The "it logs every website" myth: what a hotspot really records

Where the myth comes from

When we talk to business owners, one sentence comes up again and again: "The box records every site the guest visits, so we are covered." The belief has two roots. One is the screen-monitoring software that old internet cafés used to run. The other is the everyday reading of "keeping logs" as "keeping everything".

What Law 5651 actually expects from a public access provider is a set of internal IP allocation records: which device held which internal IP address at what time. In other words, the answer to "who was on the network, when, with which address". The question "what did they read or watch" is simply not part of it.

The technical reality: HTTPS closed the door

Almost every site a guest opens on a phone today is served over HTTPS. What that means in practice:

• The content of the page is encrypted. Nothing in the middle can read it.
• The full address (URL) is encrypted. Paths such as /cart, /messages or /search?q=... are invisible.
• Only the server name (SNI) and the IP address cross the network, and even the server name is increasingly encrypted (Encrypted Client Hello).

A hotspot appliance sitting in the middle of the network cannot see URLs. To see them it would have to break the encryption, which means installing a fake certificate on the guest's phone. That requires tampering with the guest's device and raises serious legal and ethical problems. Nobody does that, and nobody should.

DNS-over-HTTPS: even the domain name may be hidden

In the past, the question "which domain did they go to" could be answered from DNS queries. The phone asked for the IP of example.com, and the network saw the question. Modern browsers and operating systems now carry DNS inside HTTPS as well (DNS-over-HTTPS, DoH). The query travels encrypted from the browser straight to a DNS provider. The network in between sees only "it talked to a DNS provider".

The consequence: a promise of "URL logging" is mostly empty on today's devices. The appliance either sees nothing or produces an incomplete and misleading list. An incomplete list is more dangerous than a complete one, because it creates false confidence.

So what does the appliance keep?

The record Hotspot-Box keeps is limited to who was on the network and when:

Field	What it means
Verification detail	Phone number verified by SMS (stored encrypted, masked in the panel), coupon code or e-mail
Device MAC address	The identity of the guest device's network adapter
Assigned internal IP	The address the box gave the device for that session
Session start and end	Login time and the time the session closed
NAT detail	Where applicable, the outgoing address and port mapping

Daily record files are linked with a SHA-256 hash chain and receive an RFC 3161 timestamp. Only the digest goes to the timestamp service, never the records. Records stay on the box for 2 years (730 days); expired days are deleted automatically and the deletion is written to the audit trail.

What the appliance never keeps

• Visited sites and URLs
• Page content or downloaded files
• Messages or e-mail content
• Location data
• The guest's social media profile

There is an optional DNS query log. If you enable it, the box records the domain names requested by devices that use the box's DNS server. Devices using DoH do not appear in that log, so the feature is not a "complete list" and we do not present it as one. Before enabling it you should update your privacy notice and retention policy accordingly.

A common request: "add URL logging, just in case"

During deployment talks we sometimes hear "let the box log URLs as well, just in case". We decline, and we say why. First, as explained above, it stays technically incomplete. Second, every extra piece of data you keep is a processing activity under data-protection law: you must declare it in your privacy notice, set a retention period and restrict access to it. Third, when a request arrives the authority asks for an internal IP and a time; handing over a URL list does not make you safer, it only means you shared more data.

If your installer or adviser recommends it, ask "which question will it answer?" If the answer is "just in case", that data should not be kept.

What changes for your business

Instead of saying "I record everything", you can say "I can prove who was on my network, when, and with which address." That is also what an authority asks in an investigation: which device was using a given internal IP at a given time? The box answers that question with time-stamped records whose integrity can be verified.

Keeping less data also means less data-protection burden. Data you do not hold cannot leak, cannot be shared by mistake, and cannot miss a retention deadline.

In short

• "It logs every website" is technically out of reach for most traffic because of HTTPS and DoH.
• Law 5651 is about internal IP allocation records, not content or URLs.
• Hotspot-Box records identity, device, address and time. It never touches content.

How the records are produced and verified is described on the product page. Common questions are answered in the FAQ.

This article is for general information only and is not legal advice.