A Guest Wi-Fi Login That Asks for an Email Address

A list nobody planned

A cafe's free Wi-Fi opens on a login page that asks for an email address. Customers type one in and forget it, and months later the owner finds a long list in the Wi-Fi account.

The obvious idea is to send everyone on it the new newsletter. Since July 1, doing that has carried real risk under Canada's anti-spam law.

Under CASL, an address typed in to get online is not consent to receive marketing email. The customer agreed to use the Wi-Fi, and nothing more.

Why the login is not consent

Express consent needs a clear request of its own. That request says what the person will receive, who is asking, how to reach them, and that consent can be withdrawn.

A line in the Wi-Fi terms saying users agree to receive offers does not do that. Consent folded into terms of use, or given through a box already ticked, is not the kind the regulator accepts.

Some messages may be allowed on other grounds, such as a purchase in the past two years. A login page cannot show which addresses belong to paying customers, so it cannot prove that either.

This is general information about the anti-spam rules, not legal advice on your own sign-up page.

What the login page should say

Keep the Wi-Fi and the newsletter as two separate choices on the same page. Getting online should not depend on agreeing to anything else.

• An unticked box for the newsletter, apart from the Wi-Fi terms.
• What they will receive, such as a monthly email with news and offers.
• Your business name as customers know it, with a mailing address.
• A phone number, email address or website where they can reach you.
• A plain line saying they can leave the list whenever they like.

Whether the email field is needed at all is a separate decision. If an address is required to log in, say on the page what it is used for, and use it for nothing else.

Find out who holds the list

Many guest Wi-Fi systems keep the addresses with the company that supplies the hotspot service, not on anything the business owns. Find out where the list lives, who can see it and how to export it.

Read the supplier's terms on what it may do with those addresses. Your customers gave them to your business, and they will hold you responsible for any mail that follows.

If you ever change supplier, ask what happens to the stored list. Addresses left behind in an old account are still your customers' information.

The record to keep for each sign-up

A business relying on express consent has to be able to show it. For a login page, that means a record made at the moment someone ticks the box.

Keep the address, the date and time, the location if there is more than one, and the exact wording of the page. Each time the wording changes, file the earlier version with the dates it ran.

A welcome email sent straight after sign-up confirms the address is real. People in a hurry to get online type invented addresses, and those never belong on a mailing list.

A worked example

A trailer hitch installer in a light industrial park fits hitches, wiring and brake controllers to pickups, SUVs and motorhomes. Customers often wait an hour or two in a small room with coffee and free Wi-Fi.

The Wi-Fi login asked for an email address, and small print under the button said users agreed to receive promotions. Two years of addresses had gathered in the hotspot account.

The owner wanted to send a spring towing checklist with a discount. He could not tell which addresses belonged to paying customers, and nobody on the list had given express consent.

The old list was set aside unused. The login now asks only for the password printed on a card at the counter, with a separate, unticked box and an email field for a towing season newsletter.

Each sign-up is stored with the date, time and page wording. The work order offers the same newsletter, with a box the customer ticks and initials at pickup.

Everyone on the new list chose to be there, knows who will write and can leave at any time, so the first issue arrives as something expected.

Why not email the old list once

It is tempting to write once to the old addresses and ask whether they would like the newsletter. The law treats that request the same way as the newsletter, so the same rule catches it.

The safer course is to leave the old list alone and start a new one, at the login page, the counter and the website.

If the addresses serve no other purpose, delete them. A list nobody may use is still personal information the business has to look after.

Building a list you can use

Ask wherever customers already are: the Wi-Fi page, the counter, the receipt and the website's contact form. Each place needs the same plain wording and the same record.

Say what the newsletter is for in terms the customer cares about, such as seasonal checklists and holiday hours. A vague promise of news and deals gives nobody a reason to tick the box.

Then send what you promised, as often as you promised. People who chose to hear from you, and hear what they expected, tend to stay.

The counter-case

A cafe that never means to send marketing email has no list to worry about. It may not need the email field at all, since a password on a card by the till does the same job.

A business that already gathers sign-ups well at the counter may not miss the Wi-Fi ones either. Its login page can simply connect people and leave it there.

Wherever an address is asked for, though, the page should say plainly what it is for, and the business should keep to that. Customers notice when an address given for one thing is used for another.

A sign-up you can rely on

1. Read your login page as a customer would.
2. Find out where the addresses are stored.
3. Set the old list aside unused.
4. Add an unticked box for the newsletter.
5. Name your business and how to reach you.
6. Record each consent with the wording shown.
7. Send a welcome email straight after sign-up.

Step six is the one that matters later. If a customer ever asks how you came to have their address, the record shows that they said yes, when, and to what.

Sorting the addresses you already hold by the basis of their consent, and what every message must now carry, are set out in the first newsletter under CASL.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.