Is a time stamp required for guest Wi-Fi records?

A claim appears often in guest Wi-Fi product pitches: "records are legally invalid unless they are time stamped."

We tried to verify it at source. The result was surprising.

The finding: the phrase does not appear

In the full text of the İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik (Official Gazette 11/4/2017, No. 30035), the phrase "zaman damgası" (time stamp) does not appear at all. We searched both the consolidated text on mevzuat.gov.tr and the original Official Gazette publication; zero results.

"RFC 3161" appears nowhere in Turkish legislation either.

So what does article 5/1-e say?

There is an integrity requirement for commercial mass use providers. Article 5/1-e reads:

"…bu bilgilerin doğruluğunu, bütünlüğünü ve gizliliğini teyit eden değeri…" (…a value confirming the accuracy, integrity and confidentiality of this information…)

It asks for a value showing the record has not been altered. In practice that is usually a hash. But the article does not say how that value is to be produced, and does not mention time stamping.

Note also that this requirement sits in article 5, for commercial providers. The general duties in article 4 contain no such requirement.

Where is time stamping required?

Time stamping genuinely is mandatory in Turkish legislation — but for other provider categories, in a different regulation.

The relevant text governs the procedures for storing traffic information:

• For hosting providers (article 7/1-c), the duty to store "dosya bütünlük değerlerini zaman damgası ile birlikte saklamak" (file integrity values together with a time stamp) is written explicitly.
• For access providers (article 8/1-e), a similar duty exists.

So the time stamping duty exists — but a café or hotel is not in those categories.

What does this mean?

Two conclusions:

1. If you meet a pitch saying "your records are invalid without a time stamp", ask for the basis. Ask which article of which regulation.

2. It does not mean time stamping is useless.

If it is not required, why use it?

A time stamp proves to a third party that data existed before a given date. A hash you generate on your own system says "this file has not changed" but not "this file existed on that date" — because you control the system clock.

In a dispute that difference can matter. So we recommend time stamping as good practice, not as a legal requirement.

In Hotspot-Box, daily archives are chained with SHA-256 and optionally signed with an RFC 3161 time stamp. We do this because it strengthens the record, not because a law requires it. If you would rather not use time stamping, you can turn it off; your obligations are unaffected.

What actually matters?

What the regulation asks for is that records are kept and stored for two years. In practice the most common problem is not integrity but gaps:

• Days with no records because the device was off
• Periods where writing stopped because the disk filled
• Traffic never recorded because of a configuration error

An archive that is time stamped but has a two-week gap is weaker than one with no gaps and no stamp.

Your priorities should run in this order: uninterrupted logging first, then a backup copy, then an integrity value, and time stamping last.

Summary

Claim	True?
Time stamping is mandatory for guest Wi-Fi records	No — the phrase is not in the regulation
Commercial providers must store an integrity value	Yes — article 5/1-e
Hosting and access providers must use time stamps	Yes — but in a different regulation, different category
Time stamping is useless	No — not mandatory, but it strengthens the record

---

This article is for information only and is not legal advice. Consult a lawyer about your own situation. Quotations are taken from the legislation as it stood on the date of publication.