Introduction
Public Wi-Fi services in Turkey are widely used by businesses, municipalities, hotels, cafes, restaurants, shopping malls, universities, hospitals, airports, libraries, co-working spaces, event venues, transport stations and public institutions. Offering free or paid internet access to visitors may look like a simple customer service. However, under Turkish law, public Wi-Fi may create legal obligations relating to Law No. 5651, internet access logs, user identification, filtering measures, personal data protection, cybersecurity, official requests, municipal responsibility, customer privacy and administrative sanctions.
The main legal framework is Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications. This law regulates the obligations and responsibilities of internet actors, including content providers, hosting providers, access providers and collective internet use providers. Official public guidance explains that Law No. 5651 covers the obligations and responsibilities of these actors and the procedures for combating certain offences committed through internet publications.
For public Wi-Fi providers, the most important concept is internet collective use provider, known in Turkish as internet toplu kullanım sağlayıcı. This concept covers real or legal persons that provide internet access to persons at a certain place and for a certain period. The 2017 Internet Collective Use Providers Regulation defines this category and sets out obligations for both ordinary collective use providers and commercial collective use providers.
This means that a hotel giving Wi-Fi to guests, a cafe offering Wi-Fi to customers, a municipality providing free Wi-Fi in a park, a shopping mall offering guest internet, a university providing student Wi-Fi or a business offering visitor Wi-Fi may need to comply with 5651-related obligations. Public Wi-Fi compliance should therefore be treated as a legal and technical governance issue, not merely as an IT installation.
What Is a Public Wi-Fi Service?
A public Wi-Fi service is an internet access service made available to persons who are not simply internal employees or closed-system users. It may be offered free of charge, included in another service or provided for a separate fee. The service may be available in hotels, cafes, restaurants, shopping malls, municipal parks, public squares, libraries, airports, hospitals, campuses, buses, ferries, co-working offices or event venues.
From a legal perspective, public Wi-Fi generally involves three layers. The first layer is the upstream internet service provider, which provides the actual internet connection. The second layer is the venue or institution that makes Wi-Fi available to users. The third layer is the user who connects to the network and accesses internet content.
A common mistake is to assume that all legal responsibility belongs to the upstream internet service provider. This is incorrect. The venue or institution offering public Wi-Fi may have separate obligations as an internet collective use provider. These obligations may include user identification, access log retention, filtering measures and protection of log integrity.
Internet Collective Use Provider under Turkish Law
The 2017 Internet Collective Use Providers Regulation defines an internet collective use provider as a real or legal person that provides persons with the opportunity to use the internet environment at a certain place and for a certain time. The same regulation defines commercial collective internet use providers as persons providing such services in public places such as internet salons for a fee or together with computer games.
This distinction is important. A municipality that offers free Wi-Fi in a public square, a hotel that offers Wi-Fi as part of accommodation, a cafe that offers Wi-Fi as an additional service or a company that offers guest Wi-Fi may generally be considered an internet collective use provider. However, internet cafes and similar businesses that commercially provide internet access for a fee may fall into the stricter category of commercial collective internet use provider.
The ordinary collective use provider does not always need an operating permit specifically for public Wi-Fi. Local governorate guidance explains that ordinary internet collective use providers, such as public institutions, companies and hotels offering internet access to employees or customers, do not need an “izin belgesi” but must comply with Article 4 obligations of the regulation.
By contrast, commercial collective internet use providers must obtain an authorization document from the local civil authority after obtaining workplace opening and operation permits. Governorate guidance lists the application requirements, including petition, workplace license copy, fixed IP number, tax document and filtering software license copy.
Legal Obligations of Ordinary Public Wi-Fi Providers
Ordinary internet collective use providers have several core obligations. The 2017 regulation states that they must use a content filtering system to prevent access to content constituting a crime, keep access records electronically in their own systems for two years, and establish systems to identify users through SMS or similar methods when internet access is provided in publicly accessible areas.
These obligations are central for businesses and municipalities. A public Wi-Fi provider should not simply install a modem and publish the password on a wall. It should have a system capable of identifying users, generating access logs, storing those logs securely and applying filtering measures.
The obligation to keep access records is particularly important because public Wi-Fi may be misused for cybercrime, fraud, unlawful content access, harassment, threats, copyright infringement, illegal betting, phishing, data theft or other unlawful acts. Proper logs help identify which internal IP address, MAC address, device or user was connected at a specific time.
