Putting open WiFi in front of a crowd, without creating a problem.

The controls that actually matter

• Client isolation. The single most valuable setting, and the one most often missed. Devices on the public network should not be able to see or reach each other. Without it, you have put several hundred strangers on a shared network and invited them to look around.
• Separation from everything else. Public traffic must not share a network with your traders, tills or ticket scanners. Different VLANs, not just different passwords.
• Acceptable use terms at the portal. Short, readable, accepted before access. This is what lets you cut someone off without an argument, and it sets expectations.
• Content filtering where children are present. Not a universal legal requirement in the UK, but at a family event it is both expected and sensible. Schemes like Friendly WiFi exist precisely because the expectation is real.
• Rate limiting. Less about safety, more about one person not ruining it for everyone. Worth doing anyway.

Data protection, which is the bit people underestimate

The moment your portal collects an email address, a name, or anything tied to a device, UK GDPR is engaged and you are responsible for it. This is the part that creates actual obligations, and it is usually an afterthought behind the filtering question.

• Collect less. The safest data is the data you never took. If you do not need an email to provide access, do not ask for one.
• Separate access from marketing. If you want opt-ins, that is a distinct, unticked, clearly-worded consent. Access must not be conditional on accepting marketing.
• Say what you keep and for how long, and then actually delete it. A retention period nobody enforces is worse than none, because you have stated it.
• Know who the controller is. Usually the organiser for anything collected in their name. Get it in writing with whoever runs the network.
• Ours is set out in the privacy notice and the trust page, including what we log and what we deliberately do not.

Logging: less is usually better

There is a widespread belief that an event must retain detailed logs of what guests did. For a short-term event network run by a small supplier, the heavy telecoms retention duties that people are thinking of generally do not apply.

What you want is enough to run and secure the network, and no more. Extensive logs of browsing activity are a liability to hold, a burden to secure, and something you may have to hand over or explain. We keep technical operational data and purge most of it at the end of the event, deliberately.

Things that are not worth your worry

• Being liable for every site a guest visits. A provider that merely conveys traffic is in a very different position from one that selects or modifies it.
• Verifying identity of every user. Not required, creates a data protection burden, and slows down the gate.
• Blocking everything that could conceivably be misused. Over-filtering generates complaints from people who cannot reach their banking app, and achieves little.

A note on where this advice stops

This is general information from people who build event networks, not legal advice, and we are not solicitors. The law changes, and your circumstances may pull in duties that do not apply to a typical event: a licensing condition, a venue policy, a local authority requirement, or an event aimed specifically at children.

Where the stakes are high, take your own advice. Where you want the network built so that the sensible controls are on by default, that is what we do.