# Guest Wi-Fi Legal Requirements in Türkiye: Hotels & Cafés

> Guest Wi-Fi rules for hotels and cafés in Türkiye: Law 5651 logging, KVKK privacy notices and consent, user authentication methods and hotspot architecture.

Hotels, cafés and restaurants that offer guest Wi-Fi in Türkiye are collective-use providers under Law No. 5651. They must identify users by SMS or a similar method, keep access logs for two years and take measures against access to criminal content. The login process also counts as personal data processing under KVKK (Law No. 6698), so the login page needs a privacy notice, and any purpose beyond the legal duty, such as marketing, needs separate explicit consent.

A well-designed hotspot architecture covers both sets of obligations in a single login flow. The rules apply to every venue in Türkiye, including international hotel chains. This guide is general information, not legal advice.

## Law 5651 and KVKK: what each law covers

Guest Wi-Fi falls under two laws at the same time, and each one answers a different question:

| Topic | Law 5651 and the 2017 Regulation | KVKK (Law No. 6698) |
|---|---|---|
| Purpose | Preventing crime and tracing online acts back to a person | Lawful processing of personal data |
| The venue's role | Collective-use provider | Data controller |
| Core duties | Identify users, keep access logs, use content filtering | Privacy notice, legal basis, data security, disposal |
| Is consent needed? | No, the duty comes from the Law | Not for logs. Yes for marketing and profiling |
| Retention | Access logs for two years | Only as long as the purpose requires, then delete or anonymize |

In practice, Law 5651 logs are kept because the law expressly requires them and they fulfil a legal obligation, so no consent is needed. Users must still be told clearly about that processing.

## User authentication methods

The Regulation calls for users in public venues to be identified "by short message service (SMS) and similar methods". "Similar" is generally read as any method that links the user to a real person. A single Wi-Fi password shared by everyone does not identify anyone.

| Method | How it works | Strength | Watch out for |
|---|---|---|---|
| SMS verification | A one-time code is sent to the phone | Mobile lines in Türkiye are registered to an ID. The most common method | SMS costs, delivery problems to foreign numbers |
| Call verification | The user calls, or receives a call from, a number | A fallback when SMS doesn't arrive | Call charges and user familiarity |
| WhatsApp verification | A code or confirmation arrives via WhatsApp | High success rate with foreign tourists | Needs mobile data or pre-login access to WhatsApp (walled garden) |
| Turkish ID number | Checked against name, surname and birth year | Strong identity link | Turkish citizens only, minimize what you store |
| Chip ID card (NFC) | The card's chip is read with a phone | Resistant to forgery | Requires an NFC-capable device |
| Passport | Passport details are entered or scanned | Suits foreign guests | Assurance depends on the verification method |
| Hotel PMS integration | Login with room number and surname | Identity already verified at check-in | Needs a PMS connection, access should end at check-out |
| Username/password, QR, voucher | Personal credentials issued at reception | Practical for events and meetings | Record who received which voucher |
| Email confirmation | A link sent by email | Easy | Weak identity link on its own |

Social media login ties a user to a real person only weakly and involves sharing data with the platform, so it should not be the only option. In general, don't rely on a single method. Pair SMS for local guests with WhatsApp or passport for international guests, and add PMS login in hotels. More guests get through the login that way, and the identification duty is still met. [WiPoint](/en/solutions/wipoint) supports 12 authentication methods on the same portal, among them SMS, call, WhatsApp, Turkish ID, NFC ID card, passport and PMS integration.

## KVKK: privacy notice and explicit consent

### What the privacy notice must cover

Under Article 10 of KVKK and the Communiqué on the Procedures and Principles of the Obligation to Inform, the notice must state:

- who the data controller is, and its representative if there is one
- what data is processed and why (phone number, MAC address, IP address, session times)
- to whom and for what purpose data may be transferred, for example to authorized judicial and administrative bodies or the hotspot service provider
- how the data is collected and on what legal basis
- the data subject's rights under Article 11

Link the notice from the portal so it is one tap away, and write it in plain language.

### When explicit consent is needed

- Campaign SMS messages and newsletters, which also need commercial electronic message approval under Law No. 6563, registered in the Message Management System (İYS)
- Visit-frequency analytics, profiling or ad targeting
- Sharing data with third parties for marketing

Rules for collecting consent:

- Keep the privacy notice and the consent request separate. The Communiqué requires them to be handled independently.
- Never pre-tick consent boxes.
- Don't make internet access conditional on marketing consent. Users who decline must still be able to verify and connect.
- Store consent records (text version, time, user) and make withdrawal easy.

