Since the early 2000s, WiFi terminals allowing access to the Internet via wireless networks have multiplied in French public places. Users equipped with WiFi-compatible mobile devices (laptops, mobile phones, PDAs) are thus able to connect to the Web or to professional applications (extranet, etc.) while travelling or staying in a hotel, for example.

However, the rise of WiFi has raised a new issue in the fight against new technology-related crime. While it is possible to be clearly identified when using traditional means of communication (fixed and mobile telephony, internet access at home), WiFi terminals offer a means of communication that allows people to operate anonymously and therefore with impunity.

Among the offences related to the use of the Internet, we distinguish :

Fraud and cybercrime :

  • Invasion of privacy
  • Online scam
  • Hacking of private networks

Cybercrime :

  • Child pornography
  • Organised crime
  • Terrorism...

In response to these growing threats, the French State has put in place, in accordance with European directives, a legislative framework aimed at limiting the anonymity of public WiFi users, with the aim of ensuring the security of citizens, while guaranteeing respect for individual freedoms.

The purpose of this section is to shed light on the responsibilities and risks inherent in the provision of a WiFi service, based on the regulations in force.


Bodies in charge of the regulation of public WiFi in France

ARCEP The Autorité de Régulation des Communications Electroniques et des Postes was created in 1996 to regulate competition in the telecommunications sector. This authority also monitors compliance with emission standards.

CNCIS The Commission Nationale de Contrôle des Interceptions de Sécurité (CNCIS) is an independent administrative authority responsible for ensuring compliance with the provisions relating to correspondence transmitted by electronic communications.

CNIL The Commission Nationale de l'Informatique et des Libertés (CNIL) was established by law n° 78-17 of 6 January 1978. This independent authority lays down the rules relating to information technology, files and freedoms.

HADOPI Hadopi is an institution exclusively dedicated to the dissemination of works and the protection of rights on the Internet. It sets an unprecedented precedent for changing the debates and problems encountered by copyright on the Internet.

THE JUDICIAL AUTHORITYThe judicial authority ensures compliance with the regulation of public WiFi. To do so, it relies on the investigations of the police and national gendarmerie services in the framework of classic judicial requisition. An administrative requisition procedure specially created for the fight against terrorism allows the services concerned, such as the Direction de Surveillance du Territoire (DST), to act more quickly. Ministry of the Interior

What is an Internet Service Provider (ISP)?

Article L32 of the Code des Postes et des Communications considers as an Internet access provider :

  • Providers of access to electronic communications networks accessible via a WiFi terminal,
  • Individuals whose activity is specifically aimed at offering an online connection service for a fee, such as the managers of "cybercafés",
  • Those who offer an internet connection to their customers or visitors in a public setting, such as hotels/restaurants, airports or public transport.



Case study

If a carrier wishes to offer Internet access to its passengers, it has two options:

He decides to call upon an Internet Service Provider, i.e. a professional declared to ARCEP, in order to entrust him with his public access service. Consequence: the carrier is not considered as an electronic communications operator. He is not subject to the regulations, his Internet Access Provider being responsible for ensuring compliance with the legal obligations on his behalf.

He decides to manage his own access service. He buys WiFi equipment and then calls on a telephone operator who will be responsible for deploying and possibly maintaining the equipment. Consequence: The carrier is considered as an Internet Service Provider. He has the obligation to declare his activity to ARCEP, he is responsible for the annual administrative tax according to his turnover (in K€) and the respect of all legal obligations inherent to his status of operator.


Definitions and principles laid down in Article L32 of the French Post and Electronic Communications Code.

