Key points
- In the US, private LTE or 5G usually runs on CBRS (Citizens Broadband Radio Service), a shared band at 3550–3700 MHz[3]. Every CBRS radio must be registered with and authorized by a coordination service called the SAS (Spectrum Access System)[4]. Wi-Fi needs no license or registration, but it gets no protection from interference[1].
- Devices are the biggest practical gap. Wi-Fi devices number in the tens of billions[2]. A CBRS device needs LTE Band 48 or 5G band n48, plus a SIM card or eSIM from your network.
- Outdoors, CBRS rules allow much higher power than Wi-Fi rules, for radios that are professionally installed[5][4][6]. But power limits are not coverage: a site survey decides how many radios each option needs.
- For moving devices, the two work differently. In LTE and 5G, the network decides when a device switches to the next radio[7]. In Wi-Fi, the device decides, with optional help from the network[8].
- Both can be well secured. Cellular checks a SIM whose key stays in tamper-resistant hardware[9]. Enterprise Wi-Fi uses WPA3-Enterprise, which checks each device against a server[10]. The practical difference is how you issue and manage credentials.
What is the difference, in plain terms?
In practice, the two differ most in which devices work, how the radios are licensed, and how moving devices are handled. Private LTE or 5G means your own cellular network. It has its own radios and core software (the system that runs the network). Only your devices hold its SIM cards or eSIMs. An eSIM is a digital SIM built into the device.
The table compares the two on the points that usually decide a project. It describes rules and standards, not the performance of any product. Real results depend on design and devices.
| Item | Private LTE or 5G on CBRS | Wi-Fi |
|---|---|---|
| Which devices work | Devices with LTE Band 48 or 5G band n48 and a SIM card or eSIM for your network; some current phones list both bands[11] | A far larger base: 38 billion Wi-Fi devices shipped by 2022[2] |
| License and registration | The free tier (General Authorized Access) is licensed by rule, with no individual license[3]. Every radio registers with a SAS and must be authorized before it transmits[4] | No license or registration[1] |
| Protection from interference | Available with a Priority Access License; free-tier users have no protection from each other[3] | None: devices must accept interference from other users[1] |
| Outdoor radio power | Much higher for professionally installed outdoor radios (Category B)[5][4] | Lower for an access point that serves many devices (our comparison of the rules)[6][12] |
| Who decides when a moving device switches radios | The network[7] | The device, with optional help from the network[8] |
| How a device proves who it is | A SIM card or eSIM; the secret key stays in tamper-resistant hardware[9] | A password (WPA3-Personal), or a check of each device against a server (WPA3-Enterprise)[10] |
| Priority for important traffic | Can guarantee a data rate for chosen traffic[13] | Four priority levels: voice, video, best effort and background[14] |
| Coordination fees | SAS administrators may charge a reasonable fee[4] | Only for 6 GHz standard-power access points, which must use an AFC (Automated Frequency Coordination) system; fees allowed[6] |
Which should you choose, and when should you use both?
Wi-Fi is usually the right first choice when:
- most users bring laptops, phones or tablets that you don't control;
- guests need access;
- the space is mostly indoors;
- you want the widest channels for the highest peak speeds: up to 320 MHz in the 6 GHz band[6].
Private LTE or 5G is worth considering when:
- you need to cover large outdoor or mixed indoor-outdoor areas, where higher-power outdoor radios help[5];
- devices keep moving, and you want the network to manage handover, the switch from one radio to the next[7];
- you own the devices and can issue them SIM cards or eSIMs[9];
- applications need a guaranteed data rate[13].
Typical settings include warehouses, ports and terminals, yards and remote and utility sites.
One way to divide the work is Wi-Fi for people indoors and private cellular for outdoor areas, vehicles and fixed equipment. Both can sit behind the same firewalls and identity systems.
The two can also work together. The 5G core is designed to accept devices over Wi-Fi as well as over cellular radios[13]. Devices can also use their SIM to log in to Wi-Fi[15]. Some vendors sell the two together. Celona, for example, includes up to four Wi-Fi 7 access points in each private 5G subscription[16].
Will my phones, laptops and other devices work?
Devices are the biggest practical difference. Wi-Fi has by far the larger device base. The Wi-Fi Alliance counts 38 billion Wi-Fi devices shipped by 2022 and 80,000 Wi-Fi CERTIFIED products by 2023[2].
