Hotel guest Wi-Fi in Türkiye: login, logs and Law 5651

In Türkiye, Law No. 5651 defines a collective use provider as anyone who gives people the use of the internet at a certain place for a certain time, and requires such providers to keep access records. The 2017 regulation sets a two-year retention period for those in scope and lists the fields. Whether a hotel falls in scope is a legal reading to confirm in writing.

A guest asks reception for the Wi-Fi password, the router keeps a rolling buffer of a few hours, and the owner has been told by three different people that hotels must keep guest internet records for two years. Only one of those three people has read the text. After reading this article you will know what the law on hotel Wi-Fi in Türkiye (opens in a new tab) actually says, which records the regulation asks for, and which seven questions to send to your IT provider and your lawyer.

Does a hotel in Türkiye have to log guest Wi-Fi?#

Yes, if the hotel is a collective use provider: Law No. 5651 places record-keeping duties on anyone who gives people internet access at a certain place for a certain time, and adds permit duties on those who do it for commercial purposes.

The law was adopted on 4 May 2007 and published in the Resmî Gazete on 23 May 2007, No. 26530. Article 2(1)(i) defines the collective use provider (toplu kullanım sağlayıcı) as anyone who gives people the use of the internet at a certain place for a certain time. Article 7 puts two duties on every such provider, commercial or not: take the measures set by regulation to block access to content that constitutes a crime, and keep access records of use.

Commercial providers carry more. They need a permit from the local civil administrator, who reports the permit information to the Cyber Security Presidency within thirty days and inspects these providers. They must also take measures to protect families and children, prevent crime and identify offenders.

The law says who and what in outline. The how comes from the Regulation on Internet Collective Use Providers, issued by BTK and published on 11 April 2017, No. 30035, which replaced the 2007 regulation. Neither text names hotels. That gap is the whole reason this article ends with questions for a lawyer rather than a product recommendation.

Guest identity notification (KBS) and personal data (KVKK) are separate duties that run alongside this one; they are covered in our KVKK guide for hotels.

Who counts as a collective use provider?#

The law's definition is broad and has no size threshold; the regulation's definition of a commercial-purpose provider is narrower and names internet salons and similar public places, not hotels.

The law's words are wide: a certain place, a certain time. A lobby, a pool bar, a meeting room and a guest room all fit those words without stretching them. Article 3 of the regulation, by contrast, defines commercial-purpose providers as the people or companies that provide collective internet use for a fee at internet salons and similar places open to the public.

The hinge is "for a fee". A hotel does not sell Wi-Fi as a line item; it is included in the room rate. Whether that counts as a fee is a legal reading, not a technical one, and it decides which set of duties applies. The regulation does not exclude hotels, and the law does not name them, so two readings are possible. That is exactly why the answer should come in writing from a lawyer who has read both texts.

The practical split matters: the universal duties (filtering, records) apply to every provider, while the permit, fixed IP and daily integrity value sit in the commercial chapter. A hotel that also runs a paid business centre or a co-working desk has a second, separate question to ask about that outlet.

What has to be kept, and for how long?#

Article 4 of the regulation says access records are saved electronically on the provider's own systems and kept for two years, and Article 3 lists exactly which fields those records contain.

The fields are the IP addresses distributed inside the network, the start and end times of use, the MAC address of the device using that IP, the destination IP address, and, where addresses are shared through ports, the real IP and port assigned to the user. Two years, on your own systems. Not on the router's rolling buffer, not in a vendor's dashboard you cannot export from.

If the hotel offers access in public areas, Article 4 also asks for systems that identify users by SMS or similar methods. Commercial-purpose providers keep the same records plus a value recorded daily that confirms their accuracy, integrity and confidentiality, also for two years. In plain words: a daily fingerprint of the day's records, so that a later edit shows.

Filtering is part of the same article: a content filtering system to prevent access to content that constitutes a crime, and for commercial providers a secure internet service kept active and up to date.

What the list does not contain is just as important: no guest name, no room number, no passport. Those belong to other duties and other rules, and mixing them into the Wi-Fi record creates a personal data problem rather than solving one.

For the vocabulary behind these fields, see our hotel network and Wi-Fi terms explained.

