Regulations on guest identification and self check-in changed substantially between the end of 2025 and 2026. In Italy, the Council of State ruling no. 9101/2025 of 21 November 2025 closed the debate opened by the TAR Lazio: self check-in is legitimate, but guest identification must take place "de visu", with a real-time visual check. At European level, since 20 May 2026 EU Regulation 2024/1028 on short-term rental data collection and sharing is fully applicable. And many municipalities — from Florence to Milan — have banned key boxes on public land.
This guide, updated to July 2026, summarises the registration obligations, the permitted verification methods and the official tools required in the main European countries, with practical guidance on organising a fully compliant autonomous check-in.
In brief: what you need to know in 2026
- Self check-in is legal in Italy, but identification must be de visu: in person or with real-time video/biometric verification at arrival (Council of State no. 9101/2025).
- Not compliant: autonomous access based only on sending the ID document before arrival, without a simultaneous visual check.
- Data for all guests must be sent to the police via Alloggiati Web within 24 hours (art. 109 TULPS).
- The CIN (Italian national identification code) is mandatory in listings and at the property entrance: fines up to €8,000.
- From 20 May 2026, EU Regulation 2024/1028 requires the registration number in every listing and monthly data transmission from platforms to the authorities.
- Key boxes on public land are banned in many municipalities (Milan from 1 January 2026, Florence since 2025), with fines and removal.
The European regulatory framework
Within the Schengen area, most states require guest registration, particularly for foreigners, with data transmission to public security authorities within set deadlines. The GDPR provides the legal basis for processing this identifying data, grounded in legal obligation, with minimisation and security principles.
Operational methods, however, remain governed by national — and increasingly municipal — regulations, creating a varied landscape that requires specific attention for each market. A common European layer now sits on top: EU Regulation 2024/1028, designed to give authorities reliable data on who rents what, where and for how long.
Italy: self check-in is legal, but identification is de visu
Italy requires identification of all guests with electronic transmission to the police within 24 hours via the Alloggiati Web platform (art. 109 TULPS, R.D. 773/1931). The path on verification methods has been winding:
- November 2024 — the Ministry of the Interior circular imposes "de visu" recognition, effectively blocking remote check-in.
- 27 May 2025 — the TAR Lazio annuls the circular, temporarily reopening remote verification.
- 21 November 2025 — the Council of State (ruling no. 9101/2025) overturns the TAR decision: real-time visual identity verification is a substantial public security safeguard and remains mandatory.
The balance set by the Council of State is clear: verification may also use digital tools, as long as it is effective, in real time and simultaneous with the guest's arrival.
What is allowed:
- In-person welcome with document check
- Video call at the moment of arrival, comparing face and document
- Systems with biometric verification triggered on entry to the property
- Handover of the access code or card after verification
What is not allowed:
- Sending the document before arrival with automatic code delivery, without any visual check
- Anonymous key handover via key box without identification
- Delegating identification to the booking platform's identity verification
The property manager always remains responsible and must guarantee data transmission to Alloggiati Web whatever method is adopted.
CIN and key box bans
Since 2025 every accommodation facility and short-term rental unit in Italy must have a CIN (national identification code), displayed at the entrance and included in every listing: fines reach €8,000. The CIN is also the registration number Italy uses to comply with EU Regulation 2024/1028.
On the urban front, many municipalities have banned key boxes on public land and street furniture: Florence since 2025, Milan from 1 January 2026, with fines from €100 to €400 and mandatory removal. The direction is clear: anonymous key handover is considered incompatible with the identification obligation and with urban decorum. The alternatives indicated by the municipalities themselves are video intercoms, electronic locks and in-person welcome.
EU Regulation 2024/1028: what changes from 20 May 2026
EU Regulation 2024/1028 introduces the first common European framework for collecting and sharing short-term rental data. From 20 May 2026:
- Every unit offered for short-term rental must have a unique registration number (in Italy the CIN), visible in every online listing.
- Platforms (Airbnb, Booking.com, Vrbo and similar) transmit data on each unit to national authorities monthly: nights booked, number of guests, listing URL, registration number and address.
- Listings without a valid registration number must be removed by the platforms.
For compliant hosts the operational impact is limited, but the regulation makes operating without registration much harder: cross-checked data between platforms and authorities quickly exposes non-compliant properties.
