Self Check-In and Keyboxes in Italy: What Property Owners Need to Know

You can let guests into your property without being there. What you cannot do is let them in without anyone ever looking at them.

Last checked: 5 October 2026. This question was decided in court in November 2025. Before acting, check the official sources linked throughout this guide.

The short answer

Self check-in has not been made illegal in Italy, and keyboxes have not been banned. What a Ministry of the Interior circular ruled out — and what the Council of State allowed it to rule out — is a specific practice: collecting copies of your guests’ documents electronically and then sending them a door code or a keybox code, with no visual check at all of who is actually walking in.

The obligation is to verify that the person in front of the property is the person on the document. The court said that this check does not necessarily require you to be standing there yourself. What it does require is that the check happens, and that it happens at the moment of access.

Four things that are not the same thing

Almost every confused conversation about this subject comes from merging four separate steps into one. They are separate in law and they are separate in practice.

	What it is	Is it regulated?
1. Collecting data	The guest sends you their details and a copy of their document before arrival	Useful preparation. It is not identification, and no rule treats it as such
2. Identification	Checking that the person really is the holder of that document	Yes. Article 109 of the TULPS, and the circular of 18 November 2024
3. Access	How the guest physically gets in: a key handed over, a keybox, a smart lock, a code	Not regulated as such. It becomes a problem only when it replaces step 2
4. Reporting	Sending the guests’ identities to the police through Alloggiati Web	Yes. Article 109, within 24 hours — 6 if the stay is 24 hours or less

Steps 2 and 4 are two different duties in the same article of law. You can do the fourth perfectly and still be in breach of the second. Step 3, the part everyone argues about, is not the regulated part at all.

What Article 109 actually says

Article 109 of the consolidated public security act — the TULPS, Royal Decree 773 of 1931 — contains two obligations.

The first: the people it lists may give accommodation only to people holding an identity card or another document suitable to prove their identity. For non-EU guests, a passport or an equivalent document bearing a photograph is sufficient.

The second: within 24 hours of arrival — or 6 hours where the stay is not longer than 24 hours — those same people must report the identities of their guests to the territorially competent Questura, the provincial police headquarters.

It applies to short lets. That is not a matter of interpretation: article 19-bis of Decree-Law 113 of 2018, converted into Law 132 of 2018, states that article 109 is to be read as applying to landlords and sublandlords letting property, or parts of it, under contracts of less than thirty days.

What happened in court

Three dates, in order.

• 18 November 2024. The Chief of Police issues a circular — protocol number 38138 — to all Prefects and Questori. It confirms that managers of accommodation of every kind must verify guests’ identity de visu, by checking that the people staying match the documents provided, and it excludes the legitimacy of remote check-in procedures.
• 27 May 2025. The Regional Administrative Court for Lazio, in judgment no. 10210/2025, annuls the circular, holding it contrary to article 109 and disproportionate.
• 21 November 2025. The Council of State, Third Chamber, deciding the Ministry’s appeal after a hearing on 9 October 2025, upholds the appeal, reforms that judgment and dismisses the original claim. The circular stands.

If you read anything about this before December 2025, there is a good chance it describes the position as it was after the first judgment and before the second. The second is the one in force.

What the decision says — and what it does not

This distinction matters more than anything else on this page, so we will be exact about it.

The decision says that the identification duty in article 109 was not swept away by the 2011 reform, which changed only how guest details are communicated, not whether guests have to be seen. It says the circular was a legitimate confirmation of an existing obligation rather than a new rule invented by administrative letter.

The decision also says — and this part is routinely left out of the coverage — that identification de visu does not necessarily come down to the owner checking in person. The court observed that it could be carried out through video-link devices installed by the manager at the entrance to the property, provided they are capable of establishing, there and then, that the guest really is the holder of the document shown or transmitted. It gave two examples: a digital spyhole, and a QR code that captures a still image.

It then noted that the circular neither addresses these solutions nor categorically excludes them, and that what the circular censures are the most extreme remote check-in procedures — those in which managers simply collect the guests’ identity documents with no visual check whatsoever and send them automated codes for the door or for a keybox at the entrance.

The decision does not say that keyboxes are prohibited. It does not say that self check-in is unlawful. It does not approve any particular device, service or product. And it does not rule on whether a video call made on the guest’s own phone is enough: the examples it gives are devices the manager has installed at the entrance. We are not going to turn an example into a rule, in either direction.

So are keyboxes banned?

No. There is no express national prohibition of keyboxes in any of the sources above, and the court’s reasoning is not about the object at all. A keybox is a way of handing over a key.

The way to think about it is sequential. A keybox used after a real-time visual check is a convenience. A keybox used instead of that check is the practice the Ministry ruled out.

Two caveats worth knowing, because they come from a different direction entirely. First, some Italian cities have introduced their own local rules about keyboxes fixed to street-facing walls and railings — those are municipal measures about public space and street furniture, not about identification, and they do not automatically apply anywhere else. We found no such measure for Olbia in the sources we consulted, and we are not going to transplant another city’s rules onto Gallura. Second, if your property is in a block of flats, fixing anything to the common parts is a condominium question, governed by the building’s own rules, and it is worth checking before you drill.

Can guests send their documents before arrival?

Yes, and it is sensible: it means the data is ready when the reporting clock starts, which matters a great deal on a stay of under 24 hours, where you have six hours rather than twenty-four.

What it does not do is complete the identification. Sending a photograph of a passport three days in advance tells you that someone holds that passport. It does not tell you that the person opening your door is that someone. That gap is the entire subject of the circular and of the judgment.

