Turkish Law 5651: Logging Obligations for Public Wi-Fi Providers

Under Türkiye's Law No. 5651, anyone who gives people internet access at a particular place for a particular period is a collective-use provider (toplu kullanım sağlayıcı), which includes hotels, cafés, restaurants, schools, dormitories, hospitals and shopping malls. All of them must use content filtering to prevent access to criminal content, record access logs (known in the industry as internal IP allocation logs) electronically and keep them for two years, and identify users in public venues via SMS or similar methods. Commercial providers such as internet cafés must also keep a daily value that proves the integrity of those records.

These duties come from the Regulation on Internet Collective-Use Providers of 11 April 2017. This guide explains them, shows how they translate into technology and covers how they interact with KVKK, Türkiye's data protection law. It is general information, not legal advice.

Who counts as a collective-use provider?

Article 2 of the Law defines a collective-use provider as anyone who offers people the opportunity to use the internet at a certain place and for a certain period. It makes no difference whether access is free or paid, or whether the business is Turkish- or foreign-owned. In practice there are two groups:

• Commercial collective-use providers: internet cafés and gaming halls whose business is selling internet use. Under Article 7 of the Law they need a permit from the local civil administration (the governor's or district governor's office).
• Non-commercial collective-use providers: businesses and institutions that offer internet alongside their main service. Examples are hotels, cafés, restaurants, malls, schools, dormitories, hospitals, public buildings and offices with guest Wi-Fi.

The competent authority is the Information and Communication Technologies Authority (BTK). It took over the duties of the Telecommunications Communication Presidency (TİB) when TİB was closed in 2016.

Legal basis: Law 5651 and the 2017 Regulation

Two texts set the rules:

1. Law No. 5651, Article 7: requires commercial collective-use providers to obtain a permit, and requires all collective-use providers to take measures preventing access to content that constitutes a crime. The civil administration notifies the BTK of permit details within thirty days.
2. Regulation on Internet Collective-Use Providers (Official Gazette, 11 April 2017, No. 30035): replaced the 2007 regulation. Article 4 lists the duties of all collective-use providers, and Article 5 lists the additional duties of commercial ones. The Regulation extended log retention from one year to two and made user identification mandatory in public venues.

One detail matters in practice. The old rules expected logs to be signed "with software provided by the Presidency". That wording has been removed, and the BTK says it no longer supports its IP Log Signer tool. Providers may therefore choose their own method, but they still have to be able to prove integrity.

What needs to be logged?

Logs are kept so that you can show, after the fact, which device and user was using a given IP address at a given moment. Monitoring content is not their purpose. The ISP knows the venue's public IP address. Dozens of guests may share that one address, though, so only the venue's own records can show who held which private IP inside the network.

An access log should include at least:

• the internal (private) IP address and the device's MAC address
• when the IP was assigned and released (DHCP lease start and end)
• the hotspot authentication details, such as phone number, room number or verification result
• session start and end times
• the public IP address the venue used

Many venues also keep NAT records (public IP, source port, time) to make matching easier when authorities ask. Recording the content of visited pages, on the other hand, creates unnecessary data and can conflict with the proportionality principle in KVKK.

Clocks have to be accurate. Your records will be matched against the ISP's records down to the second, so routers, hotspot gateways and log servers must all sync to accurate time via NTP.

Timestamps and integrity values

Article 5 of the Regulation requires commercial providers to store the recorded data every day together with a value confirming its accuracy, integrity and confidentiality, and to keep both for two years. The Regulation does not list this duty for non-commercial venues such as hotels, cafés or schools. Logs are only credible if you can show they haven't been altered, though, so applying the same method everywhere is established good practice.

The usual approach:

1. At the end of each day, the log file is closed and hashed with a current algorithm such as SHA-256.
2. The hash is sent to a BTK-authorised certificate service provider to obtain an RFC 3161 timestamp. Only the hash leaves the building. The file itself stays on site.
3. The timestamp token is archived next to the log file. If each day's hash also covers the previous day's, even the deletion of a whole day becomes detectable.