However, logging must be performed lawfully. Public Wi-Fi providers should not collect unnecessary personal data, should not monitor communication content beyond legal necessity, and should not disclose logs to unauthorized persons. Compliance requires both 5651 awareness and personal data protection discipline.
User Identification through SMS or Similar Methods
One of the most important practical obligations for public Wi-Fi providers is user identification. The regulation states that collective use providers offering internet access in publicly accessible areas must establish systems to identify users by SMS or similar methods.
In practice, this usually means that a user enters a mobile phone number, receives a verification code and connects after verification. Other identity verification methods may also be used if they can reliably identify the user and match the user to access logs. Municipal Wi-Fi systems, hotel captive portals, shopping mall guest Wi-Fi and airport Wi-Fi commonly use this model.
User identification is legally important because anonymous public Wi-Fi can create serious risk. If unlawful activity occurs through an open network and the provider cannot identify the user, the investigation may first point to the venue’s IP address. Proper identification helps separate the venue from the actual user and supports lawful cooperation with authorities.
However, SMS verification also involves processing personal data. The provider should inform users clearly about what data is collected, why it is collected, how long it is retained, whether it is shared with third parties and how users may exercise their rights. A phone number collected for legal identification should not automatically be used for marketing.
Access Log Retention
Public Wi-Fi providers must keep access records electronically. The 2017 regulation requires ordinary internet collective use providers to keep access records in their own systems for two years. For commercial collective use providers, the regulation similarly requires electronic access records to be kept for two years.
Logs should be accurate, complete and technically reliable. They should normally include information that allows the provider to determine which user or device used the internet connection at a specific time. Depending on system architecture, relevant logs may include login time, logout time, internal IP address, public IP address, MAC address, user identifier, session ID and authentication data.
The provider should also protect the integrity of the logs. Governorate guidance for commercial collective use providers refers to saving data confirming the accuracy, integrity and confidentiality of recorded access information and keeping such data for two years.
A public Wi-Fi provider should avoid editable, unsecured or incomplete logs. If logs can be altered by ordinary employees or deleted automatically before the legal period ends, compliance risk increases. Good practice includes timestamping, hash verification, restricted administrator access, audit trails, backup and secure retention.
Filtering and Protection against Criminal Content
The regulation requires public Wi-Fi providers to use content filtering systems to prevent access to content constituting a crime. For commercial collective use providers, the obligation is stricter: they must use content filtering and secure internet service for protection of family and children and prevention of access to criminal content, keep filtering systems active and updated, and prevent their deactivation.
Filtering is especially important for locations used by children and young people, such as municipalities, libraries, schools, dormitories, cafes, internet cafes, youth centers and public transport facilities. A business should not offer unrestricted public Wi-Fi without any filtering measures.
However, filtering should be proportionate and lawful. The purpose is not to unlawfully monitor users or censor ordinary content, but to take preventive measures against content that constitutes a crime and to comply with legal duties. Providers should choose professional filtering systems, keep them updated and document their use.
Commercial Public Internet Providers
Commercial collective internet use providers are subject to additional requirements. The regulation requires them to obtain an authorization document from the local civil authority, use filtering and secure internet service, keep filtering systems active and updated, obtain and use a fixed IP from access providers, notify fixed IP changes within fifteen days, keep access records for two years and notify closure or transfer of the workplace within fifteen days.
The classic example is an internet cafe. However, similar business models may arise in gaming centers, internet salons, paid computer-use venues and other public places where internet use is provided commercially as a main activity.
Local governorate guidance states that persons wishing to operate as commercial collective internet use providers must first obtain the workplace opening and operation license, then apply to the local civil authority. It also lists fixed IP, filtering software documentation and other application documents.
If a business provides Wi-Fi only as an additional service to customers, such as a cafe, hotel or restaurant, it may not necessarily fall into the commercial collective use category. However, if the business model is primarily paid internet access or public computer use, stricter commercial rules should be reviewed.
Public Wi-Fi in Hotels, Cafes and Restaurants
Hotels, cafes and restaurants often provide Wi-Fi as a customer convenience. These businesses are usually not internet cafes, but they may still be internet collective use providers. Therefore, they should comply with ordinary collective use obligations, including user identification, log retention and filtering.
For hotels, Wi-Fi compliance is especially important because guests may be local or foreign, may use multiple devices and may access the network from rooms, lobbies, meeting halls and restaurants. A hotel should ensure that room-based Wi-Fi access, lobby Wi-Fi and event Wi-Fi are all logged and tied to identifiable users where required.
