Deliverability and compliance
Email marketing compliance for venues
In the UK, marketing emails to guests generally need their consent under PECR, and their data is handled under UK GDPR. A list built from explicit, recorded opt-ins answers both, and it protects your sending reputation too, because spam complaints are one of the signals mailbox providers act on.
What does UK law require before you email guests?
Two sets of rules apply. PECR (the Privacy and Electronic Communications Regulations) governs the sending: under regulation 22 you generally need a person's consent before sending them marketing by email or text, unless the soft opt-in applies. UK GDPR governs the data: what you collect, why, how long you keep it, and how guests see, correct or erase it.
Consent under UK GDPR has to be freely given, specific, informed and unambiguous, given by a clear positive action. A pre-ticked box does not count, and nor does accepting the terms of your WiFi. The ICO (the Information Commissioner's Office) regulates both sets of rules.
This guide explains the rules in general terms so you can ask the right questions. It is not legal advice: as the data controller you decide your lawful basis, and your own legal adviser should confirm it.
Does the soft opt-in cover your WiFi guests?
Usually not. The soft opt-in lets you email existing customers about similar products and services if you collected their details in the course of a sale, or negotiations for one, gave them a chance to refuse marketing at that point, and give them one in every message since.
It does not cover prospects, bought lists or everyone who joined your WiFi: a login is not a sale. Relying on it for WiFi guests stretches an exception that is narrow on purpose.
The safer basis is the one you can show: an explicit opt-in at the login, ticked by the guest, timestamped and stored with the wording they saw. It covers guests whether or not they have bought anything, and it answers a complaint with a record rather than an argument.
Wording an opt-in at the login page: the WiFi email capture guide
What changes if you also email guests in the US?
US email law starts from the other end. CAN-SPAM, the federal law on commercial email enforced by the FTC (the Federal Trade Commission), does not require consent before you send. It requires every message to identify the sender honestly, avoid misleading subject lines, include a valid physical postal address and offer a way to opt out, and you have to honour an opt-out within 10 business days.
A list built to the UK standard already goes further than CAN-SPAM asks, which is why many groups run one standard everywhere. Texts have rules of their own in both countries, so treat consent to texts separately from consent to email.
Why not buy or rent an email list?
Because the consent on it is not yours. Consent to marketing is given to a named sender, so a list someone else collected rarely carries consent to hear from your venue. And people who never chose you are likely to ignore you, unsubscribe or report you as spam.
The cost lands on your sending reputation. Old and mistyped addresses bounce, abandoned ones can be used as spam traps, and complaints count against you with mailbox providers. A small list of guests who asked to hear from you does more than a large one that did not.
- Consent names a sender, and someone else's list rarely names you
- Old and mistyped addresses bounce, and bounces count against you
- Spam complaints from people who never chose you count against your domain
What decides whether your email reaches the inbox?
Three things: whether mailbox providers can confirm the email is really from you, whether the people you send to want it, and whether you keep your list clean. Authentication covers the first: SPF and DKIM show the email came from a server and a domain you control, and DMARC tells providers what to do with email that fails those checks.
The largest providers have made this a requirement rather than advice. Google's sender guidelines, in force since 2024, ask anyone sending more than 5,000 messages a day to Gmail accounts to authenticate with SPF, DKIM and DMARC, to offer one-click unsubscribe in marketing email and to keep spam complaints below 0.3%. Yahoo set similar requirements at the same time.
Then keep the list clean. Remove addresses that hard bounce, stop emailing anyone who complains, and stop sending to guests who have ignored you for a long time, because email that nobody opens tells providers it is not wanted.
- SPF: lists the servers allowed to send email for your domain
- DKIM: signs each email so providers can check it was not changed on the way
- DMARC: tells providers what to do with email that fails those checks
- One-click unsubscribe in every marketing email
How do you keep consent records you can prove?
Record five things for every opt-in: who agreed, when, to what wording, where (which venue, which form or login page) and for which channel. If a guest says "I never signed up", that record is your answer.
Withdrawal needs the same care. An unsubscribe has to take effect at once and stay in effect, which means it must survive the next import of an old spreadsheet. Keep a suppression list of everyone who has opted out, and check it before every send, not only when the campaign is approved.
Finally, do not keep data for ever. UK GDPR expects you to keep personal data no longer than you need it, so set a retention period for guests who stop engaging, write it down and apply it. When a guest asks to be erased, erase them everywhere you hold their data, keeping only what you need to make sure they are not emailed again.
- Who: the guest's email address
- When: the date and time they agreed
- Wording: the exact text they saw, and its version
- Where: the venue, and the login page or form
- Channel: email, text or WhatsApp, each recorded separately
How Purple Engage does it
Compliance in Purple Engage
Purple Engage is the consent authority for your email, texts and WhatsApp: the one place every send checks. It supports your own legal advice rather than replacing it.
Consent per channel, with its source
One record per guest, channel, subscription group and purpose, so a yes to email is never read as a yes to texts or WhatsApp.Checked twice
Consent is checked when a campaign is approved and again just before each email goes, so a guest who unsubscribes in between is left out.Receipts and a proof pack
A receipt for every consent decision names the wording shown, the lawful basis, the source and the venue. A proof pack gathers the evidence for one campaign, one guest or a date range.Opt-outs that stay opted out
The suppression list survives re-import, a hard bounce suppresses the address, a spam complaint opts the guest out of every email group, and every marketing email has one-click unsubscribe.Your own authenticated domain
Email goes from your own sending domain, re-checked every 10 minutes, through SendGrid's EU region by default. Past its threshold, a reputation score pauses sending.Retention and erasure
Set a retention period in months, and any visit, click or form restarts the clock. Erasure runs through more than 30 registered routines, one for each place guest data is held.
Guides
Guides on email compliance
The first guides on email compliance are being written. Until they are published, these guides from the library cover related ground.
Related guides from the library
ComplianceCAN-SPAM compliance for US restaurants and venues
ComplianceEmail deliverability basics for venue marketers
ComplianceManaging consent and unsubscribes for venue email
Managing email consent correctly is the difference between a high-converting guest database and a GDPR liability.
ComplianceWhy purchased email lists fail venues
Buying email lists is one of the fastest ways to damage your sender reputation, violate GDPR, and waste marketing budgets.
ComplianceUK PECR and the soft opt-in: email marketing rules for venues
This guide explains what UK PECR requires for venue email marketing and why the soft opt-in exception is structurally insufficient for physical venues.
ComplianceGDPR-compliant email marketing for venues: a practical checklist
This practical checklist guides venue marketers through the essentials of GDPR-compliant email marketing.
Questions
Questions about email compliance
Does using Purple Engage make my email marketing compliant?
No tool is compliant on its own: it depends on how you collect consent and what you send. Purple Engage gives you the mechanisms: double opt-in forms that keep the wording each guest saw, consent recorded per channel with its source, a check before every email, a suppression list that survives re-import, retention in months and erasure through more than 30 registered routines.
Does accepting the WiFi terms count as consent to marketing?
No. Agreeing to the terms lets a guest use the WiFi. Marketing consent is a separate, clear choice, such as a box the guest ticks themselves, and only that counts in Purple Engage.
Do I need double opt-in?
UK law does not require it, but it proves the address belongs to the person who gave it, which a single box cannot. Purple Engage sign-up forms are always double opt-in, and WiFi sign-ins carry the opt-in the guest gave at the login page.
How long can I keep guest marketing data?
UK GDPR sets no fixed period: it asks you to keep personal data no longer than you need it and to be able to justify the period you choose. In Purple Engage you set it in months, and any visit, click or form submission restarts the clock.
What happens when a guest asks to be erased?
Their details are erased everywhere you hold them, and only what the law allows is kept, such as the suppression that stops them being emailed again. In Purple Engage, campaign statistics stay as counts, so your reports still add up.
Who is responsible for compliance, Purple or the venue?
The venue, as the data controller, decides the lawful basis and what is sent. Purple Engage records the basis for each consent, asks for a reference to your own legitimate interest assessment when you rely on one, and gives no legal advice.
Guide topics
The other four guide topics
List building and data capture
WiFi email capture
How to turn guest WiFi logins into a consented email list, and what to ask guests for.Campaigns and automation
Venue email campaigns
Which automations and one-off campaigns bring guests back, and when to send each one.Segmentation and targeting
Customer segmentation
How to group guests by what they do, so each group gets the message that brings it back.Analytics and ROI
Email marketing ROI
How to measure the visits and revenue your emails cause, not just the opens they get.
By type of venue
- HotelsStays from Mews and apaleo, and automations that start at checkout.
- RestaurantsWin back regulars, fill quiet weekdays and survey diners after each visit.
How Purple Engage compares
Start with consent you can prove
The free plan is listed at 500 credits a month, with unlimited* contacts and no card needed.