What is a MAC address, and what does it give away about you?

The bins went in before the 2012 Olympics. They had to be bomb-proof, which made them expensive, so the company behind them, Renew, paid for them with advertising screens built into the sides. A year later, in the summer of 2013, a dozen of them in the City of London picked up a new job. Small sensors inside logged the MAC address of every phone that walked past with Wi-Fi switched on. Most of the bins stood along Cheapside, a shopping street a few minutes from St Paul’s Cathedral.

The numbers were not small. On 6 July, the busiest day, the bins picked up 106,629 devices and logged them 946,016 times. Over the first month, Renew said, more than a million distinct devices passed by. The sensor supplier, Presence Orb, pitched it as “a cookie for the real world”. Renew’s chief executive, Kaveh Memari, told Quartz that 80 per cent of Londoners left Wi-Fi on when they went out, and that missing someone was only a matter of time. “We just need you to have it on once.”

Quartz published on 8 August. Four days later the City of London Corporation told Renew to stop, and the trial ended. The idea behind it did not.

This piece explains what a MAC address is, why phones used to shout theirs at every passing receiver, and who took advantage of that. Then it looks at the fix the industry came up with, randomized addresses on iPhone, Android and Windows, and at the researchers who found ways around it. The last part is practical: what to switch on, what to clear out, and where the protection stops.

What is a MAC address?

Every device on a network needs an identifier so that data ends up at the right place. Inside your home network, between your phone and the router in the hallway, that identifier is the MAC address. It has nothing to do with Apple’s Mac. MAC stands for Media Access Control, and your iPhone has one just like your Android TV, your printer and your games console. Many devices carry several, one each for Wi-Fi, wired Ethernet and Bluetooth.

A MAC address is 48 bits, written as twelve hexadecimal characters, usually in six pairs: 3C:22:FB:1A:2B:3C. The first three pairs are called the OUI, the Organizationally Unique Identifier. The IEEE, the engineering body that runs the registry, hands these blocks to manufacturers, and the full list is public and free to download. That is why “MAC address lookup” is such a common search: paste in the first half of a fixed address and you get the company that made the device or its radio chip. Anyone counting strangers’ phones gets the brand for free.

The last three pairs are chosen by the manufacturer, a different combination for every unit. Put together, the address is meant to be unique worldwide and, unless something changes it, it stays the same for the life of the device. Networks like that. Privacy does not, for the same reason a licence plate is a problem: see it twice, and you know it was the same car.

MAC address vs IP address vs BSSID

People mix up the MAC address and the IP address all the time. Your IP address is where your connection lives on the internet. Every website you open sees it, and from it you can roughly guess a region and a provider. We tested how rough that guess really is in our piece on how to trace an IP address. Your phone’s MAC address, on the other hand, normally never reaches a server on the internet. It stops at your router, which forwards traffic under its own identifiers.

The third identifier is the BSSID, which is simply the MAC address of your router’s Wi-Fi radio. Your router sits in one place, so Apple and Google can pin its BSSID to a location in their positioning databases. That story is told in our article on the BSSID. This one is about the device in your pocket, the one that moves.

Why your phone keeps calling out

To join your home Wi-Fi automatically, your phone has to know which networks are around. It does not just listen for routers. It asks. Every so often it sends out probe requests, short radio messages that amount to “is there a network here I know?” Microsoft’s own help page puts it plainly: when a device is not connected to Wi-Fi, it sends a signal to look for nearby networks, and that signal contains the device’s unique physical hardware address.

Probe requests are not encrypted, and listening to them needs no login. You just need to be close by. Older phones also included the names of networks they remembered, a list like “Home”, “Office-Guest”, “Harbour Hotel”. In 2016 a team led by Mathy Vanhoef showed that this list alone could single out a device. Vendors were already moving away from the practice, but the study still found it in the wild.

For retailers, advertisers and transport operators, that made for a free stream of footfall data. Nobody had to install an app or tap “accept”. They just had to leave Wi-Fi on.

Stores also use a different technique, Bluetooth beacons and the apps that listen for them, covered in Bluetooth beacons in stores.

From bins to airports: the documented cases

London was not an outlier. The cases below come with paper trails: a regulator, an operator’s own press release, or leaked documents.