For private LTE or 5G on CBRS, a device needs LTE Band 48 or 5G band n48. Some mainstream devices have both. Apple lists both bands, plus Wi-Fi 7, for the US iPhone 17 (model A3258)[11]. Zebra lists both for its TC58 rugged handheld[15]. Our CBRS device guide lists more phones, routers and modules.
Band support is necessary but not enough. The device also needs a SIM card or eSIM whose credentials your core software recognizes[9]. So test each model on your network before you buy in volume.
As of August 2025, the Wireless Innovation Forum counted about 432,500 deployed CBRS radios[17]. It also counted more than 350 radio models approved by the FCC (Federal Communications Commission)[17]. Those are network radios, not phones or sensors.
Equipment without CBRS support, such as fixed cameras or controllers, can connect through a CBRS gateway. A gateway is a router that links wired equipment to the cellular network. Ericsson's Cradlepoint R1900, for example, supports CBRS private networks[18]. It has four Gigabit Ethernet ports and Wi-Fi 6[18]. The equipment directory lists gateways, handhelds and other devices with their supported bands.
What do you pay for with each?
There is no reliable general answer to which costs more. The number of radios for each option comes from a site design. What differs is the list of things you pay for. Our cost guide gives public prices for the private cellular items.
| Cost driver | Wi-Fi | Private LTE or 5G on CBRS |
|---|---|---|
| Spectrum | None[1]. | None for the free General Authorized Access tier; auction or lease for a Priority Access License[3]. |
| Coordination service | Only for 6 GHz standard-power access points, which use an AFC system; fees allowed[6]. | SAS registration for every radio; fees allowed[4]. |
| Installation rules | 6 GHz low-power access points must be indoors[6]. | Higher-power Category B radios must be outdoors and professionally installed[4]. |
| Network equipment and software | Access points plus management, and an authentication server for WPA3-Enterprise[10]. | Radios plus core software (the Evolved Packet Core for LTE or the 5G Core for 5G) and SIM card or eSIM management[13][9]. |
| Devices | Large existing base: 38 billion devices shipped by 2022[2]. | Need Band 48 or n48 and a SIM card or eSIM from your network, or a gateway[11][18]. |
| Number of radios | From a site survey. | From a site survey. |
Which covers more area: private 5G or Wi-Fi?
Outdoors, CBRS rules allow much more power than Wi-Fi rules, but only for professionally installed outdoor radios[5][6]. Power limits are given in dBm, a unit of power. Many are stated as EIRP (effective isotropic radiated power), which includes the boost from the antenna.
The higher-power CBRS radios are called Category B. They may transmit up to 47 dBm EIRP per 10 MHz, but only outdoors and professionally installed[5][4]. That is more than Wi-Fi rules allow an access point that serves many devices[6][12].
Indoors, the limits are closer. A lower-power CBRS radio (Category A) and a 6 GHz low-power indoor Wi-Fi access point have the same cap: 30 dBm EIRP[5][6]. But the Wi-Fi rule's limit per MHz of channel is much lower than the CBRS rule's[5][6]. So the Wi-Fi access point reaches its cap only on its widest channels, up to 320 MHz[6]. Both comparisons are ours, drawn from the rules.
CBRS (EIRP per 10 MHz)
Wi-Fi, 6 GHz (EIRP)
A Category A radio and a 6 GHz low-power indoor access point share the same 30 dBm EIRP cap.
Per MHz: Category B 37 dBm, Category A 20 dBm, 6 GHz standard-power access point 23 dBm, low-power indoor access point 5 dBm, and its clients −1 dBm.
CBRS EIRP limits are per 10 MHz; the 6 GHz Wi-Fi EIRP limits are totals. Wi-Fi limits at 2.4 and 5 GHz are set as conducted power, so they are not shown.
Power limits are not coverage. Range also depends on frequency, antenna height and pattern, walls and racking, and interference. It also depends on how much power the device can send back. A site survey decides how many radios each option needs. We do not estimate radio counts from floor area. The project planner sizes your traffic, which applies to either technology.
Which handles moving devices better?
