connect button that works whether or not anyone ticks the marketing box. Offer separate, unticked boxes for email and for text, because the ICO expects granular choices. Keep a record of who agreed to what, when, and the wording they saw. Your WiFi platform should log this; check that it does before you rely on it.
What should the splash page collect?
The less you collect, the less you have to protect, explain and delete. The login method decides most of this.
| Login method | What you collect | Marketing use | Our view |
|---|---|---|---|
| Click-through (accept terms) | No contact details; device and session data only | None | Simplest and lowest risk. Fine if WiFi is a courtesy, not a marketing channel |
| Email address | Email, plus device and session data | Only if they tick an unticked opt-in | The usual choice when marketing is the goal |
| Email plus a few profile fields | Email, name, postcode or birthday month | Only with opt-in, and only fields you'll actually use | Each extra field needs a reason you can explain |
| Social media login | Whatever the platform shares, often far more than you need | Only with a separate opt-in | Avoid. You receive data you didn't ask for and can't easily justify |
| SMS code to a mobile number | Mobile number, plus device and session data | Only with a separate SMS opt-in | Useful for verifying people; don't treat the number as marketing permission |
Don't forget the data guests never see. Most WiFi systems record device identifiers (MAC addresses) and connection times. If these can be linked to a person, they're personal data too, and need a purpose and a retention period.
What goes on the splash page privacy notice?
Use a short first layer with a link to the full notice. The first layer should say who the data controller is (the organisation responsible for the data: your venue, not the WiFi platform), what you collect, why, whether marketing is optional, how long you keep it, and how to opt out or complain. The full notice then covers lawful bases, the WiFi or marketing platform you share data with, any transfers outside the UK and people's rights.
Your WiFi or marketing platform is normally your processor, because it handles the data on your behalf, so you need a written processor contract with it. Check where it stores data and whether it uses your guests' data for its own purposes.
Since 19 June 2026 you also need a way for people to complain to you about how you use their data. The ICO says complaints must be acknowledged within 30 days and answered "without undue delay". A link from the splash page notice to a simple form covers it.
How long should you keep WiFi sign-up data?
UK GDPR doesn't set a number. It requires you to keep personal data no longer than you need it, and to be able to justify your choice.
Example: a family entertainment centre decides to keep WiFi session logs for 30 days (long enough to investigate misuse), deletes email-only sign-ups with no marketing opt-in after 12 months, and removes marketing subscribers who haven't opened an email in two years. Those periods are an illustration. What matters is that you pick yours, write them down and set the system to delete automatically.
What changes at a family venue?
Children's data needs extra care. UK GDPR says children merit specific protection, particularly where their data is used for marketing. For online services offered directly to children, a child under 13 can't give their own consent; a parent must (ICO).
The ICO's Children's code applies to online services "likely to be accessed by children". The ICO's guidance doesn't specifically say whether a venue's WiFi splash page is one of those services, so check with your adviser. Either way, its standards are a sensible design benchmark: high privacy by default, collect the minimum, and no nudging towards sharing more.
For soft play centres, trampoline parks and family attractions, that means:
- Aim the marketing opt-in at adults, with a clear "I'm 18 or over" statement next to it
- Don't ask for children's names, ages or birthdays on the splash page; collect party details through the booking system instead
- Turn on content filtering on the guest network
- Keep guest WiFi completely separate from your tills, ticketing and CCTV
What did the Data (Use and Access) Act 2025 change?
The Act received Royal Assent on 19 June 2025, and most of its data protection and PECR changes came into force on 5 February 2026 (ICO). For venue marketing, four changes matter:
| Change | What it means for guest WiFi marketing |
|---|---|
| PECR fines raised to UK GDPR levels | Up to £17.5 million or 4% of global turnover. Marketing without valid consent is now a far bigger risk |
| Direct marketing confirmed as a possible legitimate interest | Helps with the UK GDPR question, but PECR consent for emails and texts to individuals still applies |
| Charity soft opt-in | Charity-run venues and attractions can email supporters who have "offered support to, or expressed an interest in" their purposes, with an opt-out |
| Complaints procedure (from 19 June 2026) | You must acknowledge data protection complaints within 30 days |
What didn't change is the core rule: to send marketing emails or texts to individuals who've only used your WiFi, you need their consent.
How Indigo does this. Indigo Unified Communications builds venue guest networks on Ubiquiti UniFi, kept separate from tills, ticketing and CCTV, for venues including SWG3 in Glasgow and Wonderworld Group's 10 sites. We hold Cyber Essentials Plus and ISO 27001:2022 ourselves. The marketing permissions on your splash page are your decision as data controller. We make sure the network behind it is secure and collects only what you've decided to collect. Venue WiFi and connectivity →
What to do next
- Log in to your own guest WiFi as a customer would and screenshot every step. Note what's collected and whether WiFi works without the marketing box ticked.
- Ask your WiFi or marketing platform for its processor contract, where it stores data and how it records consent.
- Set retention periods for sign-ups, marketing lists and session logs, and switch on automatic deletion.
- Move your main marketing sign-up to the point of sale in your booking or ticketing system, where the soft opt-in can apply.
- Check the network itself. Our guide chapter on guest WiFi and venue networks explains how to keep guests away from your business systems.
Frequently asked questions
Is it legal to collect email addresses through guest WiFi?
Yes, if you have a lawful basis, tell people why on the splash page and collect only what you need. Collecting an email address doesn't give you permission to send marketing to it. For emails and texts to individuals, PECR normally requires a separate, unticked opt-in, and WiFi access mustn't depend on agreeing to it.
Can we add WiFi users to our mailing list if they don't opt out?
Not usually. The soft opt-in only covers details collected during a sale or negotiations for a sale, and the ICO says people must actively express an interest in buying. Using free WiFi rarely meets that test. Without it, you need a positive opt-in, not an opt-out.
What are the fines for breaking PECR now?
Since 5 February 2026, the ICO can fine up to £17.5 million or 4% of global annual turnover under PECR, whichever is higher, the same level as UK GDPR. The change was made by the Data (Use and Access) Act 2025.
Does the Children's code apply to our WiFi splash page?
The ICO hasn't said specifically whether a venue's WiFi login page is covered. The code applies to online services likely to be accessed by children, so take advice if children use your WiFi. Designing to its standards costs little: minimal data, marketing aimed at adults, privacy by default and content filtering.
Sources: ICO, How do we comply with the PECR electronic mail marketing rules?, updated 28 April 2026 (https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/) · ICO, Electronic mail marketing (Guide to PECR), updated 19 November 2024 (https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) · ICO, What is valid consent?, updated 4 August 2026 (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/) · ICO, Statement on the commencement of the Data (Use and Access) Act (DUAA), 5 February 2026 (https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa/) · ICO, DUAA summary of the changes: privacy and electronic communications (https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/privacy-and-electronic-communications/) · ICO, The Data (Use and Access) Act 2025: what does it mean for organisations?, updated 19 June 2026 (https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/) · ICO, Age appropriate design code: services covered by this code (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/services-covered-by-this-code/) · DSIT, Data (Use and Access) Act 2025: plans for commencement (https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement)
Related: How do you design WiFi and networks for a busy venue? · How should leisure businesses protect customer and booking data? · Business WiFi · How do you take over a new venue's IT without disrupting trading?
What's available at your address?
Full fibre, SoGEA or a leased line: we'll tell you what you can get and the monthly price within 2 working days.