MAC randomisation: what it fixed, and what it never could
Randomisation changed both what Wi-Fi signals reveal about a phone and what a counting system has to correct for.
On this page
MAC randomisation makes a phone present randomised addresses, which change over time and from one network to the next, instead of its permanent hardware address. It reduced casual tracking, but a capable adversary with raw signal access can often work around it. Privacy therefore rests on the architecture of the receiving system.
What does MAC randomisation change on a phone?
Around a decade ago, phone makers started randomising the MAC address, the permanent hardware identifier a phone broadcast with every Wi-Fi transmission. It was a real privacy improvement, aimed at an abuse that was already happening: the silent logging of permanent identifiers as people moved through cities. A randomising phone shows one address while scanning and typically another for each network it joins, and how often an address changes depends on the manufacturer and operating system. Platform documentation states the goal plainly: the address a network sees should not be a stable, universal identifier that follows the device everywhere. Randomisation does work against the crude tracker it targeted: an address logger matching one permanent ID across locations.
What does the research say about working around randomisation?
More determined analysis is another matter, and the security literature is consistent on this point. Studies of randomisation implementations have demonstrated practical ways to defeat it, and analyses of probe-request traffic show that the timing, sequence and content patterns of a device’s transmissions form a fingerprint that survives address changes. Later work combining temporal and content-based fingerprints reports de-randomisation at rates that make address-based anonymity an unsafe assumption.
Bear this in mind when you evaluate any system that hears Wi-Fi signals, counting systems included. A vendor whose privacy story amounts to “addresses are randomised anyway” has put no design of its own behind it and leaves your compliance resting on the phone maker’s imperfect defence.
What gives a counting system its privacy?
A measurement system designed for privacy does not depend on what the phone does, because its protection sits on its own side. Personal data is irrevocably deleted at the start of the pipeline (never hashed and kept, never stored), and only anonymous, aggregated statistics remain. That leaves no address log to de-randomise and no raw signal archive to fingerprint, and so nothing to breach or subpoena.
Our Wi-Fi method is built this way, and a DPO’s DPIA questions look for this kind of design.
Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority.
Why did MAC randomisation make counting harder?
A counter that trusts addresses counts the same phone more than once, so serious measurement detects randomisation patterns, filters out spoofing and stationary devices, and calibrates the statistical model against manual control counts. That correction layer decides the quality of a count. Across the industry, randomisation has pushed vendors to improve their counting methods as well as their privacy practice. The companion article, what is a probe request, explains how the signals become statistics in the first place.
Sources
- Apple (2014). iOS Security (white paper, October 2014). https://www.apple.com/mx/privacy/docs/iOS_Security_Guide_Oct_2014.pdf
- Apple. Use private Wi-Fi addresses on Apple devices. Apple Support. https://support.apple.com/en-us/102509
- Android Open Source Project. MAC randomization behavior. https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior
- Vanhoef, M., Matte, C., Cunche, M., Cardoso, L. S., & Piessens, F. (2016). Why MAC address randomization is not enough: An analysis of Wi-Fi network discovery mechanisms. Proceedings of the 11th ACM Asia Conference on Computer and Communications Security (ASIA CCS ‘16), 413–424. https://doi.org/10.1145/2897845.2897883
- Martin, J., Mayberry, T., Donahue, C., Foppe, L., Brown, L., Riggins, C., Rye, E. C., & Brown, D. (2017). A study of MAC address randomization in mobile devices and when it fails. Proceedings on Privacy Enhancing Technologies, 2017(4), 365–383. https://doi.org/10.1515/popets-2017-0054
- Uras, M., Ferrara, E., Cossu, R., Liotta, A., & Atzori, L. (2022). MAC address de-randomization for WiFi device counting: Combining temporal- and content-based fingerprints. Computer Networks, 218, article 109393. https://doi.org/10.1016/j.comnet.2022.109393
Curious what this looks like for your venue?
Frequently asked questions
What is MAC randomisation?
Instead of broadcasting its permanent hardware address, a modern phone shows a randomised MAC address that shifts over time and is different on each network. Major mobile platforms introduced randomisation over the last decade to stop the crudest form of Wi-Fi tracking: logging one permanent identifier each time it reappears.
Does MAC randomisation make Wi-Fi tracking impossible?
No, and this is well documented. Academic work has shown that devices can be fingerprinted despite randomisation, through timing, sequence and content patterns in their transmissions. Platform documentation itself describes randomisation that persists per network and does not change constantly. Randomisation made tracking harder without making it impossible.
If MAC randomisation is imperfect, what protects visitors?
The architecture of the receiving system. A system designed for privacy deletes personal data irrevocably at the start of its pipeline, never hashed and kept, never stored, so only anonymous, aggregated statistics remain. No raw signal data is kept, so whatever a clever adversary could in principle do with raw signals has nothing to work on.
How does MAC randomisation affect counting accuracy?
A naive counter that trusts addresses counts the same phone more than once. Serious measurement detects and corrects for spoofing, stationary devices, staff patterns and randomisation itself, then calibrates against manual control counts. Counting quality is decided in that correction layer, so the maturity of the method counts for more than the choice of sensor.