Spain: centralised SES.Hospedajes platform
Since 2 December 2024 the SES.Hospedajes platform of the Spanish Ministry of the Interior has been fully operational: registration of all guests over 14 with transmission within 24 hours, under RD 933/2021, extended data collection and retention for 3 years. Booking platforms are involved as intermediaries, but compliance responsibility remains with the host.
Portugal: focus on foreigners
Portugal requires communication of foreign guests only, within 3 days via the SIBA system. National guests do not need to be reported: an approach that simplifies management for properties with mainly domestic clientele.
France: fiche de police with digitalisation
France requires the fiche individuelle de police only for foreign tourists, kept at the property for 6 months and transmitted to the authorities on request. The system allows dematerialisation, opening the door to digital solutions and reducing daily burdens.
Germany: simplification for domestic guests
Since 2025 the Meldeschein has been abolished for German guests: the registration obligation remains only for foreigners, with the option of qualified electronic signature and eID NFC (AusweisIDent) systems for contactless check-in.
United Kingdom: post-Brexit continuity
The Hotel Records Order 1972 remains in force: registration of name and nationality for guests over 16; for non-UK/IRL/Commonwealth citizens also document type and number and next destination, with the register kept for 12 months.
How to organise a compliant self check-in in 2026
The new rules do not eliminate autonomous check-in: they transform it. The compliant flow for Italy is:
- Before arrival — collect the guest's data and document (online pre-check-in).
- On arrival — de visu verification: in person or via video call, comparing face and document in real time.
- After verification — send data to Alloggiati Web within 24 hours and hand over the access credential: a temporary code valid only for the stay period or an RFID card.
Access technology makes the difference in the final part of the flow. GEVA systems for B&Bs and short-term rentals generate temporary access codes tied to the booking dates and RFID cards for subsequent entries, work offline and without cloud (no network outages, no subscription fees) and let you deliver the code only once identification is complete: automation handles the door, compliance stays under the host's control. For larger properties — hotels, holiday villages, scattered hotels — the Easy Hotel and Full Hotel lines extend the same approach to the whole building, with access control and in-room energy saving.
The role of booking platforms
Booking platforms (Airbnb, Booking, etc.) never replace the host's public security obligations. They may perform identity checks for their own purposes (trust & safety), but legal responsibility for identification and data transmission always remains with the accommodation facility.
Operational recommendations
- Check municipal regulations in addition to national rules: key box bans and short-term rental limits are decided locally.
- Display the CIN at the entrance and in all listings before the EU cross-checks kick in.
- Document the identification process (who verifies, how, when) for any inspections.
- Choose access technology with expiring codes and offline operation, to avoid depending on cloud and connectivity.
- Train staff and keep procedures up to date: the regulatory framework keeps evolving.
Frequently asked questions
Is self check-in legal in Italy in 2026?
Yes. The Council of State (ruling no. 9101/2025) confirmed that self check-in is legitimate, but guest identification must take place de visu: in person or via video call or real-time biometric verification, simultaneous with arrival. Simply sending the document with automatic code delivery is not compliant.
What does "de visu" identification mean?
Visually verifying, at the moment of arrival, that the person matches the document provided. The check can be physical or digital (video call, biometric verification), as long as it is effective and simultaneous with entry. Data must then be sent to Alloggiati Web within 24 hours.
Are key boxes banned?
On public land and street furniture yes, in a growing number of municipalities (Florence since 2025, Milan from 1 January 2026), with fines from €100 to €400 and removal. In any case, a key box does not exempt the host from de visu identification.
What changes with EU Regulation 2024/1028?
From 20 May 2026 every short-term rental must have a unique registration number (in Italy the CIN) displayed in listings; platforms transmit booking data to the authorities monthly and remove listings without a valid registration.
Is Airbnb or Booking identity verification sufficient?
No. Platform verifications serve their own purposes. Identification for public security and data transmission to the authorities remain the host's obligations.
Can I still use temporary access codes and RFID cards?
Yes: they are the recommended alternatives to key boxes. What matters is handing over the code or card only after de visu identity verification. Systems with single-use codes tied to the stay dates and offline operation add security and operational continuity.
The information in this article is updated to July 2026 and is for general guidance only: it does not constitute legal advice. For specific cases, consult a professional or official sources.