Library Wifi Filtering and Patron Devices
Patrons now bring more devices than the library owns. Phones, laptops, tablets and gaming handhelds all join the public wifi, and many libraries lend laptops and tablets too.
This guide explains when CIPA reaches the wifi, which filtering method suits devices you do not control, how to design the networks, and how adults get unfiltered access on their own devices.
Is library wifi in scope for CIPA?
CIPA follows the funding. If E-Rate discounts pay for the internet access or the internal network your wifi uses, most advisers treat the wifi like any other library connection. Here is how common setups usually look.
Wifi on the E-Rate funded connection
Public and staff wifi running over discounted internet access or discounted access points and switches.
Outdoor and parking lot coverage
The same network reaching outside the building, including after hours.
Separately funded network
A wifi network on a connection the library pays for entirely without E-Rate. State law may still apply.
Patron mobile data
Phones on their own cellular plans never touch the library network, so no library filter applies.
Even where wifi is technically outside CIPA, many libraries filter it the same way so the rules are consistent across the building. For the policy side, see our public library internet filtering policy guide and the library-specific E-Rate for public libraries guide.
Filter the wifi, not the phone
The filter lives at DNS, so any device that joins the library wifi follows the rules. Nothing is installed on computers or patron phones.
- One DNS setting on the router or firewall.
- CIPA preset covers Adult and VPN/Proxy/Anonymizers.
- Branch settings stay separate in one console.
Which filtering method works for devices you do not own
On library PCs you control the software. On patron devices you control only the network. That narrows the choice to methods that work without touching the device, and for most libraries that means filtering at the DNS level.
DNS filtering
Every device asks the network where a website lives before loading it. A DNS filter answers those lookups and refuses blocked categories.
Firewall web filtering
A firewall checks traffic by domain or address. Deeper page-level checks need decryption, which needs a trusted certificate on each device.
Device software
Filtering apps or management profiles installed on the device. Works on and off the network.
For a deeper comparison, read web filtering vs DNS filtering. The school-oriented page on SSL inspection explains why decryption fits managed devices but not guest devices.
Designing library networks for filtering
Separate networks let you apply the right rules to each group without complex per-device settings. Most libraries need three or four, and the same pattern works whether you run one building or twenty branches.
| Network | Who uses it | Filtering profile | Notes |
|---|---|---|---|
| Public wifi | Patrons' own devices | CIPA preset, proxy and VPN tools blocked, safe search forced | Splash page explains the filter and how adults ask for access |
| Public PCs | Library computers in adult areas | CIPA preset with staff PIN bypass for adults | Kept apart from wifi so bypass does not spill over |
| Children's area | Children's PCs, tablets, stations | Stricter profile set by the board | Can be a separate network or a device group |
| Staff | Library-owned staff devices | CIPA preset, staff can bypass for their own lawful work | Not broadcast to the public, strong password |
| Building systems | Printers, cameras, door controls | Allow only what each system needs | Security network, never shared with patrons |
A hosted DNS filter that supports one profile per network address or per site makes this simple. Our hosted CIPA filter for libraries gives each branch its own category settings, allow list, block list and staff PIN from one dashboard.
Everyday sites on library networks
Patrons bring a wide mix to the network. This is how our data files typical ones.
| Site | Categories |
|---|---|
| facebook.com | Social Networking |
| spotify.com | Podcasts, Streaming Media |
| whatsapp.com | Email and Messaging, Social Networking |
| zoom.us | Webinars/E-learning, Web-based Applications, Business |
| tiktok.com | Social Networking, Streaming Media |
| amazon.com | Shopping, Marketplaces / Classifieds / Auctions |
The splash page: your best explanation tool
The page patrons see when they join the wifi is where expectations are set. Keep it short, readable on a phone and consistent with your signs and your block page.
Welcome to Library Wifi
This network is filtered under the library's internet policy, as required for our federal funding.
If a site you need is blocked, ask at any service desk. Adults can ask staff for unfiltered access for research or other lawful use.
On some sites a blocked page shows a security warning instead of a message. That means the site is filtered, not that your device is unsafe.
By connecting you agree to the library's computer use rules.
ConnectWrite for a small screen
Four short sentences beat a full policy. Link to the full policy for anyone who wants it.
Explain the warning screen
Patrons who see a browser certificate warning think something is broken. One sentence on the splash page prevents many desk visits.
Say how to ask
Name the desk, a phone number or a short form. Adults should know the bypass exists before they need it.
Avoid unnecessary sign-in data
If you require a login, collect as little as you can. A card number tied to browsing undermines patron privacy.
Offer your main languages
Translate the splash page into the languages your community uses most.
Adult unblocking on wifi and patron devices
CIPA lets authorized staff disable the filter for adults. On a library PC that is a PIN at the desk. On a patron's own phone it takes a little more planning. Three routes work.
Single-site unblock
The patron names the site, staff open it for the branch or the network for a set time.
- Fast and easy to explain
- Opens the site for others on that network too, so time-limit it
Use a library PC instead
Offer an adult computer with the timed staff bypass. Simple, and keeps the wifi consistent.
- No change to network settings
- Less convenient for patrons with their own files
Separate adult network
Some libraries run an adult network behind a staff-issued code that carries the CIPA minimum only.
- Good for high request volume
- Confirm the design with your E-Rate adviser first
What a network filter does not do
It decides which websites load. It does not read messages, record keystrokes or watch what anyone does on their device. If staff have a concern about a person's safety, follow the library's safety procedure rather than looking to the filter.
Whatever route you choose, keep proxy and VPN blocking on, never ask the topic, and record only that the bypass happened. Our guide to CIPA adult unblocking in libraries covers the legal background and desk procedure.
Library-owned versus patron-owned devices
The line between the two decides what you can enforce. Be clear about it in your policy and with staff, so nobody promises patrons or parents more than the network can deliver.
Library-owned devices
Lending laptops and tablets can carry a device-level filter link or management profile, so the same rules apply at home.
Lock browser and network settings so patrons cannot remove the filter or switch to an encrypted DNS service.
Reset devices between loans to remove accounts, files and history.
Include filtering in the lending agreement so borrowers know what to expect.
Patron-owned devices
Filtered only while on library wifi. The library cannot and should not install anything on them.
On mobile data they are outside library control. Say so honestly in your policy and signs.
Do not require patrons to install certificates or apps to use the wifi.
Conduct rules still apply in the building, whatever network a device uses.
Hotspot lending: the FCC added hotspot lending to E-Rate in 2024 and voted to remove it in September 2025. Libraries continuing such programs with other funds should check which filtering conditions, if any, apply to that money. Schools facing the same questions can read BYOD filtering in schools.
Closing the common routes for library wifi
VPN/Proxy stays blocked even with the staff PIN. Public encrypted DNS and browser settings that skip the filter are blocked by default.
Common bypass routes and how libraries close them
Patron devices come with their own privacy features, and some of them skip the network filter. Here is how each is usually handled.
Encrypted DNS built into browsers and phones
Browsers and operating systems can send lookups to a public encrypted DNS service instead of the network's. Filters handle this by blocking known public encrypted DNS endpoints, which makes devices fall back to the network's DNS. Our hosted filter blocks these by default.
VPN apps and proxy sites
Block the VPN / Proxy / Anonymizers category in every profile, and keep it blocked during adult bypass. See stopping proxy and VPN bypass for the techniques.
Private relay features
Some phone features route browsing through a relay. Networks can signal that relay is not available, and many devices then fall back to normal routing. Test with the devices your patrons use.
Hard-coded DNS servers
A device set to use an outside DNS server can skip a filter that relies on the router's settings. Redirect or block outbound DNS to anything other than your filter at the firewall.
Switching to mobile data
Nothing on the library network can affect this. Policy and conduct rules are the only tools, and honesty about the limit builds trust.
Troubleshooting what patrons report
Most wifi filtering complaints fall into a handful of patterns. A short table at the desk saves time for staff and patrons.
| Patron says | Likely cause | What staff do |
|---|---|---|
| "My browser says the connection is not private" | A blocked site on HTTPS, shown as a certificate warning | Check the domain's category; explain, unblock or offer review |
| "The app won't load but the website does" | The app uses an extra domain in a blocked category | Note the app name; IT reviews the domains it needs |
| "It worked yesterday" | A category or list change, or the site moved to a new domain | Look up the domain; report to IT if a recent change caused it |
| "I can't get on the wifi at all" | Splash page not shown, or device has a stored setting | Forget and rejoin the network; open any plain web address |
| "The site opened after a minute" | The device held an old answer after an unblock | Normal; ask the patron to wait briefly and reload |
Look up any reported domain with the website category checker before changing settings. The library staff guide to filter requests has scripts for these conversations.
Rolling out filtered wifi without surprises
Changing the filter on a busy public network affects hundreds of devices at once. A staged rollout keeps the first complaints small and fixable.
Week 1: test quietly
Point one staff device at the filter. Try the sites patrons use most: job boards, benefits portals, health sites, email, homework platforms and streaming.
- List anything wrongly blocked
- Add allow list entries before launch
Week 2: one branch
Switch the public wifi at one branch, ideally on a quieter day. Brief desk staff first, and give them the troubleshooting table.
- Note every patron question
- Adjust the splash page wording
Week 3 onward: all branches
Roll out branch by branch. Review blocked sites weekly for the first month, then monthly.
- Report results to the director
- Keep a settings export for your files
Fair use is a separate setting
Bandwidth limits per device and session timeouts manage congestion. Keep them apart from content rules so staff can explain each one.
Blocking whole streaming categories to save bandwidth also blocks lawful viewing. Rate limits are usually the fairer tool.
Privacy of wifi records
Set a short retention period for lookup logs, agreed with counsel under your state library records law.
Avoid linking device addresses to library card numbers. Aggregate reports are enough to show the filter works.
Library wifi filtering checklist
Walk through this with your IT lead or network vendor once a year, and after any network change. Keep the signed-off list with your CIPA records so a reviewer can see the wifi was checked, not assumed.
Patron wifi methods
Options for devices you do not own
| Question | Software on each device | DNS filter on the wifi |
|---|---|---|
| Patron phones | Not possible | Covered by the network |
| Setup | Per device | A DNS setting |
| Adult requests | Complex | Logged staff PIN |
| Bypass | Possible | Skip settings blocked by default |
| Evidence | Scattered | Reports and log export |
Library wifi and patron device filtering FAQ
Does CIPA apply to library wifi?
If the wifi runs over internet access or internal connections that receive E-Rate discounts, most advisers treat it as in scope and filter it like the public computers. Confirm your situation with your E-Rate adviser or state library agency.
Can a library filter patrons' own phones and laptops?
Yes, while they use the library's wifi. A network-level filter, such as a DNS filter, applies to every device on the network without installing anything. When patrons switch to mobile data, the library filter no longer applies.
How do adults get unfiltered access on wifi?
Options include a timed staff bypass for the device, single-site unblocks on request, or a separate adult network behind a login. Pick an approach your adviser is comfortable with and make it easy to request.
Why do patrons see a security warning instead of a block page?
On encrypted sites, a DNS filter cannot show its own page without a certificate the device trusts, so the browser shows a connection warning. Explain this on your splash page and signs so patrons know it means the site is blocked.
Do we need to filter wifi after hours in the parking lot?
If the signal comes from the same funded network, treat it the same way. Filtering applies to the network, not the opening hours.
Does E-Rate still pay for lending hotspots?
No. The FCC voted in September 2025 to end E-Rate support for hotspot lending. Libraries that keep lending programs fund them in other ways and should check which filtering rules apply to that funding.
Should we log devices on our wifi?
Log only what you need to run and secure the network. CIPA does not require tracking internet use, and library privacy norms favour short retention and no link between devices and named patrons.
Can we block only some apps on patron phones?
A network filter can block the domains an app uses, which usually stops it working on library wifi. It cannot remove or control apps on the phone itself.
Do gaming consoles and handhelds on our wifi get filtered too?
Yes. Any device that uses the network's DNS gets the same category rules. Game downloads and multiplayer services may need allow list entries if your policy permits gaming.
Related guides
- School Guest Wi-Fi Filtering: Policies, CIPA and Setup
- Public Library Internet Filtering Policy (Template and Guide)
- Children's Area Internet Filtering in Libraries: Zones and Settings
- E-Rate for Public Libraries: Discounts, CIPA, Forms 486 and 479
- Library Internet Filtering: CIPA Compliance for Public Libraries
- School Bus Wifi and Hotspot Filtering After the E-Rate Change
We price by branches and devices, and you hear back with a number within one business day. Start with one site, and see the blocks and the reports before you decide.
Filter every device on your wifi without touching it
Our hosted DNS filter covers public PCs, staff laptops and patron devices on your networks with one router setting, with a staff PIN for adult access. Tell us about your branches.
Talk to us about your library See the hosted filterMore for library teams: web filtering for libraries and CIPA DNS filtering.