Mobile Fundamentals · Wi-Fi & Bluetooth · Lesson 3 of 4

MAC Randomization

How phones avoid being tracked by their Wi-Fi address.

Your phone's name tag

Every Wi-Fi chip is given a hardware address at the factory called a MAC address. Wi-Fi uses it to deliver data to the right device, a bit like an apartment number on an envelope. The network you join can see it, and so can equipment listening nearby.

A fixed address works like a name tag. If your phone shows the same address at the coffee shop, the gym and the mall, anyone logging those addresses can tell it's the same phone. Some retail analytics companies have used Wi-Fi sensors this way to count shoppers and spot repeat visitors.

Phones now push back with MAC randomization. While scanning for networks, they use throwaway addresses. When they join a network, they use a made-up address unique to that network. iPhones call this Private Wi-Fi Address (iOS 14 and later). Android has used a randomized MAC by default since Android 10. On iOS 18 and later you can also pick Rotating, which changes the address every two weeks.

On the simulated phone, toggle Private Wi-Fi address and watch the address each network sees.

Count the bytes

A MAC address is 48 bits, which is a lot of ones and zeros to read. So it's written in hexadecimal, a number system that uses the digits 0 to 9 plus the letters A to F. One hex digit stands for 4 bits, so two hex digits make one byte (8 bits). That's why addresses are written in pairs, like 3C:22:FB:9A:41:07.

On a factory address, the first three pairs are an OUI (Organizationally Unique Identifier), a block the IEEE assigns to a manufacturer. Look those three pairs up and you can often tell who made the device. The maker chooses the last three pairs for each individual chip.

Made-up addresses carry a marker. One bit in the first pair says the address was assigned locally by software instead of the factory, and phones set it whenever they invent an address. That bit is why the second digit of a randomized phone address is always 2, 6, A or E. If you spot one of those in your router's list of connected devices, that device is probably using a private address.