Hotel Wi-Fi: Legal Obligations

The legal basis for Wi-Fi applies to hotels and restaurants

As soon as they provide Wi-Fi access to guests, hotels and restaurants are considered “Wi-Fi operators” and are therefore subject to the applicable legislation. France has put in place a set of regulations around providing public Wi-Fi access to protect both the establishment supplying the service and the users connecting to it. The main legal points concern Internet connections, personal data protection, and ensuring lawful use of the network.

For hotels and restaurants, the guest Wi-Fi is legally regarded as an “internal network open to the public.” In this capacity, hoteliers are exempt from some obligations, such as filing an operator declaration with ARCEP (the electronic communications regulator) that would otherwise be required to be officially recognized as a public Wi-Fi access provider.

However, all other provisions still apply to hotels, as outlined by the CNIL. These include measures contained in the 2001 law on daily security, the 2006 law on counter-terrorism, and Law No. 2009-1311 related to criminal protection of intellectual property on the internet (commonly known as “HADOPI 2”).

The hotelier’s legal obligations and potential penalties

In practice, this means the hotelier must be able to provide any legally authorized party, for up to one year after the events, the following elements:

• the MAC addresses of all devices that accessed the property’s Wi-Fi,
• the date, time, and duration of each communication,
• technical information to identify the user via connection logs (IP addresses, etc.), and
• technical information to identify the recipient(s) of the communication.

Note that the hotel should keep only technical characteristics—not the identities of users or the content of their communications—in compliance with GDPR.

Importantly, any failure to meet these obligations can expose the hotelier to financial or even criminal penalties, depending on the case. Among others, failing to retain data can trigger the sanctions in Article L.39-3 of the CPCE: up to one year of imprisonment and €75,000 in fines for individuals, and €375,000 for legal entities (under Penal Code Article 131-38).

That said, if the hotelier signs a managed Wi-Fi service contract, they effectively delegate their legal responsibility to the service provider. The provider then assumes responsibility for managing, retaining, and furnishing connection logs.