GDPR for Guest Wi-Fi: What Romanian Hotels Must Log

Published on October 19, 2026 by Network Consulting Team

A surprising number of Romanian hotel GMs believe they're legally required to keep guest Wi-Fi connection logs for months, "in case the police ask." That belief is widespread, and it's wrong — and it's pulling attention toward the wrong compliance task while the obligations that actually apply, and the ones Romania's data protection authority has actually fined hotels over, go unmanaged. This article separates the myth from the law: what GDPR genuinely requires at the captive portal, what you should deliberately not collect, and where the real enforcement risk sits for a Romanian hospitality property.

The Retention Myth: Hotels Aren't Telecom Operators

The myth traces back to an older EU regime that required telecom and internet providers to retain traffic and location data for a fixed period, for law enforcement access. Romania implemented that regime as Law no. 298/2008 — and Romania's own Constitutional Court struck it down as unconstitutional in Decision no. 1258 of 8 October 2009, years before most hotels installed their first guest Wi-Fi hotspot (EDRi). The underlying EU Data Retention Directive (2006/24/EC) didn't survive either: the Court of Justice of the EU declared it invalid across the entire bloc in its Digital Rights Ireland ruling of 8 April 2014, finding the blanket retention mandate disproportionate to the privacy rights it interfered with (CJEU, Joined Cases C-293/12 and C-594/12).

Even when a retention regime of that kind existed, it targeted providers of publicly available electronic communications services — not businesses offering internet access as a courtesy to their own customers. The Court of Justice addressed that distinction directly in McFadden v Sony Music Entertainment, a 2016 case about a shop owner's free Wi-Fi: offering internet access to attract customers is an "information society service" under EU e-commerce rules, not a telecommunications service, and the operator benefits from a liability safe harbor rather than a monitoring or retention obligation (CJEU, Case C-484/14). A hotel offering guest Wi-Fi sits in exactly that category. There is no EU or Romanian law today that requires you to retain guest Wi-Fi connection logs for a fixed statutory period "for the authorities."

What GDPR Actually Requires at the Captive Portal

None of that puts guest Wi-Fi outside GDPR's reach — it means the applicable rulebook is GDPR itself (Regulation (EU) 2016/679), not a telecom-style retention mandate. In practice, that means:

• A lawful basis for every field you collect (Art. 6): a name and email address for a marketing newsletter need freely given, specific consent; the IP address, MAC address, and connection timestamp your captive portal logs automatically for security and abuse investigation can usually rest on legitimate interest, provided you've thought through and can explain why.
• Consent can't be bundled with access (Art. 7(4)): if accepting marketing emails is a condition for getting online, that consent isn't freely given and isn't valid. Terms-of-use acceptance and a marketing opt-in need separate checkboxes, with marketing unticked by default.
• Collect less, not more (Art. 5(1)(c)): a captive portal that asks for a passport number or home address just to grant Wi-Fi access is collecting data it has no use for and no basis to hold.
• Set a retention schedule and follow it (Art. 5(1)(e)): define how long session and security logs are kept, and delete them on schedule. GDPR requires a defined, justified period — not an indefinite one, and not a "keep it forever just in case" policy either.
• Tell guests what you're doing with it (Art. 13): the captive portal's privacy notice should appear before data is submitted, in plain language, covering what's collected, why, how long it's kept, and who it's shared with.

Where Romanian Hotels Actually Get Fined

ANSPDCP, Romania's data protection authority, has been more active against hotels in the last few years, and the pattern in its decisions is instructive — none of the fines below were about insufficient Wi-Fi log retention:

• Noy Business Tranzactions SRL (Pirates Resort, Mamaia): fined €1,000 in a decision closed in February 2025, after failing to respond in time to a guest's request for their own CCTV footage — a breach of the data subject access and erasure rights GDPR guarantees (StartupCafe).
• Ana Hotels SRL (the George Copos hotel group): fined €8,000 under GDPR's Article 83, for an Article 32 security failure after a ransomware attack exposed guest data (StartupCafe).
• World Trade Center Bucharest: fined €15,000 after a printed list containing 46 guests' personal data was photographed and published online, due to inadequate technical and organizational security measures (Economica.net).

Every one of these cases is about weak security, a slow response to a guest's rights request, or inadequate safeguards around data that already existed — not a missing log file. That's where a hotel's GDPR effort should actually go.

"None of ANSPDCP's hotel fines were about not keeping enough Wi-Fi logs. They were about weak security and slow responses to the guests who asked what was done with their data."

Cookies, Analytics, and Whether You Need a DPO

Two related questions come up often enough to address directly. First: if your captive portal or marketing platform drops cookies or trackers for analytics beyond what's strictly necessary to run the login page, that's governed separately by Romania's Law no. 506/2004 (transposing the EU's ePrivacy Directive), which requires its own consent for non-essential cookies — distinct from, and in addition to, the GDPR consent you get for processing personal data. A cookie banner on the captive portal isn't optional if you're running analytics or ad-tracking scripts on it.

Second: GDPR's Article 37 requires appointing a data protection officer when an organization's core activity involves large-scale, regular, and systematic monitoring of individuals. A single property logging routine Wi-Fi session metadata is unlikely to cross that threshold on its own. A multi-property group running structured guest profiling, loyalty-program data matching, or marketing analytics across properties is a different conversation, and one worth having with a data protection advisor rather than assuming either answer by default.

What to Log, and What to Deliberately Skip

Reasonable to log — and actually useful

• Captive portal consent events: who agreed to what, when, and which version of the notice they saw. This is your proof of compliance if a guest or ANSPDCP ever asks.
• Connection session metadata (IP/MAC address, timestamp) for a limited, defined window, to investigate abuse or a security incident on the network.
• Access and erasure requests themselves, and when you responded. The Pirates Resort fine above shows exactly what happens when this isn't tracked.

Worth skipping

• ID or passport numbers collected at the Wi-Fi login screen, rather than at check-in, where that data may already have a separate legal basis under accommodation-registration rules.
• Permanent, unbounded retention of session logs "just in case."
• Bundling marketing consent with network access, as covered above.

A Captive Portal Checklist for Hotel GMs

• Audit what your current captive portal actually asks for, and strike anything beyond name/email plus the technical fields it logs automatically.
• Separate the "accept terms" checkbox from the "send me marketing" checkbox, with marketing off by default.
• Put a plain-language privacy notice in front of the login form, not buried in a PDF nobody opens.
• Agree on a written retention period for session and security logs with whoever manages your network, and build it into the system rather than leaving deletion to a manual task.
• Document who on your team is responsible for handling a guest's access or erasure request, and confirm it can be done within the one-month window Article 12(3) GDPR allows.

Aligning the Network With the Policy

A retention and consent policy is only as good as the network behind it. If guest Wi-Fi, staff devices, the PMS, and camera systems all sit on the same flat network, a single compromised captive portal — or an attacker who lands on the guest VLAN — has a path to systems holding far more sensitive data than a browsing history. That's precisely the kind of exposure behind the Ana Hotels fine above. We cover the technical side of containing that blast radius in our guide to hotel network segmentation, and the security fundamentals in our piece on keeping hotel guests safe in the digital age.

This article is general information, not legal advice; for your specific retention periods and documentation, work with a qualified data protection advisor. If you want a straight answer on where your property's network architecture and data flows actually stand, a structured review through our network infrastructure consulting services is a practical starting point — get in touch with our team to scope it out.