Free guest Wi-Fi in Belgium: which rules apply, and what about GDPR?

"The Wi-Fi Code Is on the Receipt"

In Belgian hospitality, free Wi-Fi has become as self-evident as a glass of tap water. Guests ask for it before they've opened the menu, and in a hotel it stopped being a perk years ago — it's a baseline expectation. So an access point got installed at some point, the code sits on a little sign by the till, and the whole thing has "just worked" for years.

Until someone asks the question that quietly nags at a lot of owners: is all of this actually allowed? Am I liable if a guest does something illegal on my network? And the email addresses my login page collects — what exactly am I allowed to do with those?

The short answer is reassuring: offering guest Wi-Fi in Belgium is perfectly legal and requires no licence. But how you offer it determines which obligations you take on — especially once personal data enters the picture. Below is the practical rulebook. One caveat up front: this is practical guidance, not legal advice. If you're unsure about your specific situation, put it to a lawyer or a data-protection specialist.

Are You Liable for What Guests Do Online?

The fear we hear most often: "if a guest downloads something they shouldn't on my Wi-Fi, am I the one in trouble?" Broadly speaking, the European starting point is reassuring: someone who merely passes on internet access isn't automatically responsible for what users do with it. You're a conduit, not a publisher.

But "not automatically liable" isn't the same as "nothing to do". An owner whose network is set up sensibly is in a far stronger position if questions ever come:

• Keep the guest network separate. Not just for liability — for your own security too, more on that below.
• Protect it with a password. A fully open network also attracts people who aren't customers, and makes it harder to show you took reasonable care.
• Think about what you log. Recording who connected when can be useful, but those logs contain personal data — so rules apply there too (see below). Belgian telecom law has separate retention rules for network operators; if you keep connection logs, ask a lawyer whether they apply to you.

If a police request ever arrives, ask a lawyer before you hand over or delete anything. What you want to be able to show at that moment is a tidily built network — not a tangle "a cousin installed, back in the day".

Where GDPR Walks In: The Login Page

Many venues show a portal page before letting guests online: enter your email address, tick a box, off you go. Handy for marketing — but this is exactly the point where you move from "offering Wi-Fi" to "processing personal data", and therefore under GDPR.

Personal data is broader than you'd think. It's not just names and email addresses; technical identifiers such as a device's MAC address can fall under it too. The healthy reflex is simple: treat everything your Wi-Fi tells you about a guest as data with rules attached.

In practice, that means:

• Say what you do. A short, readable privacy notice on the portal page: what you collect, what you use it for, how long you keep it, and who the guest can contact with questions.
• Collect only what you need. An email address for your newsletter — fair enough. But do you really need a birth date, a phone number and a postcode to let someone online for an hour? Every extra field is extra responsibility.
• Secure what you keep. Who in the business can access that data? Does the list live on a secured system, or in a spreadsheet on the till computer? That's GDPR too.

"Free Wi-Fi in Exchange for Your Email Address"

This is where things go wrong most often in practice. Consent for marketing has to be free and specific. That means:

• No pre-ticked boxes. The guest chooses, actively, themselves.
• Wi-Fi can't be held hostage. Tying access to a mandatory newsletter sign-up sits badly with the idea of freely given consent. Offer the newsletter as an option, not a tollgate.
• Unsubscribing must be as easy as subscribing. One click at the bottom of every email — and that click has to actually work.

A mailing list built this way is smaller — but it's made of people who want your emails. For a hospitality business, that's worth more than a thousand addresses harvested on the quiet.

How Long Do You Keep the Data?

GDPR doesn't attach a fixed term, but the principle is clear: no longer than needed for the purpose. Agree on a retention period internally, write it down, and stick to it. A guest who came in for one coffee three years ago doesn't need to live in your system forever. Configure your router or portal so old data disappears automatically — then nobody has to remember.

The Technology That Makes the Rules Easier by Itself

The nice part: what's legally prudent is also, plainly, good network practice.

• Separate guests from the business. Your guest network should be fully isolated from your registered cash register, payment terminal, cameras, reservation system and office machines. A guest who can reach your till system — by accident or on purpose — is a risk no owner wants to run.
• Change the default passwords. The administrator password the router shipped with is the first thing an attacker tries.
• Keep firmware up to date. Outdated router software is an open back door. Schedule updates or let them run automatically.
• Cap the bandwidth. A per-user limit keeps the network smooth for everyone and discourages the heavy traffic you'd rather not be the conduit for.

The Most Honest Option: Collect as Little as Possible

Here's what many portal vendors forget to tell you: none of this is mandatory. The simplest compliant setup is a separate guest network with a password on a small sign, with no portal and no sign-up data. Your router still keeps technical logs such as device addresses, so set them to delete themselves after a short period; there is no consent to manage.

A portal page with email registration only makes sense if you're genuinely going to use those addresses, responsibly — a monthly newsletter worth reading, an invitation for your game season. If you're not going to do anything with them, all you're collecting is risk.

Practical Checklist

• Guest network fully separated from the till, payment terminal, cameras and office
• Default administrator password changed on router and access points
• Network protected with a proper password (and it isn't "restaurant2020")
• Firmware updates run automatically or are scheduled
• If there's a portal page: a short privacy notice is visible on it
• Marketing consent is a free, separate, never pre-ticked choice
• A retention period for collected data is agreed and written down
• Unsubscribing from emails takes one click
• Someone in the business knows who has access to the collected data

Can you tick every box? Then you're further along than most of the sector.

Rather Have Someone Simply Sort It?

A guest network that's fast, cleanly separated from your business systems, and with data collection tuned privacy-first: that is the work our IT and Wi-Fi service is built for. Have a look at our IT and Wi-Fi solutions or get in touch: we'll review your current setup and tell you honestly what's already fine and what needs fixing. And for the fine legal print, we'll happily point you to a specialist — cobbler, stick to thy last.