Electronic communications

"Electronic communications means the emission, transmission or reception of signs, signals, writing, images or sounds by electromagnetic means. »

Network open to the public

"A network open to the public shall mean any electronic communications network established or used for the provision of electronic communications services or services to the public by electronic means. »


"Operator means any natural or legal person operating an electronic communications network open to the public or providing an electronic communications service to the public. »

Extract from the general conditions of the French telecommunications operators


Article 38

  • "PROVISION OF THE CARD BY ORANGE BUSINESS SERVICES 38.2. Except with the prior written consent of Orange Business Services, the Customer shall not combine the Card with technical solutions for the purpose of redirecting Communications by any technical process, pooling a Service among several Users, or linking them together. In general, and in particular in such cases, Orange Business Services reserves the right to suspend and then terminate the Order in question. The Customer will then be invoiced retroactively for the Communications on the basis of a metered rate applicable to it. »

Article 44

  • "The Customer and its Users shall refrain from any fraudulent use of the Service concerned, such as in particular : the use of Unlimited Communications for commercial purposes (resale of Unlimited Communications), the association of the Cards with any traffic redirection solution, except with the express agreement of Orange Business Services, the uninterrupted use of the package, in particular by means of automatic and continuous dialling of numbers on the Line, the sending of mass SMS messages, whether automated or not. In the event of non-compliance with reasonable behaviour relating to unlimited voice communications, Orange Business Services reserves the right to suspend the Service. In case of fraudulent use, except as specified in the paragraph below, Orange Business Services reserves the right to suspend the Service and then terminate the relevant Order in accordance with the provisions hereof. In the event of use of Unlimited Communications for commercial purposes (including resale of Unlimited Communications), Orange Business Services shall terminate the relevant Order automatically and without notice.


Article 9.3

  • "Furthermore, with regard to unlimited communications offers, the Customer agrees not to make any fraudulent use, such as in particular: the use of unlimited communications for commercial purposes (resale of communications), the use of "voice" offers or services for data use, in particular for the needs of Machine to Machine type applications. »

Article 7.6

  • "Without prejudice to the application of the preceding provisions, with regard more specifically to SIM cards, the Customer shall refrain from any use with a radio connection box or any other technical solution whose purpose is to modify the routing of the Service and/or optional services. »


Article 3

  • "The Subscriber is solely responsible for the use and conservation of the SIM card, which may not be duplicated. The SIM card may not be used by the Subscriber to propose a commercial offer to a third party. More generally, the Subscriber undertakes not to make any commercial use of the access to the SFR network which is made available to him, in particular by allowing third parties to access the SFR network in return for a financial consideration. The SIM card may not be used by the Subscriber, by a telecommunication network operator or by a telecommunication service provider, for the purpose of modifying the routing of a telecommunication service on a public telecommunication network. In particular, it may not be used in the context of radio boxes, neither in transmission nor in reception. Any fraudulent use of the SIM card, or use contrary to these conditions, engages the personal responsibility of the Subscriber.

Obligations of a WiFi operator

Offering WiFi access to the public must be done in compliance with the regulatory framework in force in France.

Collection and storage of technical data for one year.

The law of January 2006¹ introduces into the Code des Postes et Télécommunications² provisions that oblige electronic communications operators to keep certain technical data concerning their users for a period of one year. The new obligations are intended to provide the authorities with sufficient evidence in the event of a search for proof in the context of the prevention of acts of terrorism.

This obligation obviously concerns WiFi operators.

Categories of information that must be retained :

  • Information thatidentifies the user
  • Data on the communication terminal equipment used
  • The technical characteristics as well as the date, time, duration and location of each communication
  • Data on additional services requested or used and their providers
  • Data allowing theidentification of the recipient(s) of the communication

Operators are under no obligation to keep records of users: Organisations providing a WiFi connection may choose to offer this service without identifying individuals. In this case, they are only required to hold the technical data created by the use of their services. Operators only have to keep the technical data. They do not have to keep information about the content of communications: the text of an SMS, the subject and content of an email, etc.


The Commission Nationale de Contrôle des Interceptions de Sécurité (CNCIS) may at any time carry out checks on technical communications operations.

Failure to comply with this law is punishable by up to 5 years' imprisonment and a fine of 300,000 euros.


¹ Law n° 2006-64 of 23 January 2006 on the fight against terrorism and on various provisions relating to security and border controls. "In order to prevent acts of terrorism, the agents of the police and national gendarmerie may require operators to communicate data stored and processed by the latter. »

² Articles L34-1 and L34-1-1 of the French Post and Electronic Communications Code "Persons who, as part of their main or secondary professional activity, offer to the public a connection enabling online communication via a network access, including free of charge, are subject to the provisions applicable to electronic communications operators. »

Opinion n° 2005-0918 of 13 October 2005 on the draft law on the fight against terrorism.

