Guest Wi-Fi: must you identify users or keep logs? And how to advertise it (2026)

Updated: 9 November 2026

Almost every guest looks for free Wi-Fi before booking. Many hoteliers wonder: must I ask for ID to connect? Keep logs? Can I ask for an email to send offers? This is what we checked in official sources (links at the end), and what we could not confirm. This is not legal advice: check your case with your adviser.

Must you keep connection logs?

It depends on the country, and some points are unclear:

Spain: Law 25/2007 requires operators providing publicly available electronic communications services or running public networks to retain communications data for 12 months. The text does not name hotels or Wi-Fi hotspots. We found no official guidance stating whether a hotel offering Wi-Fi to guests counts as an operator.
Spain: Organic Law 4/2015 (art. 25(1)) subjects "commercial access to public telephone or online services in premises open to the public" to record-keeping duties, as set by implementing rules. We found no such implementing rule for hotel Wi-Fi. INCIBE, the national cybersecurity institute, said in a 2020 article that businesses offering Wi-Fi should keep connection records available to the police. If you charge for access or open it to non-guests, ask your adviser.
Portugal: in 2022 the Constitutional Court struck down, with general binding effect, the articles of Law 32/2008 requiring one-year retention of traffic and location data. That duty fell on electronic communications providers. We have not reviewed later legal changes.
Italy: the old duty to identify Wi-Fi users (the "Pisanu decree") is often described as abolished since 2011, but we could not confirm it in the official text.
Greece: we found no specific official rule we can cite.

If someone does something illegal on your Wi-Fi

The EU Court of Justice (McFadden, C-484/14, 2016) was clear about a shop offering free Wi-Fi:

It is not liable for users' copyright infringements, because it only transmits the connection.
A court or authority may order it to password-protect the network and, to make that effective, ask users to identify themselves before getting the password.
It cannot be required to monitor what passes through the network.
In practice: a guest network with a password (for example, given at check-in) is a reasonable measure.

Captive portal: what to ask for and how

If your login page collects data, the GDPR applies:

Say who processes the data, why, for how long and how to exercise rights (GDPR art. 13). INCIBE recommends this explicitly.
The acceptance box must never be pre-ticked.
Ask only for what you need. If Wi-Fi depends on accepting marketing, be careful: the GDPR (art. 7(4)) looks at whether a service is made conditional on consent to data that is not needed.
Marketing consent must be separate and clearly distinguishable from the terms of use (GDPR art. 7(2)).
Marketing emails need prior consent (Directive 2002/58, art. 13(1)). Exception: if you got the email in a sale, you may send offers for your own similar products, as long as the customer can object free and easily when giving it and in every email (art. 13(2)).

Basic network security

INCIBE recommends at least:

WPA2 encryption or better; no open networks or passwords on display.
Change the router's default admin username and password.
Rename the default network and keep the firmware updated.
Keeping the guest network apart from your front-desk and office network is good practice.

How to advertise your Wi-Fi

Travellers, and the AI assistants helping them choose, compare amenities. Say the same thing everywhere:

Google: in your Business Profile, open Hotel Details, search for the amenity and fill it in. Google notes that hotel attributes cannot be updated through the spreadsheet upload. "Free Wi-Fi" is one of the highlights Google may show, but it is not guaranteed.
Your website: with schema.org you can mark up the amenity on your hotel using amenityFeature and LocationFeatureSpecification, for example name "Free Wi-Fi" and value true.
Booking.com and other platforms: we found no official help page we can cite; check the facilities section of your extranet.
Be precise: "Free Wi-Fi throughout the property" or "in public areas only". If some areas have no signal, say so.

10-minute check

Check the guest network has a password, WPA2 or better, and is not your office network.
If you use a captive portal, review the privacy notice and make sure no box is pre-ticked.
Keep the email offers box separate from the terms of use.
Check that Google, your website and your platforms say the same about Wi-Fi.

How iQuota helps

iQuota publishes your property on an official booking page that AI can read. Describe your Wi-Fi in the same words as on Google and your website: consistent information helps guests know what to expect.

Want an official booking page AI can read and a connector with your real prices, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Must I ask for ID to give a guest Wi-Fi in Spain?

We found no official rule requiring it of a hotel. Since the guest is already registered at check-in, a password given with the stay is usually enough; if in doubt, ask your adviser.

Am I liable if a guest downloads pirated content on my Wi-Fi?

According to the EU Court of Justice (McFadden, 2016), a business offering free Wi-Fi as a mere conduit is not liable for those infringements, although it can be ordered to add a password.

Can I require an email and marketing consent for Wi-Fi?

It is risky: marketing consent must be separate and freely given (GDPR art. 7), and marketing emails need prior consent except for the existing-customer exception (Directive 2002/58, art. 13).

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά