I'm assuming that you're referring to a captive portal type HotSpot.
Usually, it's MAC based. The MAC is placed in database and marked as being valid or expired depending on the time allowed and (if required) validated payment, etc.
Here's a good explanation:
How Wi-Fi hotspots force you to log in - Network World