Cafes and restaurants should avoid shared passwords that allow anonymous access by anyone nearby. A captive portal, SMS verification or another user identification method is safer. The business should also display or provide a short privacy notice explaining how Wi-Fi data is processed.
A simple “free Wi-Fi” sign is not enough from a compliance perspective. The business should be able to show that it has taken legal and technical measures under 5651 and KVKK.
Municipal Public Wi-Fi Services
Municipalities frequently provide free Wi-Fi in parks, public squares, libraries, cultural centers, public transport stops, beaches and municipal facilities. Municipal Wi-Fi projects are valuable for digital inclusion and public service. However, they also create public-law, data protection and cybersecurity responsibilities.
A municipality offering public Wi-Fi is typically an internet collective use provider. It should therefore use filtering systems, keep access records for two years and establish systems to identify users through SMS or similar methods in publicly accessible areas.
Municipalities should also prepare data protection notices, because user phone numbers, identity-related information, IP logs, session data and location-based connection information may be personal data. The Turkish Personal Data Protection Authority states that personal data is any information relating to an identified or identifiable natural person, and processing is lawful only if one of the legal grounds under Article 5 exists.
Municipal Wi-Fi projects should also be supported by procurement-compliant contracts. The municipality should define who provides the hotspot system, who stores logs, who responds to official requests, who protects personal data, who maintains cybersecurity, who handles outages and who deletes data after the retention period.
Shopping Malls, Airports and Transport Facilities
Shopping malls, airports, bus terminals, metro stations, ferry terminals and large public venues often provide Wi-Fi to thousands of users per day. These environments create higher compliance risk because user volume is high and user identity may be difficult to manage.
Such venues should implement robust hotspot management systems. The system should support SMS verification, log retention, device identification, secure storage, filtering, user terms, privacy notices and administrator access control.
The venue should also clarify its relationship with telecom operators, IT contractors and hotspot vendors. If a vendor manages the system, the venue should ensure that the vendor stores logs lawfully, protects personal data, responds to requests only through authorized channels and returns or deletes data at the end of the contract.
Large venues should avoid unsecured guest networks. Open networks without authentication may create serious legal and reputational risk.
Public Wi-Fi and KVKK
Public Wi-Fi almost always involves personal data processing. Phone numbers, SMS verification records, IP addresses, MAC addresses, device identifiers, session times, captive portal forms, location information and user logs may all relate to identifiable or identifiable natural persons.
The Personal Data Protection Authority states that personal data means any information relating to an identified or identifiable natural person. It also states that processing must be based on at least one legal ground under Article 5, including explicit consent, legal obligation, contract necessity, legitimate interest and other statutory grounds.
This means that a public Wi-Fi provider should not collect more data than necessary. If SMS verification is used to comply with 5651 obligations, the phone number should generally be used for that purpose, not automatically for advertising. If the provider wants to send marketing messages, separate commercial electronic communication consent may be required.
Public Wi-Fi privacy notices should explain:
Identity of the data controller.
Categories of data collected.
Purpose of processing.
Legal basis.
Retention period.
Recipients and vendors.
Whether data is transferred abroad.
User rights.
Contact channel for privacy requests.
The Personal Data Protection Authority also emphasizes the obligation to inform data subjects at the time personal data is obtained. Therefore, privacy notices should be shown before or during Wi-Fi login, not hidden somewhere inaccessible.
Data Security Obligations
Public Wi-Fi data must be protected securely. Log records, phone numbers, device identifiers and session information should not be accessible to ordinary employees or unauthorized vendors.
The Personal Data Protection Authority’s data security guidance states that data controllers must take necessary technical and administrative measures to prevent unlawful processing, prevent unlawful access and ensure protection of personal data. This applies directly to Wi-Fi logs and authentication data.
Public Wi-Fi providers should implement:
Role-based access control.
Strong administrator passwords.
Multi-factor authentication for management panels.
Encryption of logs.
Secure backup.
Firewall and network segmentation.
Guest network isolation.
Regular software updates.
Vendor access restrictions.
Incident response procedures.
Periodic log integrity checks.
Employee training.
A guest Wi-Fi network should be separated from internal business systems. For example, a cafe’s guest Wi-Fi should not allow access to POS systems. A municipality’s public Wi-Fi should not expose municipal internal networks. A hotel’s guest Wi-Fi should be isolated from administrative systems and payment infrastructure.