Handover is the moment a moving device switches from one radio to the next. Neither technology guarantees a clean handover; both depend on design and devices. So if vehicles, robots or handhelds move across a yard or campus, test with the exact devices you will deploy.
The two split the decision differently. In LTE and 5G, the network decides[7]. The device reports what it measures, and the radio serving it decides to hand it over. That radio asks the next radio to accept the device, then tells the device to switch[7]. Whoever runs the network tunes this behavior centrally.
LTE or 5G
- Report. The device reports signal measurements to its serving base station, A.
- Decide and prepare. Base station A decides to hand the device over and asks base station B to admit it.
- Command. Base station A tells the device to switch to B.
- Continue on B. The device carries on through base station B. The operator tunes this behavior centrally.
Wi-Fi
- Neighbor report (802.11k). Optionally, the network shares information about nearby access points.
- Suggestion (802.11v). Optionally, the network suggests a better access point, band or channel.
- The client decides. The device itself chooses when to leave access point A.
- Fast re-authentication (802.11r). Optionally, the device re-authenticates quickly with B. Results depend on each client's roaming support.
In Wi-Fi, the device chooses when to leave one access point for the next. Wi-Fi calls this roaming. The Wi-Fi Alliance's Agile Multiband program certifies features that let the network help[8]. The network can share a list of nearby access points and suggest a better access point, band or channel[8]. A third feature lets the device log in again quickly after it moves; it is optional in that program[8].
With Wi-Fi, results depend on how each device handles roaming and which features it supports. With cellular, they depend on how the network's handover settings are configured. See yard and vehicle automation for related deployments.
Is private LTE or 5G more secure than Wi-Fi?
Both can be secured to a high standard. They differ in how a device proves who it is, and in how you issue and manage those credentials.
In private LTE or 5G, each device proves its identity with its SIM card or eSIM[9]. In 5G, the device and the network check each other[9]. The secret key must stay in tamper-resistant hardware and never leave it unprotected[9]. 5G also hides the permanent subscriber identity over the air, using a one-time concealed form[9]. The National Institute of Standards and Technology (NIST) notes a limit[19]. LTE's authentication proves the SIM card to the network, not the user or the device the SIM sits in[19].
On Wi-Fi, WPA3 (Wi-Fi Protected Access 3) is mandatory for Wi-Fi CERTIFIED devices[20]. WPA3-Personal uses a password, with a key exchange designed to resist password guessing[10]. WPA3-Enterprise checks each device against an authentication server[10]. The device must also check the server's certificate[10].
Some devices support both. Zebra's TC58 handheld supports WPA3-Enterprise and, on its cellular models, can use its SIM to log in to Wi-Fi[15]. CBRS also adds one rule that Wi-Fi lacks. Links between radios and the SAS must be secured, and a SAS must refuse service to uncertified radios[4].
In either technology, much of the security depends on how you run the network. Decide who issues and revokes credentials, how to handle lost devices, and how to separate traffic once a device is on the network.
How do CBRS spectrum rules compare with unlicensed Wi-Fi bands?
Wi-Fi needs no paperwork, but it gets no protection. Wi-Fi equipment runs under Part 15 of the FCC's rules, and nobody registers an access point[1]. Part 15 devices must not cause harmful interference, and they must accept interference from other devices[1]. So anyone can set up Wi-Fi, and a neighbor's network can share your channels.
CBRS shares its spectrum among three tiers of users[3]. Automated coordinators, the Spectrum Access Systems, run the sharing[3]:
- Federal incumbents, including Department of Defense radar, are protected from everyone[3].
- Priority Access licensees are protected from General Authorized Access users[3]. Priority Access Licenses (PALs) are sold by auction or leased[3].
- General Authorized Access (GAA) users are licensed by rule, with no individual license[3]. They must accept interference from both higher tiers and have no protection from one another[3].
In return, a SAS assigns channels and power to every registered radio[4]. A radio must change frequency, reduce power or stop transmitting within 60 seconds when its SAS tells it to[4]. So a GAA network can lose or change channels when incumbents are active nearby. The CBRS map and our guide to SAS and Dynamic Protection Areas explain how to plan for this.
Wi-Fi is not entirely uncoordinated either. In the 6 GHz band, standard-power access points and fixed client devices must check an AFC system first[6]. It tells them which channels and power they may use at their location[6]. Low-power indoor access points need no such check, but they must stay indoors[6]. Both kinds of coordinator may charge fees under FCC rules[4][6].