The retail sensor: Nomi Technologies. Nomi put sensors in shops that recorded the MAC addresses of passing phones. According to the US Federal Trade Commission, it collected information on about nine million devices in the first nine months of 2013. Nomi hashed the addresses before storing them. The FTC pointed out that the hash was still unique to each phone and could be followed over time. Stores learned how many people walked past instead of coming in, how long visitors stayed, what kinds of devices they carried, and how many had been to another branch of the chain. Nomi’s privacy policy had promised an opt-out in the shops themselves. There was none, and shoppers were never told they were being tracked. In April 2015 Nomi settled with the FTC. It was the agency’s first case against a retail tracking company.

The Underground: Transport for London. For four weeks at the end of 2016, TfL tested Wi-Fi data collection at 54 Tube stations in zones 1 to 4. By its own account it gathered 509 million pieces of data from 5.6 million devices over roughly 42 million journeys. One finding: passengers travelling between King’s Cross St Pancras and Waterloo took at least 18 different routes. Since July 2019 the collection has been permanent across more than 260 stations. TfL says the data is depersonalised automatically, that it worked with the Information Commissioner’s Office, and that it would put up signs telling passengers. Of all the cases here, this one is the most orderly. It still shows how much can be read from a phone simply looking for networks.

The spy agency: CSEC at the airport. In January 2014 CBC News published a document from the Snowden archive: a 27-slide presentation from May 2012 by Canada’s signals intelligence agency, then called CSEC. It described using two weeks of data from the free Wi-Fi at a major Canadian airport to identify travellers’ devices. According to CBC, the agency could then follow those devices for a week or more as they turned up at other hotspots, in hotels, coffee shops, libraries and at other airports, including in the US. The report does not say exactly how CSEC got the data or which identifiers it used. CSEC denied that anyone’s movements had been “tracked”, putting the word in quotation marks itself.

The fix: MAC address randomization

The industry responded in stages. The first stage only covered the search calls. According to a study by the US Naval Academy, Apple introduced random addresses for probe requests with iOS 8 in 2014, and Android followed with version 6.0. As soon as the phone joined a network, though, it went back to its real hardware address.

The second stage arrived in 2019 and 2020. Google says Android 10 uses a randomized MAC address by default for the connection itself, a different one for each network. Apple followed in autumn 2020 with iOS 14 and called the feature “Private Wi-Fi Address”. The idea is the same on both: the coffee shop sees one address, the hotel another, the office a third. Someone running all three networks sees three different devices.

You can spot a randomized address by one bit that marks it as “locally administered”. In practice, its second character is 2, 6, A or E. If you see anything else there, you are almost certainly looking at the manufacturer’s fixed address. On iPhone and Android, MAC address randomization is on by default in 2026.

The details differ, mostly in how often the address changes.

Android has a quirk worth knowing. Google’s developer documentation says the random address is derived from the network’s name and security type, so if you forget a network and add it back, you get the same random address as before. Whoever runs a network you visit regularly can still recognise you there. That is deliberate, otherwise a hotel would make you sign in again every day. Since Android 11, developer options include a switch for non-persistent randomization, which generates a fresh address under certain conditions, at the latest once it is more than 24 hours old and the phone reconnects.

Apple’s Rotating mode, the default for newly joined open and weakly secured networks since iOS 18, targets the places where strangers are most likely to be listening.

Where randomization broke down

A random MAC address hides one identifier. The device behind it still behaves like itself, and that is where researchers have been digging for a decade.

Fingerprints in the probe. In 2016 Vanhoef and colleagues from KU Leuven and INSA Lyon analysed more than eight million probe requests. Besides the address, each one lists technical details: which Wi-Fi features the device supports, in what order, with which values. Taken together, these form a fingerprint that survives an address change. Combined with a running frame counter that many devices did not reset when they changed address, the researchers could follow up to 50 per cent of devices for at least 20 minutes without ever knowing a real address.

Decoy networks. In the same paper they set up fake access points posing as popular public networks. A phone that remembers such a network tries to join, and back then it did so with its real address. Spoofing just five network names revealed the true MAC address of 17.4 per cent of devices. A separate test abusing Hotspot 2.0, the standard devices use to find partner hotspots automatically, exposed the real address or a predictable field for 5.2 per cent of observed devices. In the lab, Windows and Linux machines sent their real address.

Leaky side fields. A US Naval Academy team led by Jeremy Martin published a study in 2017 based on two years of captures covering about 2.8 million devices. Many devices dropped the disguise somewhere else: they sent the odd frame with their real address, or carried it hidden in a field used for WPS, the push-button router pairing feature, from which it could be computed. With refined fingerprinting, the team defeated randomization on about 96 per cent of Android phones. They also found a flaw in the Wi-Fi chips themselves. If you already knew a device’s real address, you could send it a short control frame addressed to that address, and the chip would answer even while the phone was using a random one. That confirmed the device was nearby, whatever the brand.

