Hotel guest register requirements come from state statutes and local ordinances, and they generally obligate a lodging operator to record each guest’s full name, home address, arrival and departure dates, and assigned room, verify that information against a government-issued photo ID, keep the record for a set number of years, and protect it from unauthorized disclosure. There is no federal statute that imposes the register itself, but federal rules on tax records, data security, and record disposal layer on top of whatever the state and city require.
What the Register Must Contain
Four data points appear in nearly every jurisdiction that mandates a guest register: the full legal name of each adult guest, their permanent home address, the arrival date and expected departure date, and the specific room assigned. That is the floor.
Many localities add more. Some require a description of the guest’s vehicle and its license plate number when the car is parked on the property. Others require the operator to record the number of occupants in each room, children included. The entry is typically confirmed by examining a driver’s license, passport, or other government-issued photo ID, and this verification step is the entire point of the exercise: matching the person standing at the front desk to the name that goes into the register.
Group and corporate bookings do not create an exception. Even when a company reserves a block of rooms under a single master account, each individual occupying a room usually must be identified in the register with their own name and verified ID. Billing and registration are separate obligations, and skipping individual registration because “the company is paying” exposes the operator to the same penalties as skipping registration entirely.
Verifying Guests and Handling Refusals
No federal law requires hotels to collect identification at check-in. The obligation, where it exists, comes from state and local law. In jurisdictions that mandate a register, the hotel has little choice: admitting a guest without collecting the required information puts the operator at risk of fines or license suspension.
Even where no registration statute applies, most hotels require ID and a credit card as internal policy, and they can legally refuse a room to someone who will not provide identification. The older common law tradition that innkeepers must accommodate all comers has been narrowed by modern statutes recognizing legitimate grounds for refusal, including a guest’s unwillingness to comply with reasonable registration procedures.
Minors are a separate problem. An operator generally cannot refuse to admit a guest solely because of age without risking a discrimination claim, but minors can void contracts, so they could walk out on the bill with limited legal consequence. The practical response is advance payment in cash or on a verified credit card, parental contact information collected at check-in, and a written acknowledgment of the property’s rules.
How Long the Records Must Be Kept
Retention periods are set by state and local law, and most fall in the range of one to three years after the guest’s departure. The purpose is straightforward: if a criminal investigation, civil lawsuit, or tax dispute arises months or years later, the register still needs to exist. Destroying records before the retention period expires carries the same penalties as never keeping them, and in civil litigation courts may draw negative inferences from missing records.
Federal tax rules impose their own floor. The IRS requires businesses to keep records supporting income, deductions, and credits for at least three years from when the return was filed. If the business underreported gross income by more than 25 percent, the retention period extends to six years. For employment tax records, the minimum is four years after the tax is due or paid, whichever is later.1Internal Revenue Service. How Long Should I Keep Records Because the register supports occupancy tax calculations, these federal minimums often overlap with, and sometimes exceed, the state-mandated window.
A change in ownership does not reset the clock. The outgoing operator typically must transfer all guest records that still fall within the retention period to the new owner. Failing to arrange that transfer during a sale is a common oversight, and it can leave both buyer and seller exposed if records are needed later and nobody can produce them.
When Police Can See the Register
The rules on law enforcement access changed sharply in 2015. Before then, some cities had ordinances allowing police to walk into a hotel and demand the register on the spot, with no warrant. Los Angeles had exactly such a law, and it criminalized an operator’s refusal to hand it over.
The Supreme Court struck that down. In a 5-4 decision in Los Angeles v. Patel, the Court held that forcing hotel operators to turn over guest registries to police on demand, with no opportunity to object before a neutral decision-maker, violates the Fourth Amendment.2Justia Supreme Court. Los Angeles v. Patel, 576 US 409 (2015) The ruling did not say police can never see hotel records. It said operators must have a meaningful chance to challenge the request first.
Law enforcement now has several lawful paths to the register:
- Administrative subpoena. Officers in the field can issue one without probable cause. If the operator objects, a neutral decision-maker reviews the dispute before any records change hands. The Court identified this as a workable alternative.2Justia Supreme Court. Los Angeles v. Patel, 576 US 409 (2015)
- Administrative warrant. A judge reviews the request and issues a warrant authorizing the search, limited to the information or timeframe described in the order.
- Voluntary consent. The operator can choose to cooperate without any legal process. That is a management decision, not a legal requirement.
- Exigent circumstances. In a genuine emergency, such as an imminent threat to life or the likely destruction of evidence, police can access records without prior authorization. The Patel Court preserved this exception.2Justia Supreme Court. Los Angeles v. Patel, 576 US 409 (2015)
Note the distinction between the obligation to keep the register and the obligation to produce it. Patel did not question the requirement to maintain the record. It addressed only the conditions under which police can force the operator to hand it over. Obstructing a lawfully authorized inspection, whether backed by a warrant or a valid subpoena, still carries potential criminal penalties, including misdemeanor charges in many jurisdictions.
Protecting and Disposing of Guest Records
A guest register contains exactly the kind of personal information that creates liability when it leaks: full names, home addresses, ID numbers, vehicle descriptions, and often credit card details tied to the stay. Hotels are not exempt from the data security standards that apply to other businesses handling personal information, and the volume and sensitivity of what they collect can invite heightened scrutiny.
The FTC has pursued lodging companies for failing to protect guest data. In its action against Marriott and its Starwood subsidiary, the agency required a comprehensive information security program covering access controls, network monitoring, software patching, and multifactor authentication, along with annual compliance certifications for 20 years and independent third-party security assessments every two years.3Federal Trade Commission. FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches Once an FTC consent order is in place, future violations can carry civil penalties into the tens of thousands of dollars each.4Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
All 50 states, the District of Columbia, and U.S. territories have data breach notification laws requiring businesses to alert affected individuals when personal information is compromised. Hotels sit squarely within the scope of these laws. Deadlines and specific triggers vary, but the obligation itself is universal.
Disposal After Retention Expires
When guest records contain consumer report information or data derived from consumer reports, the FTC’s Disposal Rule requires “reasonable measures” to protect against unauthorized access during destruction.5eCFR. Disposal of Consumer Report Information and Records For paper records, that means shredding, burning, or pulverizing so they cannot be reconstructed. For electronic records, it means destroying or erasing the media so the data is unrecoverable.
Hotels that outsource destruction must perform due diligence on the vendor, including reviewing security policies and, ideally, requiring certification by a recognized industry association.5eCFR. Disposal of Consumer Report Information and Records Tossing old registration cards into a dumpster, or donating a computer that still holds guest records on its hard drive, is the kind of practice that draws enforcement. Records that have passed the mandatory retention period become a liability if they are disposed of carelessly.
Format of the Register
Older innkeeper statutes often specified a “permanently bound book,” which prevented anyone from removing or swapping pages. Most jurisdictions now permit electronic recordkeeping, but the underlying concern is unchanged: the register must be tamper-resistant, and entries must remain legible and complete throughout the entire retention period.
Digital systems offer real advantages in searchability and storage, and they carry requirements paper never had. An electronic register generally must be capable of producing a printed or on-screen report of all entries on demand, and it needs backup protocols to protect against hardware failure, ransomware, and other disruptions. Some jurisdictions treat a disorganized or illegible register as no register at all, so reliable technology and regular backups matter.
Format is less important than reliability. Whether the record lives in a leather-bound ledger or a cloud-based property management system, it must be complete, accurate, available for inspection when legally required, and preserved for the full retention period without gaps or alterations.