### Service providers and cross-border storage

A company that runs your hotspot or stores your logs acts as a data processor, so you need a data processing agreement and documented security measures. If its servers are outside Türkiye, the transfer rules in KVKK Article 9, amended in 2024, also apply.

## Network and security settings for guest Wi-Fi

- **Segmentation:** use a separate SSID and VLAN, isolated from POS, cameras and staff networks.
- **Client isolation:** stop guest devices from reaching each other.
- **Bandwidth and quotas:** set per-user speed limits, a concurrent device cap and session duration.
- **Content measures:** use DNS-based filtering to prevent access to criminal content (Law 5651, Article 7).
- **Encryption:** open networks send traffic unencrypted over the air. Wi-Fi Enhanced Open (OWE) encrypts it without a password, but how well it works with captive portals depends on client support.
- **Time sync:** synchronize every device via NTP.
- **MAC randomization:** iOS and Android use private, per-network MAC addresses that can change over time. Build logs around authenticated users and sessions instead of MAC addresses alone.
- **Procedures:** decide in writing who answers a records request from authorities, and how.

## Hotspot architecture for compliant guest Wi-Fi

A compliant guest Wi-Fi setup has six parts:

1. **Access points:** broadcast the guest SSID with client isolation.
2. **Hotspot gateway:** handles DHCP, NAT, captive portal redirection and speed profiles, typically on MikroTik or UniFi.
3. **Captive portal:** shows the welcome page, authentication methods, privacy notice and consent options.
4. **RADIUS:** authorizes sessions based on the authentication result and records accounting data (start/stop, IP, MAC, traffic).
5. **Log archive:** stores DHCP, session and NAT records with daily hashes and RFC 3161 timestamps for two years.
6. **Management and reporting panel.**

The login flow:

1. The guest joins the SSID and gets a private IP via DHCP.
2. The browser is redirected to the captive portal. A walled garden allows only the domains needed for authentication.
3. The guest reads the privacy notice, picks a method and is verified. Marketing consent, if given, is recorded separately.
4. The portal passes the result to RADIUS, and the gateway opens the session and applies the speed and quota profile.
5. Accounting records and DHCP/NAT logs flow into the central archive.
6. At the end of each day, records are hashed and timestamped. Records past their retention period are disposed of.

| Criterion | On-site hotspot server | Cloud hotspot |
|---|---|---|
| Setup | Server or software at every location | Existing router connects to the cloud |
| Updates and backups | Handled on site | Handled centrally |
| Multiple branches | Each branch managed separately | One panel |
| Log safety | Risk of loss if the device fails or is stolen | Records stored off site |
| Internet outage | Portal keeps working locally | New logins may be affected, depending on design |

Hotspot-capable access points and routers from vendors such as MikroTik and Ubiquiti are available through [wi.com.tr](/en/solutions/wi-com-tr).

## Frequently asked questions

### Is a single shared Wi-Fi password enough for Law 5651?

No. A shared password doesn't show who connected. Users in public venues must be identified by SMS or a similar method, and access logs must be kept. You can still run an encrypted network together with captive portal authentication.

### Which authentication method works best for foreign tourists?

WhatsApp, passport and, in hotels, PMS integration are the most practical options. SMS delivery to foreign numbers isn't always reliable, so SMS shouldn't be the only method.

### Do I need KVKK consent every time a guest logs in?

Not for Law 5651 logs. That processing rests on a legal obligation, so a privacy notice is enough. If you plan to send campaign messages, build profiles or share data with third parties, you need separate, optional explicit consent.

### Should logs live on my own server or with a service provider?

Either works, but the venue remains legally responsible in both cases. If you use a provider, put the retention period, data location, access rights, timestamp method and data handover at contract end in writing.

### Do randomized MAC addresses cause problems?

They don't remove the logging duty, but they make device recognition harder. The same phone may appear with different MAC addresses on different networks or over time. Match records to authenticated users and sessions instead of MAC addresses alone, and set "remember this device" periods with that in mind.

---
Canonical: https://internetten.com.tr/en/knowledge-base/guest-wifi-legal-requirements-turkey