Turkish Law No. 5651 and Guest Wi-Fi: A Guide for Businesses

Important note: This article is for general information only and does not constitute legal advice. Your business's obligations should be assessed with a legal expert according to your type of activity and current legislation.

In short: how does Law No. 5651 affect guest Wi-Fi?

Turkey's Law No. 5651, the "Law on Regulating Broadcasts on the Internet and Combating Crimes Committed Through Such Broadcasts", imposes various obligations on different actors on the internet. Businesses such as hotels, cafés, restaurants, hospitals or campuses that provide internet access to people at a specific location may be defined as "internet mass-use providers" in the related regulation. In this context, they are generally expected to keep electronic records of the IP addresses assigned on the internal network (internal IP assignment logs) and to protect the accuracy, integrity and confidentiality of these records. The exact scope of the obligations must be determined according to how the business operates and current legislation.

What is Law No. 5651?

Law No. 5651 entered into force in 2007 and has been amended several times since. It defines the responsibilities of internet actors such as content providers, hosting providers, access providers and mass-use providers. Its purpose is to combat crimes committed over the internet and to make it possible, when necessary, for authorised bodies to determine which user a given piece of internet traffic belongs to.

The details of how the law is applied are set out in regulations. For businesses offering guest Wi-Fi, the most important secondary legislation is the Regulation on Internet Mass-Use Providers. The regulation defines who mass-use providers are, which records they must keep and what additional conditions apply to those providing the service for commercial purposes.

Who is a mass-use provider?

The regulation broadly defines an internet mass-use provider as a natural or legal person who provides people with the opportunity to use the internet at a specific location for a certain period. In practice, this definition can cover a wide range of businesses:

• Hotels, guesthouses, apart-hotels and holiday villages
• Cafés, restaurants, bars and patisseries
• Shopping centres and stores
• Hospitals, clinics and healthcare facilities
• Schools, universities and dormitories
• Airports, terminals and exhibition centres
• Gyms, hair salons and businesses with waiting rooms
• Corporate companies offering a network to guests or visitors

The regulation also sets out additional obligations for mass-use providers operating for commercial purposes (for example internet cafés), such as obtaining a permit and using approved filtering software. A hotel or restaurant offering internet to guests as part of its main activity may be assessed differently from a business that sells internet access directly as a commercial activity. Because this distinction matters legally, each business should clarify its own situation with expert advice.

Which records should be kept?

The concept of "internal IP assignment logs" is central to the regulation. These records generally include:

• The IP address assigned to the user on the internal network
• The date and time at which use of the IP address started and ended
• The MAC address of the device that used the IP address

In practice, in networks with hotspot authentication, the user session with which an IP address was associated (for example a room number, phone number or voucher code) may also be important in technical investigations, because a MAC address alone does not always show who owns a device.

NAT and shared IP addresses

In guest networks, hundreds of devices usually reach the internet through a single public IP address. This is called NAT (Network Address Translation). During an investigation, it may be necessary to find out which internal device a public IP address and time seen from the outside world belong to. For this mapping to work reliably, it is important that:

• The clocks of routers and log systems are accurately synchronised via NTP,
• Internal IP assignments and session times are recorded completely,
• Port and session (NAT) information is also considered where necessary.

Devices whose clocks differ by even a few minutes can lead to an incorrect event timeline.

Integrity and retention of records

Keeping records is not enough; it must also be possible to prove that they have not been altered. The regulation requires the accuracy, integrity and confidentiality of records to be ensured. In practice, the following methods are used:

• Timestamping: Signing log files at regular intervals with a timestamp from an authorised electronic certificate service provider helps show that the record existed on that date and has not been changed since.
• Hash value: Taking a cryptographic digest of the log file and storing it separately makes changes detectable.
• Access restriction: Limiting access to logs to authorised persons and recording access activity as well.
• Backup: Securely backing up records so they are not lost due to hardware failure or cyberattacks.

For the retention period, the current provisions of the regulation that apply to the business should be followed. Because the periods set for access records in legislation can change over time, and although a range of one to two years is commonly discussed in the industry, each business's own obligation should be confirmed against the current text and with legal advice.

Law No. 5651 and KVKK: striking the right balance

Access records and hotspot authentication data (name and surname, phone number, room number, MAC address) may constitute personal data. Logging processes under Law No. 5651 should therefore be considered together with Turkey's Personal Data Protection Law No. 6698 (KVKK):

• Privacy notice: On the captive portal, guests should be told in a clear notice which data is processed, for what purpose, on which legal basis, and what their rights are.
• Proportionality: Only data that is relevant and necessary for the purpose should be collected. Collecting data that is not required by law "just because we can" creates risk.
• Separation of purposes: Data kept to meet legal obligations should be separated from marketing data. Where required, separate explicit consent should be obtained for marketing communications.
• Retention and deletion: A retention period should be defined for each type of data, and data whose period has expired should be destroyed according to the personal data retention and destruction policy.
• Data security: KVKK's administrative and technical data security measures (access authorisation, encryption, logging, backup) should be applied.
• Data processor relationship: If a cloud-based hotspot service is used, the data processing agreement with the service provider and any cross-border transfer should be assessed separately.

Does hotspot software ensure compliance with Law No. 5651?

This is the question businesses ask most often, and it must be answered carefully: installing hotspot software does not, on its own, guarantee compliance with Law No. 5651 or KVKK. Hotspot software greatly simplifies technical processes such as user authentication, session tracking, IP-to-user mapping and log generation. But compliance depends on getting all of the following right together:

• Correct design of the guest network (VLANs, NAT, time synchronisation)
• Complete, integrity-protected and secure storage of log records
• A defined retention and destruction policy
• Restricted access permissions to logs
• The ability to provide records quickly and accurately to authorised bodies on request
• Operating KVKK processes (privacy notice, explicit consent, data security)
• Informing staff about these processes

Implementation examples by sector

Hotels and holiday villages

Because hotels already register guests at check-in, authentication with room number and surname is a strong method in terms of both user experience and IP-to-user mapping. Ending access after check-out keeps records consistent with the length of stay. In multi-building properties, it is especially important that all gateways use the same time source.

Cafés and restaurants

In businesses with many short-stay visitors, SMS verification or time-limited voucher codes handed out at the table are common. Users should not be asked for unnecessary information, and session durations should match the length of a visit.

Hospitals and clinics

Patient, companion and visitor networks must be strictly separated from medical devices and hospital information systems. Not collecting anything that qualifies as health data through the portal is especially important under KVKK.

Schools, dormitories and campuses

Separating student and staff networks, authenticating with identity credentials and applying time-based access policies are common in these settings. Because large user numbers increase log volume, storage capacity should be planned in advance.

Corporate companies

Separating the guest network from the corporate network, time-limited access codes for meeting visitors and sessions linked to visitor registration are preferred.

Implementation checklist for businesses

1. Clarify your business's status as a mass-use provider, and whether it operates for commercial purposes, with a legal expert.
2. Separate the guest network from staff and critical systems with VLANs.
3. Enable NTP time synchronisation on all network devices and the log server.
4. Use a hotspot authentication method that identifies the user instead of a shared password.
5. Find out in writing which fields the internal IP assignment logs contain and where they are stored.
6. Verify the method used to protect record integrity (timestamp, hash).
7. Set the retention period according to current legislation and define the destruction process.
8. Publish the KVKK privacy notice on the captive portal.
9. Determine who can access the logs and record that access.
10. Define the procedure to follow, and the person responsible, when an official request arrives.

Frequently asked questions