Law 5651 and guest Wi-Fi: a plain guide for businesses

Who is a mass-use provider?

The law calls people and businesses that open internet access to others over their own network ‘mass-use providers’. Cafes, restaurants, hotels, dormitories, hospital waiting rooms, shopping centres, office lobbies, factory guesthouses: if you give customers or visitors Wi-Fi over your own line, you fall within this definition. The carrier that sells you the line is an ‘access provider’; its obligations differ from yours, and because it cannot know which device inside your network was given which address, it cannot keep the record for you.

The law treats those who offer this service for commercial purposes and those who do not as separate groups, and the detail of what is expected changes accordingly. Which group you belong to depends on the nature of your premises; the expectation to keep records applies to both. Giving Wi-Fi away for free does not remove it. A small number of guests does not remove it either: if you open your internet to even one person, you are expected to be able to show when that person was on your network and with which address.

Some situations are contested. In a shopping centre, is each shop obliged separately, or the centre's management alone? Is a residential complex that offers Wi-Fi in common areas a mass-use provider? How should an underage guest be handled? Seek legal advice on these questions. From the box's point of view there is no difference: in every case the record is kept, signed and retained the same way; who carries the obligation may change, the nature of the record does not.

• What must a business that gives guests Wi-Fi do under Law 5651?
• A phone hotspot and a business hotspot are not the same thing
• Guides for your industry

What must be kept: internal IP allocation records

The regulation around the law expects a mass-use provider to keep ‘internal IP allocation records’. This is the record of which device on your own network was given which internal IP address, on which date and at what time. The record exists to answer one question: at a given moment, which device and which verified person were behind the traffic leaving your network?

In practice a session record holds these fields: the guest's verification detail (phone number, coupon code or e-mail), the device's MAC address, the assigned internal IP, the session start and end times, and NAT details where present. That is the whole record. Visited sites, opened pages, content, messages and location are not recorded; keeping them is not something the law expects, and from a KVKK point of view it means needless accumulation of data.

For the record to be useful it must be tied to an identity. A shared password on the wall ties nobody to anything: a hundred people signing in with the same password produce identical records. An SMS code, a coupon, an e-mail or a registered-user sign-in creates that link. The most common and most durable route is the SMS code, because the phone number is already registered to a person on the operator's side.

• Which fields belong in a guest Wi-Fi access record?
• The ‘hotspot logs every website’ myth
• Why a shared Wi-Fi password is not enough

Integrity, time stamp and 2-year retention

Having the record is not enough; you are also expected to show it has not been altered. The regulation asks for the accuracy, integrity and confidentiality of the records to be protected and for that integrity to be made provable with a time stamp. A time stamp certifies, with the signature of an independent service, that a piece of data existed at a given moment and has not changed since. The box's own clock cannot stand in for this, because you could change that clock yourself.

Technically the process runs like this: a SHA-256 digest of each day's record files is taken. The digest is the file's fingerprint; change a single character and the digest changes completely. Days are chained together: each day's manifest contains the previous day's digest. That day's digest is then sent to a time stamp authority under the RFC 3161 standard and the signed stamp is received back. Only the digest goes to the authority, never the records themselves; guest data does not leave the box.

The retention period is 2 years. This means you must be able to go back at least two years; once a record's period ends, KVKK expects it to be disposed of. Keeping records for three or five years is not ‘safer’; personal data kept longer than necessary is a compliance problem of its own. The right target is to keep records for exactly 2 years, then delete them regularly and in a documented way.

• Is a time stamp legally required for guest Wi-Fi records?
• How long must guest Wi-Fi records be kept?
• What is inside one day of the archive?
• Records after two years: automatic deletion and KVKK

How does a request for records work?

A request usually arrives as a letter from a prosecutor's office or the police. It gives a date-and-time range and the public IP address your business was using at the time; you are asked to show the internal IP, device and verified user behind that address within that range. The deadline is usually short. The problem a business that keeps its logs ‘somewhere’ runs into at this point is not finding the record, but being unable to show that it belongs to that day and has not been altered. A prepared business does not go searching for the archive when the letter arrives; it selects the relevant days in the panel, verifies them and takes the export. The rest of this guide explains how to build that preparation.

A healthy process has five steps. Confirm the scope of the letter and the range requested. Pull the relevant days from the archive and verify their integrity; the verification report is attached to the response. Hand over only the range requested; delivering the whole two years is both unnecessary and problematic under KVKK. Who delivered it, when, which files: write this into your own audit trail. Under KVKK a request from a competent authority rests on a separate legal basis; the guest's consent is not sought for this delivery.

The contract ends, the inspection does not. Even if you drop the solution you use today two years from now, a request can still arrive for records from that period. That is why it matters for the records to sit on your premises, in a form you can reach and verify with independent tools. An archive that depends on a vendor and closes when the contract ends means an empty panel on inspection day.

• A prosecutor's request arrived: the 15-minute checklist
• 12 inspector questions, 12 answers from the box
• The contract ends, the inspection does not

Common mistakes

Relying on the router's ‘guest network’ feature. It separates guests from the staff network, which is good; but it does not verify identity and keeps no record. Everyone signing in with the shared password looks the same in the log. The second common mistake is keeping logs as plain files on the modem or an office PC: the disk fills up, the clock drifts, the file can be edited by hand and nobody can prove its integrity.

Clock drift is a silent mistake. If NTP is off or not working, the box's clock drifts by minutes within weeks and the records no longer match the time given in the request. Another confusion is treating content blocking and record keeping as the same thing. Blocking VPN, Tor or proxies does not protect the record; a content filter is no substitute for a record. What the law expects of a mass-use provider is to show who connected, not what they watched.

Collecting too much data is a mistake too. Logging visited sites, collecting communication permissions without a marketing opt-in, or asking for needless fields such as date of birth does not satisfy the law and increases KVKK risk. Finally, expecting retrospective signatures: no time stamp can be produced for days before installation. The chain starts on the day the box is installed, so every delay adds to the number of uncovered days.

• The 4 most common mistakes in log retention
• Is your router's guest network feature enough?
• Does blocking VPN, Tor or proxies on guest Wi-Fi protect records?
• Blocking unlawful content on guest Wi-Fi: what is enough?
• Box clock, NTP and time stamp offset

How Hotspot-Box does each of these

Identity: the guest signs in with an SMS code; a coupon, e-mail or registered-user account can be used instead. The phone number is stored encrypted in the box, shown masked in the panel and visible only to an authorised role. The SMS goes straight from the box to your own provider account; the number never reaches hotspot-box.com. Previously verified devices are not asked for a new code for the period you set.

Records and integrity: the box collects internal IP allocation records every day, links them with a SHA-256 hash chain and obtains an RFC 3161 time stamp. Only the digest goes to the time stamp service, never the records. The clock is synced with NTP; if the drift grows, the panel alerts you. If the internet goes down, records keep being collected; days that could not be stamped wait in a queue and are stamped when the connection returns. You see the number of pending days in the panel.

Retention and delivery: records are kept in the box for 730 days, expired days are deleted automatically and the deletion is written to the audit trail. A second copy can be sent off the box over SFTP or FTPS. When a request arrives, the relevant days are verified with one click in the panel and exported as a ZIP: day folders, line files, the SHA-256 manifest, the stamp file and a verification report. The archive can be verified with standard tools, independently of the box. The records stay on your premises; they go neither to the cloud, nor abroad, nor to us.

• The 3-2-1 rule for your Law 5651 archive
• Where does the archive signing key live?
• Fibre outage, 4.5G failover: the record chain holds
• Products: Box, Virtual Appliance, SaaS

How Law 5651 and KVKK read together

The legal basis for keeping the access record comes from the law; that is why the guest is not asked for consent to being recorded, but is told about the record in the privacy notice. Marketing is a separate matter: if you want to send campaign messages, that needs a separate and explicit opt-in, and the access record is no substitute for it. Merging the two purposes into one checkbox is the most frequent KVKK mistake.

Your business is the data controller. The records sit in the box, under your control. When a guest asks what you hold about them, you open a request case in the panel, locate the sessions and document the answer. The portal shows the privacy notice, and if the checkbox is ticked an explicit consent record is kept. Most of the technical measures KVKK expects (encryption, access rights, audit trail, disposal) are ready inside the box; the document set is completed on your side.

Be clear about third parties as well. Your SMS provider sees the number while delivering the message; define that relationship in your contract with the provider. The time stamp service sees only a digest, never guest data. The box's health telemetry contains no guest data. These three sentences answer the ‘where does the data go’ question in your KVKK inventory, and for most businesses they are the whole list.

• KVKK and guest Wi-Fi: is a phone number sensitive data?
• The KVKK document set for guest Wi-Fi
• An access record is not a marketing opt-in
• KVKK technical measures: where they live in the box

Sources and currency

This guide is not legal advice; it summarises the legislation in plain language and explains what the box does. The primary sources are listed below; we deliberately avoided article numbers and fine amounts, because they change and a figure taken out of context misleads. For situations specific to your business, consult your legal adviser. This page was last reviewed on: October 2026.

You will find the terms in the glossary, short answers on the FAQ page, and the settings specific to cafes, hotels, dormitories and other business types in the industry guides. To try the box for 7 days, start from the products page.

• Frequently asked questions
• Glossary of terms
• Industry guides
• Products