What Is Proximity Marketing and How Does It Work?

A shopper is standing outside a shop on level two. Her phone knows she is there. The shop has the jacket she looked at online sitting on a rack two metres behind the glass, and nobody tells her. Closing that gap is the whole of proximity marketing.

The idea is not new. Doing it inside a building is the hard part, and it is where most campaigns quietly die: the positioning cannot tell one shop from its neighbour, the consent was collected in a way that does not hold up, or the app fires six notifications in one visit and gets muted for good. This page covers what proximity marketing is, which technologies can actually trigger it, what consent law now requires before the first message goes out, and how to tell whether a campaign earned anything.

What is proximity marketing?

Proximity marketing is a message triggered by where a person is standing, usually within a few metres of a shop, a gate or an exhibit, delivered to a phone through an app that person has installed and given permission to notify them.

The confusion usually sits between three words that get used as synonyms and are not.

The difference is commercial, not academic. A city-level ad reaches someone who might visit this month. A geofence around the car park reaches someone who is already here. A proximity trigger reaches someone whose feet are pointed at the window, which is the only one of the three where a discount can change what happens in the next minute.

How does proximity marketing work?

Four things have to be true at once: the visitor carries your app or a partner app, the venue can locate them accurately enough, a zone is drawn where the message should fire, and consent covers both the location and the notification.

1. The app. It can be your own, or the venue’s map app, or a retail partner’s. No app and no web session means no channel.
2. The positioning. Whatever method the venue uses has to resolve the space you are aiming at, whether that is a floor, a wing or a doorway.
3. The zone. A polygon on the indoor map, with rules for entry, exit and dwell.
4. The permission. Location access and notification access, granted knowingly, revocable at any time.

The part most teams underbuild is the fifth thing, which is not a requirement but a governor: the logic that decides whether a message a person qualifies for should actually be sent. Dwell thresholds of thirty seconds or more stop a trigger firing on someone walking past. A frequency cap decides how many messages one visit can carry. Quiet hours, a cooldown per campaign, and a hard rule of one offer per zone per day are what keep the channel alive for the next quarter.

Without that layer, a campaign works on day one and is switched off by the user on day three. The opt-out is the real budget.

Which positioning technology should trigger the message?

Choose by the accuracy the message needs, not by what is cheapest to pilot. A welcome message in the car park tolerates tens of metres. A message about the display window in front of the reader does not.

The last row is the one that has changed the economics. A modern phone carries an accelerometer, a gyroscope, a magnetometer and a barometer, and the magnetic signature of a steel-framed building is distinctive enough to be matched against a survey of that building. Fusing those signals against a mapped venue gives a position indoors without anything being installed in the ceiling.

Each option is a trade, and the trade is rarely about accuracy alone. Beacons are simple to reason about and genuinely cheap at one doorway. At two hundred doorways they become an estate with a maintenance rota, a battery replacement cycle and a spreadsheet nobody wants to own.

Why does GPS geofencing fail inside a building?

Because the building attenuates and reflects the satellite signal. The US government states that GPS-enabled smartphones are typically accurate to within a 4.9 m radius under open sky, and that accuracy worsens near buildings, bridges and trees (gps.gov, GPS accuracy, current edition).

Read that figure carefully, because it is the best case. A 4.9 m radius is a circle almost ten metres across, measured outdoors with a clear view of the sky. Indoors the same receiver is working with signals that have passed through a roof and bounced off structural steel, so the error grows and stops being random: it drifts. A trigger aimed at one shopfront lands on three, or on the unit above.

The web platform inherits the same limit. The Geolocation API hands a page whatever the device can supply and nothing better, and requires the user’s express permission first (w3.org, Geolocation API specification, current edition). A browser cannot rescue a position the hardware never had.

This is why outdoor geofencing and indoor proximity are separate problems that happen to share a vocabulary. The first is solved. The second needs a map.

What does the law require before you send the first notification?

Consent, obtained before anything is read from or written to the phone, specific to location, and withdrawable. That thread runs through the EU, California and Canada. It is a design constraint on the product, not a footnote for the legal team.

In the EU, location data is named as personal data in Article 4(1) of the General Data Protection Regulation, which has applied since 25 May 2018. Recital 32 rules out silence, pre-ticked boxes and inactivity as consent, and Article 7(3) gives the person the right to withdraw at any time, as easily as they gave it. Separately, Article 5(3) of the ePrivacy Directive requires informed consent before storing information on, or gaining access to information already stored on, a user’s device. That covers an app reading a Bluetooth scan result, not only cookies.

California is blunter about indoor location specifically. The CCPA as amended defines precise geolocation as data capable of locating a consumer inside a circle with a radius of 1,850 feet, roughly 564 metres, and classes it as sensitive personal information with a right to limit its use (Cal. Civ. Code § 1798.140; see also the California Attorney General). Any system that can tell one shop from the shop next door is far more precise than that threshold. In-venue positioning is sensitive data in California by definition, not by interpretation.

The US Federal Trade Commission treats precise location as sensitive in its privacy work and has brought enforcement actions over its collection and sale (ftc.gov, privacy and security business guidance). In Canada, the Office of the Privacy Commissioner holds organisations to meaningful consent under PIPEDA, which means an explanation a visitor can actually understand (priv.gc.ca).

Three things follow for anyone building this:

• Ask for location and notifications as two separate, explained decisions, at the moment each one buys the visitor something.
• Store consent with a timestamp and the version of the wording shown, because a consent you cannot evidence is a consent you do not have.
• Make the off switch take effect on the next zone crossing, not the next release.

What does a proximity campaign look like in a mall, an airport or a hospital?