For engineers: standards, power limits and protocols
The first table sets out the standards and rules behind this guide. Like the plain table above, it describes rules, not the performance of any product.
| Factor | Private LTE or 5G on CBRS | Wi-Fi |
|---|---|---|
| Standards | 3GPP (3rd Generation Partnership Project) LTE and 5G New Radio (NR). CBRS is 5G band n48, 3550–3700 MHz, time-division duplex[21]. | IEEE 802.11, currently the 802.11-2024 revision[22]. The Wi-Fi Alliance certifies interoperability: Wi-Fi 6 from 2019, 6E from 2020 and Wi-Fi 7 from 2024[2]. |
| Spectrum | 150 MHz at 3550–3700 MHz, shared in three tiers: incumbents, Priority Access and General Authorized Access (GAA)[3]. | Unlicensed bands at 2400–2483.5 MHz[12], several 5 GHz bands between 5150 and 5895 MHz, and 5925–7125 MHz[6]. |
| Licensing and registration | GAA is licensed by rule; Priority Access Licenses (PALs) are sold by auction or leased[3]. Every radio registers with a SAS and must be authorized before transmitting[4]. | No license or registration. 6 GHz standard-power access points must get available channels and power from an AFC system before transmitting[6]. |
| Interference protection | Incumbents are protected from everyone, PALs from GAA users; GAA users have no protection from each other[3]. | None. Part 15 devices must accept interference from other users[1]. |
| Maximum radio power (EIRP) | Category A: 30 dBm per 10 MHz. Category B: 47 dBm per 10 MHz, outdoors only and professionally installed[5][4]. | 6 GHz indoor access point: 30 dBm; 6 GHz standard power: 36 dBm; other bands set by conducted-power limits (see below)[6][12]. |
| Device power | End-user devices: 23 dBm per 10 MHz EIRP[5]. | Example: a client of a 6 GHz indoor access point, 24 dBm EIRP[6]. |
| Mobility | Network-controlled handover; the serving base station initiates it[7]. | The client decides when to roam; 802.11k and 802.11v let the network advise, and 802.11r speeds re-authentication[8]. |
| Authentication | SIM credentials with mutual authentication; the long-term key stays in tamper-resistant hardware[9]. | WPA3-Personal (password-based) or WPA3-Enterprise, which requires server certificate validation and offers an optional 192-bit mode[10]; access control can use IEEE 802.1X[23]. |
| Traffic priority | QoS (quality of service) flows with guaranteed or non-guaranteed bit rates[13]. | WMM (Wi-Fi Multimedia) priority in four access categories: voice, video, best effort and background[14]. |
| Devices | Needs LTE Band 48 or 5G n48 support and a SIM or eSIM for your network; some current phones list both bands[11]. | 38 billion Wi-Fi devices shipped by 2022[2]. |
| Coordination fees | SAS administrators may charge a reasonable fee[4]. | AFC operators may charge fees for 6 GHz standard-power operation[6]. |
The power table lists limits for common configurations, including Wi-Fi's U-NII (Unlicensed National Information Infrastructure) bands at 5 GHz and 6 GHz. EIRP includes antenna gain; conducted power is measured before the antenna.
