Run Public WiFi in Your Cafe or Shop in Pakistan: PTA's 12-Month User Log Rule
Running free WiFi in a cafe, hotel or shop in Pakistan? The 2018 PTA rules need user login by SMS and 12 months of logs. See what to ask your provider.
Short answer: PTA's 2018 regulations say a public WiFi hotspot in a cafe, hotel, restaurant or park must log each user. Before access, the system collects the full name, CNIC (or passport), and a mobile number used as login, and sends a password by SMS. The logs must be kept for at least 12 months.
A customer asks for the WiFi password. You write it on a card and put it on every table. It feels harmless. Under PTA's rules it is not how a public hotspot is supposed to work, and the internet provider that supplies the line can be made to cut it off.
We read the regulation on 11 October 2026: the Data Retention of Internet extended to Public WiFi-Hotspots Regulations, 2018, S.R.O. 1489(I)/2018, published in the Gazette of Pakistan on 13 December 2018. It is a scanned file on pta.gov.pk, so a word in our summary may be misread. The regulation on PTA's site is the authority.
The rules cover WiFi offered in public places
The regulation applies to WiFi hotspots in "public places", which it defines as a street, road, park, garden or any place the public can enter freely, including a hotel, restaurant, motel, mess and club. It applies to licensed access providers and class licence holders who supply the hotspot's internet.
A "WiFi hotspot" in the text is a WiFi node attached to a fixed network that offers limited mobility or fixed access. In plain words: the router in your cafe connected to a broadband line. A home router used by your family is not what this rule is about.
One point to read carefully. The duties are written for the licensee, the company that holds the PTA licence. The text also says the "owner of a public WiFi hotspot" shall record and keep the logs. So both sides carry work, and the cafe owner should expect the provider to set it up.
| Who | What the regulation expects |
|---|---|
| Licensed provider | Registers every public hotspot and keeps the list |
| Licensed provider | Collects user details by an automated form before access |
| Hotspot owner | Records and keeps the network and system logs |
| Provider | Must give retained data to PTA or its officers when asked |
| Provider | Must cut data service to a hotspot that does not comply |
Users must register before they get access
Under regulation 4(5), the hotspot must collect the user's full name, CNIC number or passport number for foreigners, and mobile number, which is used as the login ID. The user accepts the terms and conditions. A password is then generated and sent by SMS.
This all happens on a dedicated server by an automated form, before access is granted. A card with a shared password on the table does not meet that description. The login has to be tied to a person.
- The user connects to the hotspot's login page.
- The form asks for full name and CNIC or passport number.
- The user enters a mobile number, which becomes the login ID.
- The user accepts the terms of the data service.
- An SMS sends a one time password, and access begins.
The logs must be kept for at least 12 months
Regulation 5 requires the hotspot to record NAT or PAT logs and a system log of each user, kept for a minimum of 12 months. The record includes name, CNIC, mobile number, login and logoff time, data used with URLs, MAC address and IP addresses and ports.
NAT and PAT are the address translation steps a router performs so many devices can share one internet address. The logs list which device reached which address, and when. The list in the regulation runs to fourteen items, including internet access logs for web, email and chat services.
Non-compliance leads to disconnection, not just a warning
Regulation 7(2) says that where these rules are not followed, the data service the licensee gives to the public hotspot shall be terminated or disconnected by the licensee. The licensee must also follow any PTA directions or standard procedures on hotspot set up and data retention.
For a cafe owner, this is the real risk: your provider can cut the line. If you are unsure that your set up logs users properly, ask your provider in writing what it records, where, and for how long. We did not read any PTA standard operating procedure on this, and we could not check which providers sell a ready made login system.
Confidentiality protects the people who log in
Regulation 8 says licensees and their staff must keep customer information confidential. They may not share what a customer did on the network with a third party, unless it was published in a directory, the customer agreed, or the law requires it.
So the logs are not a customer list for marketing. If you run a shop, do not use the mobile numbers collected for WiFi to send promotions without asking. If your connection is shared with a family, our guide to sharing a mobile hotspot covers the private case, and the router placement tips cover speed.
If your provider's line is unlicensed, the problem is bigger than logs. We covered the licence rules in how an ISP gets a PTA licence for a district.
Common questions
Can I give customers a shared WiFi password in my cafe?
The regulation expects each user to be registered with name, CNIC or passport and mobile number, and to receive an SMS password. A shared password on a card does not tie access to a person, so it does not match that description.
How long must WiFi logs be kept in Pakistan?
At least 12 months, under regulation 5 of the 2018 regulations. The record covers user identity, login and logoff time, URLs, MAC address and IP details.
Does this apply to my home WiFi?
No. The regulation is about public WiFi hotspots in places the public can enter, such as a hotel, restaurant, club, park or street. Your private home network is not in scope.
Who is responsible, the cafe or the internet provider?
Both appear in the text. The licensee must register hotspots and collect user data. The owner of the hotspot must record and keep the logs. In practice, ask your provider what system it supplies.
What happens if a hotspot does not comply?
The licensee must terminate or disconnect the data service supplied to that hotspot. We did not find a fine amount in this regulation.
Can a cafe share its customer logs with anyone?
Not freely. The confidentiality rule bars sharing customer use of the network with a third party, unless the customer agreed, it was published in a directory, or applicable law requires it. PTA or its officers can ask for the data.
How we verified this
What we checked, where we read it, and what we could not confirm.
Last checked on 11 October 2026. Source: the Data Retention of Internet extended to Public WiFi-Hotspots Regulations, 2018 (S.R.O. 1489(I)/2018, notified 15 October 2018, Gazette of Pakistan, Extraordinary, 13 December 2018), read from the scanned PDF on the Pakistan Telecommunication Authority regulations page, pta.gov.pk. A word could be misread from the scan. We did not read any PTA standard operating procedure issued under the regulations.
About the author
Technology Journalist & Multimedia Producer
Ahmad Ali is a technology journalist and multimedia producer at Pakistan Era, joining the team in October 2026. He covers consumer technology and digital life for Pakistani readers, combining research with hands-on product testing.