Which guest login method should a hotel use?#

Any method that ties a session to an identifiable user and writes the fields above will do; the choice is about guest friction and about what the record can actually prove.

The login page a guest sees before the internet works is called a captive portal. It is the identification step, not the record: the record is what the network equipment writes afterwards.

Room number plus surname is the lowest-friction option and records the room, but a shared room number proves the room, not the person. An SMS one-time code proves that a phone number was reachable at that moment, and records the number and the time; it adds a step and a message cost, and some guests have no local number. A voucher or printed code issued at the desk suits groups and staff, but codes get shared, and the record shows the code rather than the guest. Device-based auto-login is the smoothest for returning guests, but modern phones randomize their MAC address, so the identifier may change on every connection. That is a technical limit to raise with the provider, not a reason to skip the record.

Whatever the method, the equipment must write start time, end time, internal IP, destination IP and the identifier into storage the hotel controls. Keep the guest network separate from staff, payment and device networks, so that a guest session cannot reach the systems that hold money or personal data; our article on separating guest, staff, payment and device networks covers the design.

Keeping records usable: time, integrity and access#

A record that cannot be produced, or that carries the wrong time, is worth nothing, so the real work is a correct clock, storage that is not overwritten, and a daily seal.

Clock first. If the router, the switch and the logging server disagree about the time, the start and end times in the record are wrong even when the fields are complete. Point every device at one time source and check it.

Storage second. Many routers keep a short buffer and overwrite it within hours. The regulation asks for the records on the provider's own systems for two years, so find out where the record actually lands before assuming it does. The daily value is a fingerprint of that day's records: if someone edits or deletes a record afterwards, the fingerprint no longer matches, and the change shows. It does not prevent editing; it makes editing visible.

Access third. The records contain personal data, so decide which named people can read them and keep that list short. Reconcile the two-year record duty with your KVKK retention and destruction policy rather than running two rules that contradict each other. Back up the records: a single disk in the reception cupboard is one failure away from producing nothing when someone asks.

What do the permit, the fixed IP and the penalties involve?#

For commercial-purpose providers the regulation adds a permit from the local civil administrator, a fixed IP address with any change reported within fifteen days, and a duty to report closure or transfer within fifteen days.

The permit comes from the governor in a province and the district governor in a district. The law says the administrator reports the permit information to the Cyber Security Presidency within thirty days and inspects these providers. The fixed IP comes from the access provider, and any change must be reported within fifteen days; a hotel that changes operator or line without telling anyone has broken a fifteen-day duty, not a technical detail. Closing or transferring the business must also be reported within fifteen days, and the permit handed in.

The law sets the sanction ladder: depending on how serious the breach is, a warning, an administrative fine of 1,000 to 15,000 Turkish lira, or stopping commercial activity for up to three days. Those lira amounts are the ones written in the law. They are not the amounts applied today: under Article 17(7) of the Misdemeanours Law No. 5326, administrative fines that are not proportional are raised at the start of every calendar year by the revaluation rate set under the Tax Procedure Law, so the limits applied in 2026 are higher. Ask an adviser for the current figures rather than quoting the law's text.

What should a hotel ask its IT provider and its lawyer?#

Put the same questions to both, in writing, and keep the answers: the lawyer settles scope, the IT provider settles whether the equipment can actually produce what the text asks for.

Scope is the first question and it is not technical: are we a collective use provider under Law No. 5651, and are we a commercial-purpose provider under the 2017 regulation? Ask for the answer in writing, with the reasoning. Then the equipment: which device writes the access record, and does it hold every field in Article 3, including the real IP and port where addresses are shared? Then storage: where does the record land, on whose system, and how long before it is overwritten?

Then time: do all network devices take their time from one source, and who checks that monthly? Then integrity and access: how is the daily value produced, and which named people can read the records? Then paperwork: do we hold the permit, the fixed IP, and a process for reporting a change within fifteen days? Finally, the overlap: how do these records sit with our KVKK retention and destruction policy, and who produces a record when an authorized authority asks?

What to do next#

Send the seven questions to your IT provider and your lawyer on the same day, and ask for written answers. The law decides who counts, the regulation decides which records and for how long, the login method decides what the record can prove, and the clock, storage and daily value decide whether the record survives being asked for. Fix the clock and the storage this month; leave scope to the lawyer.