Is Your Guest WiFi Login Legal in India?

Ask most property owners whether their guest WiFi is “legal,” and you’ll get a blank look, followed by “it works fine, why wouldn’t it be.” Nobody’s checking. There’s no inspector who shows up to test your login screen. But the requirement isn’t hypothetical, and it isn’t new: Indian rules around public internet access have long expected whoever’s providing it to know, at least loosely, who’s using it. A shared password with no login step at all, still common at plenty of cafes and small hotels, quietly skips that entirely.

This isn’t a scare piece, and it isn’t legal advice; talk to your own advisor about your specific situation. It’s a plain explanation of what the requirement is actually asking for, and which parts a normal guest WiFi setup already satisfies without anyone having thought about it that way.

The part that’s actually about identification

The core expectation is straightforward: whoever’s giving out internet access to the public should be able to say, if asked, who was using a given connection at a given time. Not their life story, just enough to identify them: a phone number is the common, practical answer.

This is exactly what an OTP login already does. A guest enters their number, gets a code, and that number becomes tied to their session. A network with no login step, or a static password nobody has to type their own name against, doesn’t have that link at all: everyone online at 8pm on a Tuesday is functionally the same anonymous person. Vouchers and access control covers the login-method side of this in more depth; the compliance angle is simply that the identification step needs to exist at all, and a password on a chalkboard doesn’t provide one.

The part that’s actually about your own data handling

The second piece is newer and gets less attention: the Digital Personal Data Protection Act, 2023, which covers how a business handles the personal data (like a phone number or email) it collects, including at a WiFi login screen. The practical shape of it, for a property owner, is less about paperwork and more about a habit: collect what you actually need for the login to work, and don’t let it sit around more exposed than it needs to be.

This is where hiding guest phone numbers from staff by default stops being just a nice privacy touch and starts being the actual right shape of the thing: a guest’s number, collected to let them log in, isn’t then visible to every staff member who happens to have a dashboard login, forever, with no record of who looked. That’s not a checkbox you tick once, it’s the dashboard actually behaving the way the law expects it to by default.

What this doesn’t mean

It doesn’t mean you need a legal team, a compliance officer, or a rewritten privacy policy before your WiFi can go live. Almost every property this applies to is already using ordinary tools, an OTP login, a dashboard, that get most of the way there on their own. The gap, when there is one, is usually just the oldest, simplest setup: a shared password with no real login at all, which skips the identification step by design, not by mistake.

If a guest can get online without ever proving they’re a specific, identifiable person, that’s the thing worth fixing first. Everything past that, hiding contact details from staff who don’t need them, keeping a real session record, is the difference between technically having a login screen and actually having one that would hold up if anyone ever asked.

Where to actually check this

Look at your current login screen the way an outsider would: does it ask for anything that ties a session to a real, identifiable person, or does it just let a device on? If it’s the second one, that’s the one thing to change first, before worrying about anything more advanced. Security checklist covers the rest of what a properly locked-down guest network looks like, once the login screen itself is doing its actual job.