Those captive portals generally kind of suck; you can (or could, the last time I personally tried was pre-pandemic) get around them with mac spoofing or tunneli

Those captive portals generally kind of suck; you can (or could, the last time I personally tried was pre-pandemic) get around them with mac spoofing or tunneling traffic over UDP 53/853. They'd have to keep long-lived NAT logs on the gateway to tell that the infringement was from the guest SSID. But I guess at that point you may as well just full-on wardrive it.