If a single character in the file changes, the hash no longer matches. The timestamp independently proves that the record existed on that date. WiPoint uses this method for guest session records: it seals them with RFC 3161 timestamps and keeps them in an immutable archive for two years.

Retention periods

The Regulation says records are kept "on the provider's own systems". That does not prevent a venue from using a service partner, but the legal duty stays with the venue. The contract should therefore state the retention period, data location, access rights and how data is handed over when the contract ends.

Inspections and penalties

• Commercial providers answer to the local civil administration for permits and inspections. Under Article 7 of the Law, the local administrative authority fines anyone operating without a permit. Statutory fine amounts are revalued every year under the Law on Misdemeanours, so check the current figure for the relevant year.
• For every provider, the most concrete risk usually comes up during a criminal investigation. Prosecutors or police may ask who used the venue's IP address at a specific time. If no record can be produced, the perpetrator cannot be identified, and the venue's managers may be drawn into the investigation themselves.
• Records must also be usable. A corrupted file, a missing day or a wrong clock can have much the same effect as having no log at all.

How Law 5651 interacts with KVKK

IP addresses, MAC addresses and phone numbers in access logs are personal data, so KVKK (Law No. 6698) applies as well:

• Legal basis: logging under Law 5651 relies on two grounds in Article 5(2) of KVKK: processing "expressly provided for by law" and "necessary to comply with a legal obligation". Explicit consent is not required. Asking for it would create an impossible situation if a user later withdrew it.
• Privacy notice: even without consent, the login page must tell users what data is processed, why and for how long.
• Separate purposes need separate consent: marketing SMS, newsletters or profiling go beyond the legal duty. They need separate explicit consent with an unticked box. Commercial electronic messages also have to be registered in the Message Management System (İYS) under Law No. 6563.
• Security and disposal: restrict access to logs, record who accesses them, and delete or anonymize records once the two years are up.
• Cross-border storage: if logs are stored in a cloud outside Türkiye, assess this against the transfer rules in Article 9 of KVKK, which was amended in 2024.

Compliance checklist

1. Put guest Wi-Fi on a separate SSID/VLAN from staff and business systems.
2. Use a captive portal that identifies users by SMS or an equivalent method.
3. Collect DHCP, hotspot session and, where needed, NAT records centrally.
4. Synchronize every device via NTP.
5. Hash daily records and seal them with RFC 3161 timestamps.
6. Keep the archive for two years in immutable, backed-up storage, then dispose of it.
7. Add a KVKK privacy notice to the login page and keep marketing consent separate.
8. Take measures such as DNS-based filtering against access to criminal content.
9. Write down who handles a records request from authorities, and how.

Frequently asked questions

Does a café offering free Wi-Fi fall under Law 5651?

Yes. The definition doesn't depend on whether access is paid, so a café offering internet on its premises is a collective-use provider. The permit requirement applies only to internet cafés. Logging and user identification apply to ordinary cafés too.

How long do logs have to be kept?

Under the 2017 Regulation, access logs must be kept for two years, and commercial providers must also keep their daily integrity values for two years. The one-year period from the 2007 rules no longer applies. Once the period ends, KVKK requires the records to be deleted or anonymized.

Is a timestamp mandatory?

The Regulation doesn't name a specific technology. It requires commercial providers to keep a daily value confirming the integrity of their records, and it doesn't explicitly impose that duty on other venues. A qualified timestamp gives independent proof of when that value was created. For commercial providers it is the strongest option, and for everyone else it is recommended good practice.

Do I need users' consent to keep logs?

No. The logging duty comes from the Law, so it rests on KVKK grounds other than consent. You still have to give users a privacy notice, and you need separate explicit consent for extra purposes such as marketing.

Is a syslog server enough for Law 5651 compliance?

Not on its own. A central log platform such as Syslog collects DHCP and NAT records from your devices and makes them searchable. Compliance also requires user identification, daily integrity values, a two-year immutable archive and KVKK processes.