Automated hotel check-in: an Italian case, and what the law actually says

Anyone running a property who looks at digital check-in systems almost always starts from the wrong question: «this technology exists, can I install it?». The real question is different: once it's installed, does how you use it still meet the legal duty to identify who's coming in, a duty that stays yours and doesn't automate itself?

The case getting the most attention in Italy these past few months is a hotel in Taranto.

The case: a hotel in Taranto that says it has digitised everything

ALH, Albergo Lamanna Hotel Digitale, in Taranto, published its own transformation as a case study signed by the property's CEO, Irene Lamanna: online pre-check-in with document upload, a direct link to the police's Alloggiati Web portal for the guest report, TTLock smart locks that open with a digital key, facial recognition or a fingerprint, voice control of lights and air conditioning in the room, and a kiosk for walk-in guests, described as still being installed at the time of publication.

It's a genuine case in the sense that the technology described exists and can be checked item by item: smart locks with a biometric reader are real products, and Alloggiati Web is the portal every Italian property already uses. But, as written, it's also a company's own press release: there's no independent analysis of this case, and no number measured by anyone outside the hotel.

What the case study doesn't say

The published text carries no verifiable figures: no check-in times, no guest satisfaction scores, no installation costs, no before-and-after comparison on consumption or complaints. The kiosk for walk-in guests, the piece that would most change how a guest actually enters the property, was still to be installed at the time of publication, not yet running.

A few promotional phrases are worth separating from the technical fact: describing the security level as comparable to that of a cruise ship, or walk-in check-in as destined to happen «without queues and without stress», are claims made by the property about a service that wasn't live yet, not a measurement.

That said, the reason this is worth discussing isn't the case itself: it's that the very combination it describes, a self-service kiosk plus a biometric lock, is exactly the point on which Italian law has taken a sharp position over the past twelve months.

Who has to see whom: the duty a kiosk doesn't remove

Article 109 of the TULPS requires anyone running an accommodation business to identify every guest. Administrative judges call this the «de visu» recognition duty, and for decades it meant a person at the desk looking at the guest's face and their document.

Over the past two years, a dispute opened over what that duty means once check-in runs through a device. A circular from the Chief of Police dated 18 November 2024 reminded operators of the duty to identify guests in person; the Lazio regional administrative court (TAR Lazio), in May 2025, had ruled it unlawful after a trade association's appeal; the Council of State, in ruling no. 9101 of 21 November 2025, overturned that decision and reaffirmed the duty in full, while clarifying the point that matters most to an operator: «de visu» shouldn't be read as purely physical. A direct, real-time visual comparison between the person and the document, through a video link for example, can be enough.

What the judges ruled out is the other extreme: just uploading a photo of a document, with automatic access through a code or a key box, with nobody checking at that moment who is actually coming in. That's precisely the setup a self-service check-in kiosk risks sliding into if it's built without this step.

For anyone looking to automate check-in, the practical consequence is this: the kiosk, or the key-box system, needs to include real-time verification, not just document collection. Reporting guest data to the police through Alloggiati Web remains a separate duty, with its own deadlines: I wrote about it in more detail here.

When the key becomes a face, the data changes category

There's a second, independent layer for anyone choosing facial recognition or a fingerprint to open rooms instead of a card.

A face or a fingerprint used to identify someone uniquely is a special category of data under article 9 of the GDPR, held to the same level of protection as health data. Processing it is prohibited unless an exception applies, explicit consent among them. The delicate part is what makes that consent valid: the EDPB's guidelines on video surveillance devices are clear, when consent is the legal basis required by article 9, whoever processes the data can't make access to the service conditional on accepting biometrics, and must offer an alternative that doesn't require it, with no extra restraints or costs. Without that alternative, the consent collected isn't considered free, and so isn't valid.

Italy's data protection authority applies this principle strictly when the alternative is missing or a power imbalance makes the consent doubtful: in February 2024 it fined several companies, one of them 70,000 euros, for using facial recognition to track staff attendance on a construction site, without an adequate legal basis. In September 2025 it blocked the facial recognition system SEA used for boarding at Milan Linate airport, relying on the EDPB's opinion on facial recognition in airports, which itself points to the need for workable alternatives with no detriment for those who opt out.

A guest who voluntarily chooses biometrics to open their own room is a different context from an employee clocking in: there's room for genuinely free consent. But it only exists if someone who doesn't want to use their face or fingerprint can still get into their room with a card or a PIN, without paying more or waiting longer.

What you need before installing, not after

Three things, before signing with a smart-lock or check-in kiosk supplier: a dedicated privacy notice for the biometric processing, separate from the general one; a real non-biometric alternative, offered to the guest without presenting it as the inconvenient option; and, likely, a Data Protection Impact Assessment, since Italy's Garante lists systematic biometric processing among the cases that require one.

None of these three appear in the Taranto case study, which isn't a flaw specific to that case: a company's own press release isn't where you'd expect to find its internal compliance steps described. But it's exactly what separates installing the technology from being able to use it as described, kiosk included, without risking a challenge over the first walk-in guest who shows up outside reception hours.

If you want to know whether your website and the way you communicate check-in are already doing the job they should, the digital check-up is free if we then start with one of the monthly services. Otherwise write to me: tell me what you're considering installing, and I'll tell you which of these three steps you're still missing.