Compliance with wave emission standards

In order to prevent any risk linked to WiFi waves on public health, the Autorité de Régulation des Communications Electroniques et des Postes (ARCEP) has set the conditions for the emission of electromagnetic waves emitted by WiFi terminals. These conditions were included in the decree n° 2002-775 of 3 May 2002 which legislated on the frequency and power of the waves emitted by WiFi terminals.

Frequency :

The lower the frequency of a wave, the more likely it is to penetrate matter and therefore have an impact on exposed individuals. ARCEP has set the level of electromagnetic fields produced by public WiFi networks at 2540 Mhz.

For comparison, FM radio and mobile telephony (GSM) both use much lower, and therefore more harmful, frequencies, respectively between 87.5 and 108 Mhz on the one hand and between 900 and 1900 Mhz on the other.

Power :

ARCEP has set the power of the waves emitted from a WiFi terminal at a maximum limit of 0.1 Watt, i.e. a power 20 times lower than that of mobile phones (2 Watts). The distance between the transmitter and the individual greatly reduces the power of the waves. Indeed, at a distance of 20 centimetres from the WiFi terminal, the energy of the waves is already divided by two and beyond 50 centimetres it is even divided by ten.


The Health and Radiofrequency Foundation, at a scientific meeting held in October 2007, concluded that "studies conducted to date have not identified any impact of radio frequencies on health below the legal power limits. "The French Agency for Environmental and Occupational Health Safety (AFSSET), which is the reference for health advice on the impact of radio frequencies, issued the same opinion on WiFi. In its report on mobile telephony dated April 2005, the ARSSET concluded that "Exposure to WiFi is always in the far field (at least 50 cm) and the transmission power is low. With regard to WiFi technology, the very low power levels involved, as well as the high frequencies, imply a much lower exposure than with conventional mobile telephony. »

Failure to comply with WiFi emission standards is punishable by up to six months' imprisonment and a fine of €190,000.


Respect for users' individual freedoms

Personal data must be collected fairly and for specified, explicit and legitimate purposes.

The collection of personal data must first have received the consent of the person concerned and the data must be freely consultable and modifiable. The only exception to the prior consent rule is the collection and processing of technical data as defined in Article L.34-1 of the French Post and Electronic Communications Code (see page 6). Apart from this technical data, the French Data Protection Act applies to the collection and processing of all personal data.

Failure to comply with the Data Protection Act is punishable by up to five years' imprisonment and a fine of €300,000.


Law of 6 January 1978 on Information Technology and Civil Liberties: "Information technology must not infringe on human identity, human rights, privacy, or individual or public liberties. »


ECE R10 standard

The on-board equipment must comply with electromagnetic compatibility standards. Directive 95/54 EC introduces the following concepts:

  • functions related to the "direct control" of the vehicle, by which is meant all functions that can act: by degradation or change in the engine, gear change, braking, suspension, etc., that may affect the driver's position, for example: the memory seat, the positioning of the steering wheel, that may affect the driver's visibility such as the organs related to the windscreen wipers.
  • functions related to the driver and his passengers, other road users: example: airbag
  • functions likely to create confusion for the driver or other road users: optical disturbances (e.g. flashing lights, stop lights, false information from indicator lamps), significant acoustic disturbances (e.g. alarm, horn)
  • functions related to the operation of data buses: blocking of data transmission
  • special functions such as odometer, tachograph

ECE R 118 standard

Relating to the fire behaviour of certain categories of motor vehicles. This concerns the wire between the outdoor antenna and the WiFi box, which must be fire-resistant according to the standard.

The commitments of a responsible internet service provider :

WIIBUS guarantees you an on-board WiFi service in full compliance with the regulations in force and its evolutions.

  • The necessary technical data are collected, stored and processed on secure platforms and systematically transmitted to the authorities in the context of judicial requests.
  • Respect for individual liberties is guaranteed and no personal data is collected or used without the prior consent of the person concerned.
  • All installations comply with the standards set by ARCEP on the frequency and power of electromagnetic wave emissions. Trusting WIIBUS is the assurance of a WiFi service that complies with the regulations