Data Breach Notification
If public Wi-Fi logs or user data are accessed unlawfully, a data breach may occur. The Personal Data Protection Authority states that data controllers must notify the Board without delay and no later than 72 hours after becoming aware of the breach; if notification cannot be made within 72 hours for a justified reason, the reason for delay must be explained.
This is important because public Wi-Fi systems may be vulnerable to misconfiguration, weak passwords, insecure hotspot panels, exposed log files, vendor negligence or cyberattacks. If phone numbers, IP logs or session records are leaked, the provider may need to investigate, contain the breach, notify affected users where necessary and notify the Authority within the legal framework.
Businesses and municipalities should include breach response clauses in hotspot vendor contracts. The vendor should be required to notify the provider immediately after detecting any incident affecting Wi-Fi data.
Cybersecurity Risks in Public Wi-Fi
Public Wi-Fi is often targeted by attackers because it serves many users and is sometimes poorly secured. Risks include rogue access points, man-in-the-middle attacks, phishing pages, captive portal spoofing, weak encryption, malware distribution, session hijacking, DNS manipulation, credential theft and unauthorized access to internal systems.
A provider should not guarantee absolute security, but it must take reasonable technical and administrative measures. Good practice includes WPA2 or WPA3 security where feasible, captive portal controls, client isolation, rate limiting, firewall rules, DNS filtering, network monitoring and clear user warnings.
Businesses should also avoid collecting unnecessary passwords or sensitive information through Wi-Fi portals. Users should not be asked to provide identity numbers unless there is a specific lawful need. Overcollection increases KVKK risk.
Official Requests and Lawful Disclosure
Public Wi-Fi providers may receive requests from law enforcement, prosecutors, courts, administrative authorities or other competent institutions. Such requests may concern IP logs, user identity, phone numbers, connection times or device information.
Providers should have a formal procedure. Employees should not share logs informally. The request should be verified, recorded and answered only by authorized personnel. The response should be limited to the requested and legally justified information.
If the Wi-Fi system is operated by an external vendor, the contract should define who receives official requests, who verifies them, who produces logs and how confidentiality is maintained.
Liability for Illegal Acts Committed through Public Wi-Fi
A common concern is whether a business or municipality becomes responsible for illegal acts committed by users through its Wi-Fi. The answer depends on the facts. A public Wi-Fi provider is not automatically responsible for every user action, but failure to comply with legal obligations may increase risk.
If the provider has no user identification, no logs, no filtering and no security controls, it may be difficult to show who actually committed the act. In such cases, the venue’s public IP address may appear in the investigation. Proper compliance helps protect the provider by demonstrating that the unlawful act was committed by an identifiable user, not by the business or municipality itself.
Therefore, public Wi-Fi compliance is not merely about avoiding administrative fines. It is also about risk separation and evidence preservation.
Contracts with Hotspot and IT Vendors
Many businesses and municipalities outsource public Wi-Fi installation and management. Vendor contracts are critical because the legal responsibility may remain with the venue even if technical operations are outsourced.
The contract should cover:
User identification method.
Log retention period.
Log format.
Log integrity.
Filtering system.
Secure internet service.
Data controller and processor roles.
KVKK compliance.
Subprocessor approval.
Data breach notification.
Official request handling.
Administrator access.
Service levels.
Maintenance.
Security updates.
Data return or deletion.
Audit rights.
Indemnity.
Municipalities should also ensure that procurement documents include 5651 and KVKK compliance requirements. A cheap Wi-Fi solution may become expensive if it fails to keep logs or leaks personal data.
Administrative Sanctions
Commercial collective internet use providers face specific administrative risks. The regulation provides that commercial providers violating Article 5 obligations may be subject to administrative fines by the local civil authority, and governorate guidance also notes closure and administrative penalty risks for operating without permission.
For ordinary collective use providers, the risk may arise from failure to keep logs, failure to identify users, lack of filtering, KVKK violations, data breaches, poor security or inability to respond properly to official requests. Even where a specific permit is not required, compliance obligations remain.
In addition, KVKK administrative sanctions may apply if personal data is processed unlawfully, users are not informed, data is over-collected, logs are disclosed unlawfully or security measures are inadequate.
Practical Compliance Checklist for Businesses
Businesses offering public Wi-Fi should follow this checklist:
Classify the service as ordinary or commercial collective internet use.
