Guest WiFi terms and consent checker
Test your captive portal terms length and consent design against UK GDPR and PECR, and get the fixes to make.
- Marketing consent is separate from the access terms (0/25)UK GDPR Art. 7(2) and 7(4)
- Consent is a clear affirmative act (20/20)UK GDPR Art. 4(11), Recital 32
- Terms short enough to read at the portal (0/15)UK GDPR Art. 12(1): concise, intelligible, plain language
- Privacy notice names controller, purposes, lawful basis, retention and rights (15/15)UK GDPR Art. 13
- Guests can withdraw consent and see or delete their data themselves (0/15)UK GDPR Art. 7(3), 15, 17
- A retention period is set and enforced (0/10)UK GDPR Art. 5(1)(e)
- Give marketing its own checkbox so guests can get online without agreeing to it.
- Put a summary of 300 words or fewer on the splash page and link to the full terms (a layered notice).
- Offer a self-serve preference and data portal; withdrawing must be as easy as giving consent.
- Set a retention period for profiles and session logs and delete automatically when it ends.
Retail and shopping centres: what auditors look for
Marketing consent and footfall analyticsRecommended flow: Short access terms, a separate unticked marketing box, and a link to a preference centre.
- 1Pre-ticked marketing boxes are not valid consent (UK GDPR Recital 32; CJEU Planet49, 2019).
- 2Footfall and location analytics need to be disclosed in the privacy notice, with the lawful basis stated.
- 3The splash page must name the data controller, not just the WiFi provider.
In 2017 Purple added a joke clause to its WiFi terms for two weeks, committing anyone who connected to 1,000 hours of community service, including cleaning portable toilets at festivals. 22,000 people accepted it. One person, about 0.0045%, spotted it. Long terms are accepted, not read.
Assumptions and method
- ·Reading time = words ÷ 238 words per minute, the average adult silent reading rate for non-fiction (Brysbaert, 2019).
- ·Score = sum of the six checks (25 + 20 + 15 + 15 + 15 + 10). Terms of 300 words or fewer earn the full length points, up to 800 earn half. The score is a design check, not a legal opinion.
- ·Requests = logins × 12 ÷ 10,000 × 1, handled in 1 h each by hand or 0.1 h with self-service. Replace the rate with your own request log. Access requests must be answered within one month (UK GDPR Art. 12(3)).
Make your portal short, clear and consent-safe
Purple portals separate access terms from marketing consent and give guests a self-serve preference page.
Cleaning festival loos, hugging stray cats and dogs, and scraping chewing gum off the streets are just some of the uninviting tasks people have agreed to in exchange for free WiFi. And we aren't just talking about a few hundred unfortunate individuals. Over 22,000 people have openly agreed to carry out 1,000 hours of community service after we added the spoof clause into our terms and conditions over a two-week period.
A “Community Service Clause” was added to our usual terms and stated: The user may be required, at Purple's discretion, to carry out 1,000 hours of community service. This may include the following:
- Cleansing local parks of animal waste
- Providing hugs to stray cats and dogs
- Manually relieving sewer blockages
- Cleaning portable lavatories at local festivals and events
- Painting snail shells to brighten up their existence
- Scraping chewing gum off the streets
Don't worry, we aren't going to round up these individuals and ask them to don their rubber gloves and repay the community debt. The real reason behind our experiment is to highlight the lack of consumer awareness when signing up to use free guest WiFi. All users were given the chance to flag up the questionable clause in return for a prize, but remarkably only one individual, which is 0.000045% of all WiFi users throughout the whole two weeks, managed to spot it.
Commenting on the results, Gavin Wheeldon, CEO of Purple, said: “WiFi users need to read terms when they sign up to access a network. What are they agreeing to, how much data are they sharing, and what licence are they giving to providers? Our experiment shows it's all too easy to tick a box and consent to something unfair.”
We've unveiled the findings of our experiment to coincide with today's announcement that we are the first General Data Protection Regulation (GDPR) compliant WiFi provider. The European legislation, which comes into force on 25th May 2018, will reshape the way organisations approach data privacy and allow end users to gain more access to the data collected about them. One of GDPR's headline rulings is the introduction of 'unambiguous consent' before users' personal or behavioural data can be used for marketing purposes. The results from our experiment clearly support the inclusion of 'unambiguous consent' in the GDPR rulings.
In response to both GDPR and the results we obtained in our experiment, we have modified our privacy policy so it is clearer, simpler and shorter. In fact, our privacy policy is now only 260 words long rather than 1600, which means people should be more open to reviewing the terms before clicking 'accept'. Our access journey has also been tweaked so that users have more clarity around how their data will be used, for what purposes, and by whom.
Gavin Wheeldon says: “We welcome the strengthening of data protection laws across Europe that GDPR will bring. Not only will it give WiFi end users more control over how their personal data is being used by companies, it will also raise the level of trust in the digital economy.”
Another new feature which has been announced today is our brand-new Profile Portal, which gives end users complete transparency of all the data collected about them and also allows them to modify their marketing preferences.
Gavin adds: “Purple's Profile Portal means that all end users worldwide have the comfort of knowing they can control how their data is being used. And if they're happy to hug a few stray dogs at the same time it's a win-win.”
Read next: Top 10 Tips for GDPR
