What is a probe request?
Probe requests drive Wi-Fi discovery, and they raise the device privacy questions that footfall measurement has to answer.
On this page
A probe request is a short radio signal that a Wi-Fi device sends to ask which networks are nearby. It is a management frame, the housekeeping layer of the Wi-Fi protocol, and carries no user traffic, messages or content. No app or login triggers one, and phones send them whether or not they join a network.
How does a probe request work?
A device sends a probe request and waits for nearby access points to answer with a probe response. This is active scanning. The alternative is to listen passively for the beacons that access points broadcast, and phones do both because active scanning is faster.
A probe can be directed, naming a specific network the device is looking for, or it can be a broadcast probe that asks for any network in range. Devices send probes at intervals that vary with manufacturer, operating system, battery state and whether the screen is on. Connected devices keep scanning too, at a lower rate, which is how your phone moves to a stronger network without you asking.
What did phone makers change about probe requests?
Every probe request includes a sender address, the device’s MAC address. Devices once probed with their real, permanent hardware address, which could in principle be logged and reused. Modern devices send randomised MAC addresses that change over time and differ per network. Randomisation made simple logging harder, though not impossible, and it changed how counting works: a system that naively counts unique addresses will count the same phone many times.
A footfall system’s quality depends on its filtering and modelling layer, which has to correct for randomised and spoofed addresses, stationary devices and staff-like behaviour. What data you get describes how the resulting counts are validated and delivered.
Why do probe requests matter for privacy?
Wi-Fi discovery relies on probe requests, so privacy depends on how the system that receives them treats the identifiers they carry. An identifier that can be tied to a person is personal data under GDPR, which is why Wi-Fi analytics deserves scrutiny in any procurement or DPIA.
In a privacy-first design, personal data is irrevocably deleted, never hashed and kept, never stored. What remains are anonymous, aggregated statistics without profiles or history, and with no way back to a device or a person. The page on GDPR-compliant footfall analytics covers what a compliance review of such a design looks at.
Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority.
How do probe requests become a footfall statistic?
Wi-Fi-based people counting reads these signals with the access points a venue already runs. It anonymises at the start of the pipeline, filters out noise and calibrates the result against manual control counts. The output shows how a physical space is used: how many visited, how long they stayed and how they moved between zones, with no log of devices.
Sources
- Martin, J., Mayberry, T., Donahue, C., Foppe, L., Brown, L., Riggins, C., Rye, E. C., & Brown, D. (2017). A study of MAC address randomization in mobile devices and when it fails. Proceedings on Privacy Enhancing Technologies, 2017(4), 365–383. https://doi.org/10.1515/popets-2017-0054
- Fenske, E., Brown, D., Martin, J., Mayberry, T., Ryan, P., & Rye, E. (2021). Three years later: A study of MAC address randomization in mobile devices and when it succeeds. Proceedings on Privacy Enhancing Technologies, 2021(3), 164–181. https://doi.org/10.2478/popets-2021-0042
- Vanhoef, M., Matte, C., Cunche, M., Cardoso, L. S., & Piessens, F. (2016). Why MAC address randomization is not enough: An analysis of Wi-Fi network discovery mechanisms. Proceedings of the 11th ACM Asia Conference on Computer and Communications Security (ASIA CCS ‘16), 413–424. https://doi.org/10.1145/2897845.2897883
- Apple. Use private Wi-Fi addresses on Apple devices. Apple Support. https://support.apple.com/en-us/102509
- Android Open Source Project. MAC randomization behavior. https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior
- European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(1) and Recital 30. https://eur-lex.europa.eu/eli/reg/2016/679/oj
Curious what this looks like for your venue?
Frequently asked questions
Does a probe request contain personal data?
A probe request is a management frame and carries no user traffic such as messages, browsing or content. It does include a MAC address, and because an identifier tied to a device can be personal data under GDPR, what matters legally is what a receiving system does with it. Systems designed for privacy remove the link to any individual so that only anonymous, aggregated statistics remain.
Can a person be tracked through probe requests?
Raw, unprocessed probe data can be misused that way, which is why regulators scrutinise Wi-Fi analytics. MAC randomisation makes logging a device's address harder, though not impossible, so privacy rests on the design of the system that receives the signals. A privacy-first measurement system is built so no individual can ever be identified: personal data is irrevocably deleted, never hashed and kept, never stored, leaving only anonymous, aggregated statistics.
Do phones send probe requests while connected to a network?
Yes, most devices keep scanning even when they are connected, for example to find a stronger network, though how often varies by manufacturer, operating system and whether the screen is on. Probe behaviour has no fixed schedule and changes over time, so measurement systems have to be calibrated for it.
Is probe-based people counting GDPR-compliant?
It depends entirely on the system's design, which is why the question belongs in every procurement. Bumbee Labs' Wi-Fi method was reviewed and approved by a European data protection authority, and our GDPR page explains what that approval means for a compliance review.