# Captive Portal (Hotspot)

> A captive portal sends users who join a guest Wi-Fi network to a landing page for login or consent before granting internet access.

A captive portal is an access-control method used on public and guest wireless networks. When a user connects, the hotspot gateway blocks traffic from the unauthenticated device and redirects its web requests to a landing page. The user is then verified, for example by SMS code, ID details, username/password or voucher. After that the gateway opens internet access for that device with defined time, speed and quota rules, usually on authorisation from a RADIUS server.

Current operating systems detect a captive portal by requesting a well-known test URL right after joining a network, then display the landing page in a small pop-up browser window. HTTPS traffic cannot be safely redirected. So this detection mechanism must not be blocked, and the domains reachable before login (the walled garden) must be defined correctly. RFC 8910 and RFC 8908 define a standard way to advertise the portal address via DHCP or IPv6 router advertisements.

Current phones use a randomised MAC address per network by default, which undermines device recognition based solely on MAC addresses. Session lifetimes and re-authentication policies should be designed accordingly. In crowded venues, the landing page should load fast and work well on mobile.

In Türkiye, businesses that provide internet access to guests, such as hotels, cafés, restaurants, malls, schools and hospitals, are collective-use providers under Law No. 5651 and must retain access records. The captive portal makes it easier to associate those records with a user. Phone numbers and ID details collected on the portal are personal data, so a KVKK privacy notice must be provided and separate explicit consent obtained for additional purposes such as marketing.

---
Canonical: https://internetten.com.tr/en/glossary/captive-portal