| Equipment | Frequency | Power limit | Conditions |
|---|---|---|---|
| CBRS Category A radio | 3550–3700 MHz | 30 dBm EIRP per 10 MHz; 20 dBm per MHz[5] | Indoors or outdoors; outdoors, the antenna may be no higher than 6 m above average terrain, or the radio is treated as Category B[4]. |
| CBRS Category B radio | 3550–3700 MHz | 47 dBm EIRP per 10 MHz; 37 dBm per MHz[5] | Outdoors only; professionally installed[4]. |
| CBRS end-user device | 3550–3700 MHz | 23 dBm EIRP per 10 MHz[5] | Transmits only when authorized by its radio[4]. |
| Wi-Fi, 2.4 GHz | 2400–2483.5 MHz | 1 W conducted[12] | Antenna gain above 6 dBi requires a power reduction, with exceptions for point-to-point links[12]. |
| Wi-Fi access point, U-NII-1 | 5150–5250 MHz | 1 W conducted; 17 dBm per MHz[6] | Antenna gain up to 6 dBi without reduction; outdoor units limited to 125 mW EIRP above 30 degrees elevation[6]. |
| Wi-Fi, U-NII-2A and 2C | 5250–5350 and 5470–5725 MHz | Lesser of 250 mW or 11 dBm + 10 log B (B = bandwidth in MHz)[6] | Same 6 dBi antenna rule[6]. |
| Wi-Fi, U-NII-3 | 5725–5850 MHz | 1 W conducted[6] | Same 6 dBi antenna rule, with exceptions for point-to-point links[6]. |
| Wi-Fi 6 GHz low-power indoor access point | 5925–7125 MHz | 30 dBm EIRP; 5 dBm per MHz[6] | Indoor only; integrated antenna[6]. |
| Wi-Fi 6 GHz standard-power access point | 5925–6425 and 6525–6875 MHz | 36 dBm EIRP; 23 dBm per MHz[6] | Must use an AFC system[6]. |
| Wi-Fi 6 GHz client of an indoor access point | 5925–7125 MHz | 24 dBm EIRP; −1 dBm per MHz[6] | Indoor only[6]. |
Per MHz, the CBRS Category A rule allows 20 dBm, against 5 dBm for a 6 GHz low-power indoor access point[5][6]. That is why the Wi-Fi access point reaches its 30 dBm cap only on its widest channels.
- Wi-Fi roaming features. The Wi-Fi Alliance's Agile Multiband program covers 802.11k, which shares information about nearby access points[8]. It also covers 802.11v, which lets the network suggest a better access point, band or channel[8]. 802.11r (Fast Basic Service Set Transition) lets a client re-authenticate quickly when it roams[8]. Fast transition is optional in that program[8].
- Cellular security. In 5G, a subscription's credentials live in the USIM (the SIM application) and the operator's network[9]. They are used to mutually authenticate device and core[9]. The concealed, one-time form of the permanent subscriber identity is the SUCI (Subscription Concealed Identifier)[9]. NIST notes that LTE's equivalent procedure, AKA (Authentication and Key Agreement), authenticates the SIM card to the network[19].
- Wi-Fi security. Protected management frames are required on new Wi-Fi CERTIFIED devices[20]. WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a password-based key exchange[10]. WPA3-Enterprise keeps the protocols of WPA2-Enterprise but enforces protected management frames[10]. It also offers an optional 192-bit security mode[10]. IEEE 802.1X lets administrators restrict IEEE 802 network ports to authenticated and authorized devices[23]. IEEE 802 is a family of standards that includes Wi-Fi[22].
- SIM-based Wi-Fi login. Zebra's TC58 lists WPA3-Enterprise with Extensible Authentication Protocol (EAP) methods such as EAP-TLS[15]. On its cellular models, it also lists SIM-based EAP-SIM and EAP-AKA for Wi-Fi[15].
- Wi-Fi and the 5G core. The 5G core accepts devices over untrusted Wi-Fi through an interworking function, and over trusted Wi-Fi through a gateway function[13]. Wi-Fi Agile Multiband optionally lets access points and devices exchange information about co-located cellular networks[8].
Common questions
Is private 5G better than Wi-Fi 6 or Wi-Fi 7?
Neither is better everywhere. Wi-Fi 6E and Wi-Fi 7 add the 6 GHz band, where FCC rules allow channels as wide as 320 MHz[6]. CBRS allows much higher outdoor power for professionally installed Category B radios[5]. Private LTE and 5G also have network-controlled handover[7]. Choose by area, how much devices move, and who owns the devices.
Is private LTE more secure than Wi-Fi?
Both can be secured well. Private LTE and 5G use SIM credentials whose keys stay in tamper-resistant hardware[9]. In 5G, device and network also check each other, and the subscriber identity is concealed over the air[9]. Enterprise Wi-Fi uses WPA3-Enterprise, which protects management messages and checks the server's certificate[10]. NIST notes that cellular authentication proves the SIM, not the user or device[19]. So device and user controls still matter.
Can private LTE or 5G replace Wi-Fi?
