Last updated: 2026-11-06
Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, Telecommunications Interception Ordinance (TKÜV) as amended on 22 October 2026, Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) as amended on 10 March 2026, checked on 6 November 2026. This page provides general information, not legal advice. Whether your Wi-Fi offering falls under the security duties is a question for a lawyer admitted in Germany. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.
A Wi-Fi network is publicly available if it is open to an indeterminate group of people (Section 3 no. 44 TKG). How to check this, and what the Bundesnetzagentur (BNetzA), the German Federal Network Agency, says about guest Wi-Fi for the notification under Section 5, is explained on the page am I a telecom provider?. This page starts from there and is also written for companies based abroad that run Wi-Fi services in Germany.
Which duties apply if your Wi-Fi service is publicly available?
By the wording, the same as for any provider of publicly available telecommunications services. Sections 165 to 168 contain no special rule for Wi-Fi. This mainly concerns offerings where customers get their own, permanent internet access over Wi-Fi, such as a Wi-Fi network for residential complexes or a hotspot network with a subscription. The order is our recommendation, and the assignment to the provisions is our reading.
| Step | Duty | Provision | Note for Wi-Fi |
|---|---|---|---|
| 1 | Notify the BNetzA of the activity, if commercial | Section 5 TKG | as network operator and as service provider if you are both |
| 2 | Register with the Federal Office for Information Security (BSI) | Section 33 BSI Act (BSIG) | providers of publicly available services are at least important entities (NIS2 for telecom providers) |
| 3 | Appoint a security officer, designate an EU contact person | Section 166(1) no. 1, 2 TKG | no size threshold |
| 4 | Draw up a security concept; submit it as network operator without undue delay after starting network operation, as a pure service provider on request (security concept under Section 166 TKG) | Section 166(1) no. 3, (2) TKG | in our reading, whoever provides the access points and the access network is a network operator |
| 5 | Implement protective measures (protective measures under Section 165 TKG) | Section 165(1) to (2d) TKG | separating users from each other, managing the access points, contractors for operation and maintenance |
| 6 | Reporting procedure for security incidents to the BNetzA and the BSI (incident reporting under Section 168 TKG) | Section 168 TKG | no size threshold, initial report no later than 24 hours after becoming aware |
| 7 | Collect customer data, set up the information request procedure (customer data under Sections 172-174 TKG) | Sections 172, 174 TKG | Section 172 is linked to internet access with assigned line identifiers or provided connections; information is given by anyone who provides telecommunications services on a business basis or contributes to them (Section 174(6)) |
| 8 | Clarify interception measures | Section 170 TKG, Section 3 TKÜV | separate thresholds for Wi-Fi, see the next section |
What applies to interception measures for Wi-Fi networks?
For interception, the BNetzA treats Wi-Fi access networks like DSL or cable networks: equipment is required if more than 10,000 registered users are connected to the installation (Section 3(2) sentence 1 no. 5 TKÜV). Where all users are unregistered, the threshold only applies from more than 100,000 users, counted as end devices connected regularly and at the same time across the entire access network (no. 6). According to the BNetzA, cafés, hotels and libraries that offer their own internet connection to customers through a Wi-Fi router are not addressed. The thresholds concern only the interception equipment. Information duties remain, as the page Section 170 TKG and the TKÜV explains.
What is open for very small providers and guest Wi-Fi?
Whether a hotspot operator that is not required to notify under Section 5 falls under the security duties of Sections 165 to 168 TKG has not been settled. The BNetzA guidance on the notification duty covers only Section 5, and its page on Wi-Fi interception covers only interception. We have not found a published assessment of the security duties (as of 6 November 2026). We therefore give no result. These questions, which follow the definitions in Section 3 TKG, help when clarifying the matter with a lawyer:
- Is the Wi-Fi open to an indeterminate group of people (Section 3 no. 44), or only to a clearly defined group, such as guests with a room key or employees?
- Does the network serve wholly or mainly publicly available services (Section 3 no. 42), or is the Wi-Fi an add-on to another business?
- Is it offered for remuneration, separately or within the price of another service? Section 3 no. 61 describes telecommunications services as “normally provided for remuneration”.
- Who provides the access points, access network and internet connection, and who is the users' contractual partner?
In our reading, one duty applies regardless: the secrecy of telecommunications under Section 3 TDDDG also binds providers of telecommunications services offered wholly or partly on a business basis, so not only publicly available ones. They may obtain knowledge of the content and the detailed circumstances of communications only to the extent necessary for the service and its operation, including the protection of the technical systems (Section 3(3) TDDDG). Disclosing such facts without authorisation is a criminal offence under Section 206 of the German Criminal Code (StGB). Who is bound and how to keep it in day-to-day operation is set out on the page secrecy of telecommunications under Section 3 TDDDG.