Apple’s own bug. In October 2023, iOS 17.1 fixed a flaw tracked as CVE-2023-42846. Researchers Tommy Mysk and Talal Haj Bakry had noticed that iPhones joining a network used the private address as the sender, but included the real one in a multicast message sent to every other device on that network. Mysk said he found it in every version back to iOS 14. A sniffer on the pavement saw nothing. Anyone on the same coffee-shop Wi-Fi could read the real address.

Bluetooth. Bluetooth Low Energy also supports rotating random addresses. In 2019 Johannes Becker and colleagues at Boston University showed that many devices broadcast extra identifiers that did not change in step with the address. Watch both, and you can link the old address to the new one. Devices running Windows 10, iOS and macOS were affected at the time. If you are worried about Bluetooth trackers aimed at you, our guide to finding a hidden AirTag covers that side.

What still holds today

Many of these findings are years old, and vendors patched things after they were published. Apple’s multicast leak is closed. How many of the older attacks still work against a phone from 2026 is something nobody can honestly say without fresh measurements. It helps to sort the risk by who is watching.

Against a passive counter like the London bins, which just writes down addresses, a private Wi-Fi address is exactly the right tool. There is no fixed identifier left to recognise over days, and the counter would have to switch to far more involved fingerprinting. This is the case the feature was built for.

Against someone who runs a network you join, it only helps between networks. A hotel that asks for your name and room number knows who you are anyway, and on Fixed it will recognise your device next time. Against a well-resourced adversary analysing fingerprints and signal strength, it raises the cost without ruling anything out. For most people that adversary is not a realistic concern. For journalists, activists or someone who has fled an abusive partner, it can be.

How to find your MAC address

Before changing anything, check what your device is currently using. On iPhone, open Settings, tap Wi-Fi, then the More Info button next to the network you are on. The “Wi-Fi Address” shown there is the address the phone uses on that network. On Android it is in the network details of the connected network, on Windows in the properties of the Wi-Fi connection, and on a Mac under System Settings, Wi-Fi, then Details next to the network.

Now look at the second character. A 2, 6, A or E means a private address is in use. Anything else means your device is using its fixed hardware address on that network. Not a reason to panic, but a reason to look at the setting for that network.

Turning on a private Wi-Fi address

Setting a custom MAC address by hand is overkill for most people. The built-in private address does the same job. Here is where to find it, following each vendor’s own instructions.

iPhone and iPad. Open Settings, tap Wi-Fi, then the More Info button next to the network. On iOS 18 or later, tap Private Wi-Fi Address and choose Off, Fixed or Rotating. For cafés, trains and hotels, Rotating is the better choice. At home Fixed is fine, since your own router knows you anyway. On older versions there is a single Private Wi-Fi Address switch, which should stay on.

Mac. On macOS Sequoia 15 or later, open System Settings from the Apple menu, click Wi-Fi in the sidebar, then Details next to the network. The menu next to Private Wi-Fi Address offers the same three options as the iPhone.

Android. Labels vary by manufacturer. On a Google Pixel, open Settings, tap Network & internet, then Internet, then the gear icon next to the network. Under Privacy you choose between a randomized MAC and the device MAC, and further down the page shows the randomized address currently in use. Google says the randomized address has been the default since Android 10. If you want a new address more often, you can enable non-persistent randomization in developer options. Expect some hotspots to ask you to sign in again more often.

Windows 10 and 11. In Settings, under Network & internet and Wi-Fi, there is a switch called Random hardware addresses. It applies to all networks. For a single network, go to Manage known networks, pick the network and turn the option on there. If the switch is missing, your Wi-Fi hardware most likely does not support it.

Three habits that do more than any setting

Clear out saved networks. The hotel from 2019, the airport hotspot, the guest Wi-Fi of a company you left years ago: your device will try to join every network on that list, and the 2016 decoy experiments relied on exactly that. Delete what you no longer use.

Stop auto-joining open networks. Some phones connect on their own to open hotspots they rate as high-quality. On a Pixel it is called Connect to open networks and sits under Network & internet, Internet, Network preferences; other brands label it differently. If you do not rely on it, turn it off.

Bluetooth off when you are not using it. Headphones, watch and car need it. The rest of the day it is just broadcasting, and researchers have found gaps in the disguise there too.