The same machinery does very different jobs. In a mall it moves a shopper towards a shop. At an airport it moves a passenger towards a gate, and past retail on the way. In a hospital it usually should not be marketing at all.

Shopping malls. A welcome message on arrival in the car park, an offer from an anchor tenant when the shopper is on the right level, and a link into the map for anything harder to find than the food court. Mapsted’s mall deployments combine indoor-outdoor navigation, targeted offers and visitor analytics with no beacons, no Wi-Fi and no on-site hardware (mapsted.com, mall navigation and analytics).

Airports and rail. Timing carries more weight than the offer. A restaurant promotion sent before security is an irritation to a passenger watching the queue; the same promotion sent once they are through, with the walking time to their gate attached, is useful information that happens to sell a sandwich.

Hospitals and campuses. The valuable message on arrival day is a route to the right department, in the right language, for a person who is anxious and probably late. Wayfinding is the product. Anything commercial belongs in the retail concourse, if anywhere.

Museums and venues. The exhibit is the trigger. Standing in front of an object and receiving the story behind it is the one case where visitors reliably want more notifications, not fewer.

The pattern common to all four is that the message is useful within the next minute. A message that would have been just as good by email is not a proximity campaign. It is an email that startled somebody.

How do you measure whether it worked?

Against a holdout. Hold back a comparable slice of opted-in visitors who receive nothing, then compare their behaviour with the group that received the message. Without that, you are measuring the venue’s footfall and calling it a campaign.

Two of those deserve care. Tap rate flatters a campaign that has been throttled down to its most obvious offer, so read it beside total taps rather than alone. Opt-out rate is the only metric that compounds: every visitor who mutes the app is removed from every future campaign, and they do not come back.

Foot traffic patterns, dwell times and zone-level heat maps are where the durable value sits, because they keep paying after the campaign ends. Knowing that a third of visitors reaching level three turn left and never pass three tenants changes leasing conversations, not just promotions.

When is proximity marketing the wrong choice?

When almost nobody has the app, when the venue has no other reason to be mapped, or when nothing you want to say is time-sensitive. In those cases the honest answers are signage, staff and email, in that order.

• Low app penetration. If a thousand people a day carry your app in a venue of forty thousand, fix distribution first. A precise message to nobody is still nobody.

• One trigger point. A single doorway, a single pop-up stand, no venue map and no app of your own: a Bluetooth Low Energy beacon or an NFC tag is cheaper and finishes on Friday. Beacons are sometimes the right answer, and a vendor who tells you otherwise is selling.

• No consent path. If the only way to get the audience is a permission prompt you would be embarrassed to explain, there is no campaign here. There is a complaint waiting.

• Offers that are not offers. Ten per cent off something the visitor was already carrying to the till does not need a location trigger. It needs a better offer.

Where a trade-off is real it is better stated than hidden. Hardware-free positioning needs an accurate map and a survey of the building, which is work. Beacons need hardware, which is also work. There is no option on the table with zero setup.

How do you run proximity marketing without installing hardware?

By positioning from the phone’s own sensors and an accurate indoor map, instead of from equipment mounted in the ceiling. That is how Mapsted’s platform works: no beacons, no Wi-Fi and no on-site hardware for the venue to buy, mount or maintain.

What that buys a venue operator is a shorter path from decision to live campaign. There is no procurement cycle for hardware, no installation window negotiated around trading hours, and no battery replacement schedule arriving eighteen months later. Zones are drawn on the indoor map, messages are attached to them with entry, dwell and frequency rules, and the same positioning layer feeds the analytics that tell you where visitors actually went.

What it does not remove is the work that matters: a correct, current map of the building, a consent flow a visitor can read, and something worth saying when they arrive. Those three are the campaign. The positioning is only what makes them possible indoors.

Bring us your floor plan. If you operate a mall, an airport, a hospital or a campus, the fastest way to see whether proximity marketing is worth it on your site is to look at your own building: where the zones would sit, which paths visitors already take, and what could reasonably be triggered. Talk to Mapsted about your venue and we will walk through it with you.

Frequently Asked Questions

Is proximity marketing legal?

Yes, with consent. In the EU you need freely given, specific and informed consent before accessing the device, under the GDPR and Article 5(3) of the ePrivacy Directive. In California, precise location is sensitive personal information under the CCPA as amended, carrying a right to limit its use. Canada requires meaningful consent under PIPEDA. The common rule is simple: ask first, explain plainly, and make withdrawal easy.

Does proximity marketing work without an app?

Only partially. A web page can request the visitor’s position through the browser, but it gets whatever accuracy the device offers and only while the page is open, so it cannot wake a phone in a shop. NFC tags and QR codes work without an app because the visitor initiates the interaction. For anything that fires on its own as a person moves, an installed app is still the channel.

How close is proximity?

Closer than geofencing and much closer than geotargeting. A useful working figure is a few metres, meaning the system can tell one shop, gate or exhibit from the one beside it. For comparison, GPS smartphones manage about a 4.9 m radius outdoors under open sky and worse indoors, which is why in-venue triggers need indoor positioning rather than satellite positioning alone.

Do I need beacons for proximity marketing?

Not any more, though beacons still suit some jobs. Bluetooth Low Energy beacons give a cheap, well-understood trigger at one or two fixed points. Across a whole venue they become an estate to mount, power and maintain. Sensor-fusion positioning reaches the same zones using the phone’s own sensors against a mapped building, which removes the hardware but adds a mapping and calibration requirement.

How many notifications are too many?

Fewer than most campaigns send. A practical starting point is one message per visit, one per campaign per day, a dwell threshold of at least thirty seconds so passers-by are not triggered, and no messages outside trading hours. Then watch the opt-out rate rather than the tap rate, because every visitor who mutes the app is lost to every future campaign as well.