Example: check questions for a city Wi-Fi network
Fictitious example, not a client. A municipal marketing company runs free Wi-Fi at 25 locations in the town centre. Users accept the terms of use on a landing page without registering. At peak times around 1,500 devices are connected at the same time. A contractor operates the access points and the controller on behalf of the company, and a regional ISP supplies the internet connection. No fee is charged.
The table is the work product of this page. The column “Answer in the example” is our assessment where the law allows an answer, and the open points go to a lawyer for clarification. For your own hotspot, take over the questions and columns and enter your answers.
| Check question | Why it matters | Answer in the example | Evidence in-house | Result |
|---|---|---|---|---|
| 1. Is the Wi-Fi open to an indeterminate group of people? | Section 3 no. 44 TKG | yes, anyone in range can connect | landing page, terms of use | criterion met (our reading) |
| 2. Is it short-term shared use on your own premises, or a connection of its own? | BNetzA guidance on Section 5: group A (own, permanent connection) or group B (short-term shared use) | short-term use in public space, not on the company's own business premises | list of locations | fits neither group with certainty, open |
| 3. Is a fee charged? | Section 3 no. 61 TKG, “normally provided for remuneration” | no, funded from the marketing budget | business plan | open, clarify with a lawyer |
| 4. Who provides the network and the service? | Section 3 no. 7 (operator); distinction between providing and contributing in our reading | company as client, contractor operates, ISP supplies the connection | service contract, connection contract | role of the company open; in our reading the contractor contributes |
| 5. Do Sections 165 to 168 TKG apply to us? | security concept, protective measures, reporting | depends on questions 2 to 4 | - | not established, no statement; clarify with a lawyer before expanding |
| 6. Is interception equipment required? | Section 3(2) sentence 1 no. 6 TKÜV | no registration, around 1,500 devices at the same time, well below 100,000 | controller report for peak times | no equipment under Part 2 TKÜV; repeat the count every year |
| 7. Do we keep the secrecy of telecommunications? | Section 3 TDDDG, Section 206 StGB | contractor logs connection data for troubleshooting | data processing agreement, logging concept | limit the scope to what is necessary, set the contractor's confidentiality in the contract |
| 8. Can we detect an incident and pass it on internally? | basis for Section 168 if it applies; good practice in any case | only the contractor reports disruptions, to the town's IT | service contract | define the reporting route to management, regardless of the result for question 5 |
| Approval | checked by: head of IT; approved: management; open points 2 to 5 passed to legal counsel; check again when registration, a fee or new locations are introduced | |||
If the model changes, for example to a paid offering with user accounts, the assessment can change. Then the duties from the first section apply by the wording, and for interception the lower threshold of 10,000 users.
Three common gaps
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| No notification duty read as no duties at all | “Guest Wi-Fi does not have to be notified” applied to every duty | security duties and secrecy of telecommunications not checked, even for offerings with a connection of their own | check each duty separately, file the result with reasons |
| Users counted per hotspot only | each location looked at on its own | TKÜV threshold for the entire access network exceeded without anyone noticing | evaluate devices connected at the same time across all locations, repeat every year |
| Contractor without instructions | operation fully outsourced | logging and access to user data without limits and without control | set the scope of logs, confidentiality and reporting routes in the contract |
How we can help
If your Wi-Fi offering is a publicly available telecommunications service, we draw up the security concept under Section 166 TKG and set up the reporting procedure and evidence. Where classification questions are open, we prepare the technical details for your legal counsel. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.
Frequently asked questions
Do I have to provide interception equipment as a hotspot operator?+
Do I need a security concept under Section 166 TKG for my guest Wi-Fi?+
May I filter or log the traffic on my Wi-Fi?+
Does an external contractor for the access points change my duties?+
Does a Wi-Fi provider have to register with the BSI?+
Read more
- Section 5 TKG: Am I a Telecom Provider? Roles, Notification
- Section 166 TKG Security Concept: German Telecommunications Act
- Section 168 TKG: Reporting Security Incidents to BNetzA and BSI
- Customer Data, Sections 172-174 TKG (German Telecommunications Act)
- Secrecy of Telecommunications: Section 3 TDDDG for Providers
- NIS2 for Telecom Providers in Germany: TKG Duties, Registration
- German Telecommunications Act (TKG): Telecom Security Services
Sources
- Section 3 TKG: definitions (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 165 TKG: technical and organisational safeguards (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 166 TKG: security officer and security concept (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Telecommunications Interception Ordinance (TKÜV) (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 3 TDDDG: confidentiality of communications, secrecy of telecommunications (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 206 StGB: violation of postal or telecommunications secrecy (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Bundesnetzagentur: Wi-Fi interception (German) (retrieved 2026-11-06)
- Bundesnetzagentur: guidance on the notification duty under Section 5 TKG, Official Gazette 23/2021 (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).