Back to news
Législation
Public WiFi: legal obligations for businesses on the French Riviera
Author
July 4, 2025
Offering public WiFi is essential for many establishments on the French Riviera, but it comes with strict legal obligations: data retention, access security and GDPR compliance. In Nice, Cannes, Antibes or Menton, hotels, restaurants and coworking spaces must follow these rules to avoid penalties. This guide explains what is mandatory, what is recommended and how to stay compliant without adding operational complexity.
Who is concerned by the obligations?
Any organization offering public WiFi is concerned: hotels, restaurants, cafes, coworking spaces, libraries, malls or transport facilities. The obligation depends on public access, not on company size. During high season in Cannes or Grasse, it becomes even more important to maintain a compliant and documented setup.
Which data to retain and for how long?
CPCE L34-1 requires retention of technical connection data for 1 year. If identity data is collected, it must be retained for 5 years. Network security data can be retained for 3 months. Communication content must never be stored. A clear retention policy is essential.
Securing public WiFi
Security requires strict separation between public and internal networks, WPA3 encryption, strong passwords and access logging. A captive portal informs users and frames usage. Logs must be protected and accessible only to authorized staff.
GDPR and user information
GDPR requires clear information about data collection, retention duration and user rights. A concise notice in the captive portal or a dedicated page is sufficient if it is complete. Transparency also builds trust with customers.
Building a compliance plan
An effective plan includes an architecture audit, logging setup, simple documentation and regular reviews. It is recommended to test log retrieval procedures and ensure staff can respond to legal requests. This reduces risk and simplifies daily operations.
Service areas
Riviera Connect supports establishments in Nice, Cannes, Antibes, Mougins, Valbonne, Menton and Grasse, as well as Monaco. We adapt public WiFi compliance to local constraints and legal requirements.
FAQ on public WiFi obligations
Do I have to identify users?
No, identification is optional. If implemented, stricter retention rules apply.
Do I have to retain WiFi data?
Yes, technical connection data must be retained for 1 year if you offer public access.
What are the risks of non-compliance?
Penalties can be significant under GDPR. A compliance audit greatly reduces risk.
Is a captive portal mandatory?
It is not mandatory but strongly recommended to inform users and frame access.
Can I outsource public WiFi management?
Yes, but you remain responsible for compliance. A qualified provider simplifies setup and monitoring.
Ready to transform your connectivity?
Free Quote
Tags: Législation