Use an authorized internet service provider.
Avoid anonymous open Wi-Fi.
Implement SMS or similar user identification.
Keep access logs electronically for two years.
Use filtering systems.
Keep filtering systems active and updated.
Separate guest Wi-Fi from internal networks.
Prepare a Wi-Fi privacy notice.
Do not use phone numbers for marketing without separate consent.
Limit employee access to logs.
Use secure hotspot systems.
Sign KVKK-compliant contracts with vendors.
Prepare official request procedures.
Prepare data breach response procedures.
Review logs periodically.
Train staff.
Practical Compliance Checklist for Municipalities
Municipalities offering public Wi-Fi should follow this checklist:
Map all Wi-Fi locations.
Identify users through SMS or similar methods.
Keep access logs for two years.
Use filtering systems.
Prepare municipal privacy notices.
Use procurement documents requiring 5651 and KVKK compliance.
Define vendor responsibilities.
Ensure logs are stored securely.
Separate public Wi-Fi from municipal internal networks.
Define official request procedures.
Prepare breach response workflows.
Conduct periodic security audits.
Avoid unnecessary personal data collection.
Publish clear acceptable use rules.
Coordinate legal, IT and procurement teams.
Conclusion
Public Wi-Fi services in Turkey create important legal obligations for businesses and municipalities. Hotels, cafes, restaurants, shopping malls, airports, universities, public institutions and municipalities may be internet collective use providers under Law No. 5651 and the 2017 Internet Collective Use Providers Regulation. Commercial internet-use venues, such as internet cafes and similar businesses, may face additional permit and fixed IP obligations.
The core obligations include using filtering systems, keeping access records electronically for two years and identifying users through SMS or similar methods where internet access is provided in publicly accessible areas. Commercial collective internet use providers must also obtain permission from the local civil authority, use fixed IP, keep filtering systems active and notify relevant changes.
Public Wi-Fi also involves personal data protection. Phone numbers, IP logs, MAC addresses, session data and device information may be personal data under KVKK. Therefore, providers must inform users, process only necessary data, secure logs, limit access, manage vendor contracts and respond properly to data breaches.
The safest approach is to treat public Wi-Fi as a regulated service, not as a casual amenity. A compliant public Wi-Fi system should combine 5651 logging, user identification, filtering, KVKK privacy notices, cybersecurity controls, vendor contracts, official request procedures and periodic audits.
Businesses and municipalities that build these measures into their Wi-Fi systems will reduce legal risk, protect users, support lawful investigations and demonstrate responsible digital service governance in Turkey.
Frequently Asked Questions
Is public Wi-Fi regulated in Turkey?
Yes. Public Wi-Fi may fall under Law No. 5651 and the Internet Collective Use Providers Regulation if a business, municipality or institution provides internet access to users at a certain place and for a certain period.
What is an internet collective use provider?
It is a real or legal person that provides persons with internet access at a certain place and for a certain time. The regulation includes this definition and distinguishes it from commercial collective internet use providers.
Do hotels and cafes need a special permit for Wi-Fi?
Ordinary collective use providers such as hotels, companies or public institutions generally do not need a separate “izin belgesi,” but they must comply with Article 4 obligations such as filtering, log retention and user identification.
Do internet cafes need permission?
Yes. Commercial collective internet use providers must obtain permission from the local civil authority after obtaining workplace opening and operation permits.
How long must public Wi-Fi logs be kept?
The regulation requires access records to be kept electronically for two years.
Must public Wi-Fi users be identified?
Yes. Collective use providers offering internet access in publicly accessible areas must establish systems to identify users through SMS or similar methods.
Is filtering required for public Wi-Fi?
Yes. The regulation requires content filtering systems to prevent access to content constituting a crime. Commercial providers must also use secure internet service and keep filtering systems active and updated.
Does KVKK apply to public Wi-Fi?
Yes. Phone numbers, IP addresses, device identifiers and access logs may be personal data. KVKK defines personal data as any information relating to an identified or identifiable natural person.
Can phone numbers collected for Wi-Fi login be used for marketing?
Not automatically. If the phone number is collected for user identification and legal compliance, using it for marketing requires separate analysis and usually separate consent under applicable rules.
What should a municipality do before launching free Wi-Fi?
A municipality should implement user identification, two-year log retention, filtering, KVKK privacy notices, cybersecurity controls, vendor contracts, official request procedures and periodic audits.
No Responses