What a private address does not cover

The MAC address is one identifier among many, and not the strongest. Once your phone is online, every site sees your IP address, whichever MAC address you used in the café. A VPN moves that trail to the VPN provider; what that buys you is covered in what a VPN really does.

Apps do not need your MAC address either. They have the advertising ID, which data brokers used to build movement profiles of millions of people. Our article on the advertising ID shows how that worked. Add to that the accounts you sign in with and the mobile network, which knows which cell your phone is in regardless of Wi-Fi.

So a private Wi-Fi address makes one kind of tracking hard: quiet counting in public places. No vendor promises more than that.

What’s left

Renew tried something in 2013 that was cheap and invisible at the time. A phone probing for networks with a fixed address could be recognised by any receiver on the street. Retailers and transport operators made use of that, and an intelligence agency analysed travellers’ Wi-Fi data. Since then Apple, Google and Microsoft have gradually made those addresses change. For everyday life that is real progress, even if researchers have repeatedly found ways around it.

For you it is a small job. Check the second character of your Wi-Fi address, set public networks to Rotating, clear old networks off the list and turn Bluetooth off when you do not need it. Five minutes, and a bin like the one from 2013 will find it much harder to recognise you.

---

Sources: Quartz, Siraj Datoo, This recycling bin is following you, 8 August 2013 · Vice, Lex Berko, London Shut Down Its Data-Collecting Recycling Bins, 12 August 2013 · BBC News, City of London calls halt to smartphone tracking bins, 12 August 2013 · Federal Trade Commission, Retail Tracking Firm Settles FTC Charges it Misled Consumers About Opt Out Choices, 23 April 2015 · Transport for London, TfL to use depersonalised Wi-Fi data collection technology, 2019 · CBC News, Greg Weston, CSEC used airport Wi-Fi to track Canadian travellers, 30 January 2014 · IEEE Registration Authority, MAC address blocks, public listing · Apple Support, Use private Wi-Fi addresses on Apple devices · Android Open Source Project, MAC randomization behavior · Microsoft Support, How to use random hardware addresses in Windows · Mathy Vanhoef et al., Why MAC Address Randomization is not Enough (PDF), ACM AsiaCCS 2016 · Jeremy Martin et al., A Study of MAC Address Randomization in Mobile Devices and When it Fails, PETS 2017 · Johannes K. Becker, David Li, David Starobinski, Tracking Anonymized Bluetooth Devices (PDF), PETS 2019 · Ars Technica, iPhones have been exposing your unique MAC despite Apple’s promises otherwise, 26 October 2023

Frequently asked questions

What is a MAC address?

A hardware identifier a device uses on a local network: Wi-Fi, wired Ethernet or Bluetooth. It is twelve characters long, usually written as six pairs such as 3C:22:FB:1A:2B:3C. MAC stands for Media Access Control and has nothing to do with Apple’s Mac computers. Every phone, laptop, smart TV and games console has at least one.

Can you tell the manufacturer from a MAC address?

From a fixed hardware address, yes. The first three pairs are a block the IEEE assigns to a manufacturer, and the list of those blocks is public. A private, randomized address breaks that link: its second character is 2, 6, A or E, the rest is random, and the prefix no longer points to any company.

Can someone track me with my MAC address?

Not across the internet, because your MAC address normally never leaves your local network. Someone who puts receivers within radio range, though, can recognise a device with a fixed address in different places. That is exactly what advertising bins in London did in 2013. Modern phones use changing addresses to make this much harder.

What is a private Wi-Fi address on iPhone?

Since iOS 14, an iPhone joins each Wi-Fi network with its own randomized MAC address instead of the hardware one. iOS 18 added three options: Off uses the real address, Fixed keeps one private address for that network, and Rotating changes it about every two weeks, according to Apple. You find it under Settings, Wi-Fi, then the More Info button next to the network.

Should I turn off private Wi-Fi address?

Usually not. Apple explicitly recommends leaving it on. Turning it off only makes sense for a network that admits devices by their fixed address, such as some workplaces, schools, or a router with parental controls. Even then, switch it off for that one network only and leave it on everywhere else.

Is a MAC address the same as an IP address?

No. Your IP address routes your traffic across the internet and is visible to every site you visit. Your MAC address only matters inside the local network, between your device and the router. It stops at the router; a server on the internet only ever sees the IP. For tracking people as they walk past, the MAC address is the issue. For tracking them online, it is the IP.