One practical point, from a different rule: once the system has generated the receipt for your transmission, the ministerial decree requires you to delete the transmitted data. What you keep is the receipt, for five years. So the pre-arrival copies are working material, not an archive to build.

Can a smart lock or a keybox still be used?

Treat the technology as what it is: a way of opening a door. None of the sources treats a lock, a code or a box as a method of identification, and neither should you.

The principle the court set out is that the visual check must establish, at that moment, the correspondence between the guest and the document. A device that lets you see the person at the entrance while they are entering can do that. A code sent by message cannot, because nobody is looking.

We are deliberately not recommending products or setups here. No official source certifies any of them, and an article that told you “this device makes you compliant” would be making a promise that no one is in a position to make.

If you live outside Italy

This is the part that worries owners abroad, and reasonably: you cannot fly to Olbia for every arrival.

What the sources establish is that the obligation under article 109 sits with the person giving the accommodation. Delegating the work does not delegate the responsibility. Within that, two things are clear:

• Someone else can carry out the check and the reporting. For the reporting side, the ministerial decree of 16 September 2021 states that the credentials issued to the property must be used personally by the manager or be handed to an identified person, specifically appointed to carry out the transmission, with the relevant instructions. The Questura of Sassari, which covers Olbia, also recognises applications from estate agencies and property managers, who attach their company registration extract.
• The identification still has to happen. Appointing someone does not remove the requirement; it moves who performs it. Whoever it is has to be able to do the visual check at the moment of access, and you should know in writing who that is and how they do it.

What no source supports is the idea that a management contract, by itself, settles the question. If you take one thing from this section, make it the practical one: before you sign with anyone, ask who looks at the guest, how, and what evidence you get back. Our guide to Alloggiati Web and SIRED covers the receipts side of that answer.

Does it apply to Airbnb and Booking.com stays?

Yes. The duty attaches to whoever gives the accommodation, not to the channel the booking came through, and article 19-bis settled that lets of under thirty days are covered. The platforms do not identify your guests for you and do not report them to the police on your behalf.

Is any of this different in Sardinia?

The identification rule is national and applies in Olbia exactly as it applies anywhere else in Italy. What Sardinia adds is on the reporting side rather than the identification side: alongside the national police portal, the Region runs its own system, SIRED / ROSS 1000, for tourism statistics, with its own 24-hour deadline. Those are separate duties, and one does not cover the other.

Before any of this applies, a property needs its codes. The IUN and the CIN in Sardinia sets out that part.

A practical checklist

Step	The question to answer
Decide who performs the check	You, someone local, or a manager — named, not assumed
Decide how the check happens	In person, or a device at the entrance that shows you the guest while they arrive
Make sure it happens at access	Not the day before, not afterwards
Check every guest, not just the booker	The duty covers everyone who stays the night
Keep the keybox in its place	After the check, not instead of it
Report through Alloggiati Web	24 hours, or 6 if the stay is 24 hours or less
File the receipt, delete the rest	Receipt kept five years; transmitted data deleted once it exists
Check the building’s rules before fixing anything	Common parts are a condominium matter

Frequently asked questions

Is self check-in legal in Italy?
Self check-in as a way of letting guests into a property has not been prohibited. What was ruled out is a check-in in which documents are collected remotely and an access code is handed over with no visual check of the guest. The Council of State upheld that position in a decision deposited on 21 November 2025.

Are keyboxes banned in Italy?
No express national prohibition of keyboxes appears in the sources. The issue is not the box but whether anyone verified who is going in. Some municipalities have introduced local rules about boxes attached to street-facing walls; those are separate measures about public space, and we found none for Olbia.

Do I need to meet every guest in person?
Not necessarily. The Council of State observed that the check could be carried out through video-link devices installed at the entrance, capable of establishing there and then that the guest is the holder of the document, and gave a digital spyhole and a QR code capturing a still image as examples. What is required is the check, at the moment of access.

Can guests send their ID before arrival?
Yes, and it helps you meet the reporting deadline. It does not amount to identification on its own, because it does not establish that the person arriving is the person on the document.

Can I use a smart lock?
A smart lock is a way of opening a door, and no source treats any device as a method of identification. It can sit inside a compliant arrangement, after the visual check; it cannot replace it.

Do I still need to use Alloggiati Web?
Yes. Identification and reporting are two separate duties in the same article. Alloggiati Web is the sole channel to the Questura, within 24 hours of arrival, or 6 hours where the stay is not longer than 24 hours.

Can a property manager handle check-in for me?
Someone else can carry out the work. The 2021 ministerial decree allows the property’s credentials to be handed to an identified person specifically appointed to transmit the data, and the Questura of Sassari recognises applications from property managers. The obligation itself stays with whoever gives the accommodation.

Does this apply to Airbnb and Booking.com bookings?
Yes. The duty follows the person giving the accommodation, not the booking channel, and lets of under thirty days are expressly covered.

Where this leaves you

The headline that circulated for a year — keyboxes banned, self check-in over — was never what the documents said. The real rule is narrower and more demanding at the same time: somebody has to look at your guest, at the moment they arrive, and match that face to a document. How they look, and from where, is more open than most of the coverage suggests.

Own a property in north-east Sardinia? AirAffitti can help you organise and run the operational side: listings, guest communication, pricing, check-in coordination, access coordination, cleaning between stays and the day-to-day management of apartments and rooms in Olbia, Porto Rotondo and along the coast. What our management covers sets out what is included.

What we are not is a law firm or a tax practice. Nothing on this page is legal advice, and no procedure described here is certified or approved by any authority. For your own position the official sources linked above, and a qualified Italian lawyer, are the right places to go.

AirAffitti editorial team