For a fleet of company-owned devices that support Band 48 or n48, a private cellular network can carry all their traffic. Visitors' phones and laptops will not have credentials for your network. Many devices also lack Band 48 or n48 support, so keeping Wi-Fi for them is usually simpler. The 5G core can also serve devices over Wi-Fi, so the two can share one core[13].
Do regular phones work on a private CBRS network?
Only if they support LTE Band 48 or 5G n48 and accept a SIM card or eSIM for your network. Apple, for example, lists both bands for the US iPhone 17[11]. Test each model before you buy at scale. Band support alone does not guarantee that a phone will connect.
Is CBRS licensed or unlicensed spectrum?
Neither, in the usual sense. The General Authorized Access tier is licensed by rule, with SAS coordination and no individual license[3]. The Priority Access tier uses county licenses sold at auction[3]. Wi-Fi bands are unlicensed under Part 15, with no registration and no protection from interference[1].
Next in the reading path
Sources
- 47 CFR 15.5: General conditions of operation — Electronic Code of Federal Regulations (eCFR), Sep 30, 2026. Accessed Oct 1, 2026.
- Who We Are — Wi-Fi Alliance. Accessed Oct 1, 2026.
- 3.5 GHz Band Overview — Federal Communications Commission, Apr 3, 2023. Accessed Oct 1, 2026.
- 47 CFR Part 96: Citizens Broadband Radio Service — Electronic Code of Federal Regulations (eCFR), Sep 30, 2026. Accessed Oct 1, 2026.
- 47 CFR 96.41: General radio requirements — Electronic Code of Federal Regulations (eCFR), Sep 30, 2026. Accessed Oct 1, 2026.
- 47 CFR 15.407: General technical requirements (U-NII devices) — Electronic Code of Federal Regulations (eCFR), Sep 30, 2026. Accessed Oct 1, 2026.
- ETSI TS 138 300 V18.7.0 (3GPP TS 38.300 Release 18): NR and NG-RAN Overall description; Stage-2 — ETSI / 3GPP. Accessed Oct 1, 2026.
- Wi-Fi CERTIFIED Agile Multiband Technology Overview — Wi-Fi Alliance. Accessed Oct 1, 2026.
- ETSI TS 133 501 V18.9.0 (3GPP TS 33.501 Release 18): Security architecture and procedures for 5G System — ETSI / 3GPP. Accessed Oct 1, 2026.
- Wi-Fi CERTIFIED WPA3 Technology Overview — Wi-Fi Alliance. Accessed Oct 1, 2026.
- iPhone 17 - Technical Specifications — Apple. Accessed Oct 1, 2026.
- 47 CFR 15.247: Operation within the bands 902–928 MHz, 2400–2483.5 MHz, and 5725–5850 MHz — Electronic Code of Federal Regulations (eCFR), Sep 30, 2026. Accessed Oct 1, 2026.
- ETSI TS 123 501 V18.9.0 (3GPP TS 23.501 Release 18): System architecture for the 5G System (5GS) — ETSI / 3GPP. Accessed Oct 1, 2026.
- Wi-Fi CERTIFIED WMM programs — Wi-Fi Alliance. Accessed Oct 1, 2026.
- TC53/TC58 Mobile Computers Spec Sheet — Zebra Technologies, Mar 5, 2025. Accessed Oct 1, 2026.
- Celona Orion Pricing — Celona. Accessed Oct 1, 2026.
- Inside the CBRS Ecosystem — Wireless Innovation Forum. Accessed Oct 1, 2026.
- Ericsson Cradlepoint R1900 — Ericsson. Accessed Oct 1, 2026.
- NIST SP 800-187: Guide to LTE Security — National Institute of Standards and Technology. Accessed Oct 1, 2026.
- Security — Wi-Fi Alliance. Accessed Oct 1, 2026.
- ETSI TS 138 101-1 V18.9.0 (3GPP TS 38.101-1 Release 18): NR; User Equipment (UE) radio transmission and reception; Part 1: Range 1 Standalone — ETSI / 3GPP. Accessed Oct 1, 2026.
- IEEE 802.11-2024: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications — IEEE Standards Association, Apr 28, 2025. Accessed Oct 1, 2026.
- IEEE 802.1X-2020: Port-Based Network Access Control — IEEE Standards Association, Feb 28, 2020. Accessed Oct 1, 2026.
