What you agree to at a hotel or airport login page

My own service keeps connection logs for ninety days. I wrote that line, and the paragraph around it, and the reason is duller than anyone expects. Abuse complaints about traffic leaving one of my lines take roughly that long to reach me, and when one lands I have to work out which customer was on it. Ninety days is the shape of my complaint inbox. It says nothing about anybody’s browsing.

So I have been on the drafting side of the document you tick past in a hotel lobby, which makes me a poor candidate for outrage about it. Most of those clauses have a boring operational reason behind them. The interesting part of a sign in page sits outside the terms altogether. It is the one field they make you fill in.

Not the security version

I have written the security argument about public networks elsewhere on this site. The fake network wearing the venue’s name, the sign in page that belongs to somebody in the car park, the stranger reading your screen over your shoulder. None of that is here.

Assume, for everything below, that the network is genuinely the hotel’s. Nobody is intercepting anything. The equipment is well configured and the vendor is competent.

All of it still happens.

And I use hotel wifi constantly, in several countries a year. Advice telling you to burn a fortnight of roaming data over a log retention clause was written by somebody who is not paying that bill.

The only field that matters

Before you sign in, a network has one thing on you. A device. Modern phones randomise the address they present to each network, which killed the old trick of following a single handset through every branch of a chain.

The record therefore starts anonymous. Some device arrived at 09:40, asked for these domains, moved this much data, left at 11:00.

Then the portal asks for an email address or a room number, you give it one, and every line of that record acquires a person.

That is the whole difference between a cafe and a hotel, and it is invisible because the login page looks identical in both. A cafe with the password chalked behind the counter gets a device and a list of domains, with no way to tell which of the forty people in the room it belongs to. There is no identity field anywhere in the system.

A hotel asks for a room number and a surname. The room number points at a registration card, and in most of the countries you are likely to be standing in, taking a passport at check in is a legal requirement rather than a hotel’s habit. The identity was already in the building. The portal just wired the network record to it.

Airports land in between, and where exactly depends on the field. An email address is soft. A frequent flyer number is a name with a decade of travel behind it, and a flight number sits close to that end.

The forty five minute free tier is part of this too. A session that expires is a session you have to log back into, and the second login is where a venue gets an address you actually check.

Three clauses, worst first

Sharing is the one to read. Analytics partners, service providers, affiliates, group companies. It matters because of who you are contracting with, which I will come back to.

Marketing is second, and it is the only genuinely optional thing on the page. A line says they may write to the address you gave, and the box underneath it is already ticked. Everything else there is accept or do not connect. The box is a real choice, dressed as a default, sitting exactly where your eye is not, because your eye is on the button.

Retention comes third and most people rank it first. A record of the connection held for a stated period: times, addresses, volumes, sometimes the names your device looked up. Plenty of countries require anybody offering public internet access to keep exactly this for a set number of months, so a good share of that clause is compliance with a rule. It matters the way a receipt matters. A record exists, and somebody can ask for it later.

The company whose name is not on the door

The venue almost never runs the wifi.

It is a managed service. A specialist company installs the access points, operates the sign in page, holds the database, and sells the same package to a few hundred other properties. Your tick lands with a company you have never heard of, and that company holds the same kind of record from every venue on its books.

The clause usually says so, in the flat register these documents are written in. Nobody is hiding it. It is drafted to be skipped, which is a different thing from deceptive and works considerably better.

But it changes the question you thought you were answering. You were deciding whether you trust this hotel. That was never the decision in front of you.

The building is counting phones

Here is the half that almost never comes up, and it has nothing to do with your internet connection.

Access points can see devices that have never connected to anything. Your phone announces itself looking for networks it recognises, and every access point in the building hears it. Count those announcements and you have a footfall system. How many people came in, which zones they stood in, how long they stayed, whether they came back on a different day.

Shopping centres and terminals run this and it is genuinely useful to them. On its own it is close to harmless, because the randomised address means each visit is a separate anonymous smear that cannot be chained to the last one.

The sign in page is where that stops. The system holding the physical track and the system holding your name are one system: same access points, same vendor, same session, same database.

So for that stay, or that layover, the walking route has a name on it. Forty minutes in one area, twelve in another, a two hour gap, then back through the same zone at nine at night.

People expect a network to know their traffic. Very few expect it to know their route through a building, and the route is the better description of a person.

I want to be careful here, because this is where privacy writing usually goes wrong. Most venues are not doing the join. Plenty are counting bodies to decide how many staff to put on a desk. But the join is a feature of the platform, it is in the sales material, and the consent for it is the box.

What I had wrong

For years I typed an invented email address into these pages. Made one up at the keyboard, felt roughly as clever as that sounds.

Two things wrong with it. The small one is that many portals now send a code to the address, so an invented one fails and you type your real one thirty seconds later with the failed attempt logged beside it.

The larger one is that I was defending the wrong field. In a hotel the email was never the identifier. The room was. I was carefully obscuring the optional field and filling in the mandatory one honestly, because a room number is three digits and reads like furniture. It is a pointer into the registration system, and the registration system has my passport in it. About a decade of that, while thinking of myself as careful about this subject.

The short list

One email address that exists only for portals, receipts and delivery notices. A real inbox, never read. That retires the marketing clause outright.

Untick the box. Half a second, and it is the only lever on the page.

Forget the network before you leave the building, and turn automatic rejoining off. The security reasons are in the other piece. The reason here is that a saved name means your phone walks into every branch of that chain announcing that it knows this network, which is precisely what a counting system listens for, and you attached a name to it once in a lobby in another country.

On a hotel network, accept that the identity is the room. The record attaches to your stay and no email trick changes that. If something belongs off the stay record, that is what your own mobile data is for, and it is cheap enough that I stopped deliberating over it.

Ten seconds on the page itself. Not to read four thousand words. To see whose document it is, and whether the sharing clause names a group of companies instead of the one you are standing in.

What separates this from most of what I write about is that it is a contract you signed. An offer with terms on it, accepted freely, by an adult, in exchange for internet access worth about four dollars. That makes complaining afterwards a weak position, and it makes reading one of them properly, once, in a lobby, with eleven minutes to kill, a genuinely useful thing to have done.