In brief
Hotspot" means two different things: your phone's internet sharing and a business's guest Wi-Fi portal. The differences, when each applies, and what the law expects of a business.
One word, two different things
Search for "hotspot" and results arrive from two worlds. In one there is your phone's settings menu: "Personal hotspot", internet sharing. In the other there is the guest Wi-Fi of cafés, hotels and waiting rooms: a page that opens when you connect, a phone number, a code by SMS. Both are called hotspots, but technically and in terms of responsibility they are different things.
This article separates the two and makes clear which one a business owner needs.
The phone hotspot: internet sharing
Your phone's hotspot feature shares its mobile data connection over Wi-Fi with a few devices. The technical name is tethering. Its traits:
- The connection goes through your operator line and uses your mobile data allowance.
- Connected devices use one password that you hand out. The phone keeps no record of who connected or when.
- Capacity is small: a few devices, for a short time.
- Use is personal: your laptop, the friend next to you, your child's tablet on the train.
The feature is built for exactly this, and it is good at it. Your operator contract may have conditions on sharing; that is a separate matter. It has a place for a small business too, such as keeping your till or POS terminal alive for a few hours during a line failure. But it is not a service offered to customers.
The business hotspot: a captive portal
On a business's guest Wi-Fi, a welcome page opens at the start of the connection. This is a captive portal. Before the guest gets online they are verified on this page: they enter a phone number, receive a code by SMS, type it in. A voucher code or an e-mail address can be used instead. Once verified, the device goes online under a plan (speed, duration, quota).
This arrangement differs in three ways:
- Who connected is known. Every session is recorded with the verification detail, the device's MAC address, the assigned internal IP and the session start and end times.
- Record integrity is protected. On the box the daily records are linked in a SHA-256 hash chain and timestamped; they are kept for 2 years.
- There is capacity and control. Tens or hundreds of devices, per-person speed limits, session length, daily quota.
What is not recorded: sites visited, content, messages, location. The portal records which device was on the network with which internal IP and when, not what the guest did. The guest's phone number is stored encrypted and shown in the panel only to the authorised role, masked.
Side by side
| Phone hotspot | Business hotspot (captive portal) | |
|---|---|---|
| Who it is for | You and people close to you | Customers, guests, visitors |
| Connection | Mobile data | The business's internet line |
| Access | One shared password | Individual verification (SMS code, voucher, e-mail) |
| Records | None | Session and internal IP allocation records, timestamped |
| Capacity | A few devices | Tens to hundreds of devices |
| Speed / time control | None | Per device, through a plan |
| Network separation | None | Guest network separated from staff by VLAN |
Which one for a business?
Short answer: if you offer internet to your customers, the second.
Law 5651 defines businesses that provide internet access to others as mass-use providers and expects them to keep internal IP allocation records, protect the accuracy and integrity of those records with a timestamp, and retain them for 2 years. Cafés, restaurants, hotels, waiting rooms and dormitories are typical examples of that definition.
These two approaches do not meet that expectation:
- "I turn on my phone's hotspot and give customers the password." The connection going through a phone does not take you outside the definition, and no record is created at all.
- "I wrote the modem's Wi-Fi password on the counter." Everyone uses the same password; which device connected when is unknown, and even if it were known, its integrity is not protected.
There are debated cases too: is every shop in a shopping centre separately responsible, is a residential complex's management a mass-use provider, how are minors handled. Seek legal advice on those. The box does the same job in either case: it verifies the session, keeps the record, protects the chain.
The small business's path
For a small café the "right set-up" is not complicated:
- The existing modem and access point stay; the box sits between them. You do not replace the modem or need a static IP.
- The guest network is separated from the staff network with its own Wi-Fi name and a VLAN. MAC exemptions are set for the printer and the POS terminal.
- A plan is chosen for guests; for a café we suggest 10/5 Mbps, a 2-hour session, 2 devices.
- For SMS codes, a credit pack or your own SMS provider account is connected. SMS reaches foreign numbers too.
- The portal is branded, the privacy notice is shown, explicit consent is recorded.
From then on the guest sees your Wi-Fi, not their phone's hotspot menu; they connect, enter the code, get online. And you watch what happens from the panel.
See Products for the options, Industries for examples by sector and the FAQ for common questions.
This article is general information, not legal advice.