The Privacy Implications of MAC Addresses

A MAC address contains no name and looks like nothing more than a string of hex digits. Yet for a long time it was a globally unique, lifetime-stable identifier broadcast in the clear over the air. Those three properties together made it one of the most effective offline tracking mechanisms of the past decade.

What it reveals

Manufacturer and model clues. The first 24 bits are an IEEE-allocated OUI, so a lookup names the vendor. Vendor plus a specific prefix often narrows the device category and sometimes the model range. That has direct value to an attacker: knowing the other end is a particular camera model allows targeted attempts against that model's known vulnerabilities. Prefix distributions per vendor are visible in the vendor directory.

Location history. This is the serious one. WiFi devices broadcast probe requests while searching for networks, carrying their source MAC. Deploy sniffers in a shopping centre, an airport or a street, log when and where each address appears, and a person's movements can be reconstructed. Such WiFi probe devices were commercially deployed at scale for footfall analytics.

Cross-venue correlation. One MAC recorded at several locations links those appearances into one person's trail. Combine that with other sources such as payment records, loyalty systems or cameras and the anonymous identifier can be tied to a real identity.

Presence inference. Even without knowing who you are, the fact that a given device appears at a location every Wednesday evening is sensitive on its own.

Why frame headers are not encrypted

WPA2 and WPA3 encrypt the payload. MAC addresses sit in the frame header and have to be in the clear, otherwise devices sharing a channel cannot perform addressing and collision avoidance. This is not an implementation flaw but an unavoidable consequence of link-layer design. Encrypting a wireless network therefore does not hide client addresses, which is the same root cause behind MAC filtering providing no security.

Does the law treat it as personal data

Under the EU General Data Protection Regulation, a device identifier is personal data when it can be linked to an identifiable natural person. MAC addresses are generally held to fall inside that scope, because they are sufficient to distinguish one person's behaviour over a period even if the collector does not know their name.

The practical implication is that deploying WiFi probes for footfall statistics requires a lawful basis, clear notice, data minimisation and retention limits. Simply hashing addresses does not automatically remove them from scope, since a 48-bit space can be exhaustively reversed unless the hash is salted and the key properly managed.

This site addresses the point in its own privacy policy: submitted queries are recorded, and you can contact us to have a record deleted.

Current protections

Address randomisation. The most effective countermeasure. Modern phones change address on every scan and generate a distinct address per network when associating, which defeats cross-venue correlation. Platform-specific behaviour is in MAC address randomisation.

IPv6 privacy addresses. Early SLAAC embedded the MAC in the lower 64 bits of an IPv6 address, exposing a layer 2 identifier to the public internet. RFC 7217 stable privacy addresses replaced that, as covered in EUI-64 and IPv6 address generation.

Bluetooth resolvable private addresses. BLE specified a fifteen-minute rotation mechanism from the start, while still letting paired devices recognise each other. The comparison is in Bluetooth addresses versus WiFi MAC addresses.

What users can do

Confirm randomisation is on. iOS calls it Private Wi-Fi Address in the network details, Android calls it Privacy under advanced network options, and Windows requires enabling random hardware addresses manually.

Turn off WiFi and Bluetooth scanning when not in use. Flipping the main switch may still leave background scanning active; WiFi scanning and Bluetooth scanning have to be disabled separately in location settings.

Do not expect a manual MAC change to give you privacy. It affects only the local broadcast domain and does nothing about your public IP, browser fingerprint or account state. Details in changing a MAC address and the risks.

What network administrators should do

Accept that a MAC is no longer a stable identity and move authentication to a real identity mechanism such as 802.1X, discussed in 802.1X and MAC authentication bypass. If you do collect addresses for operational reasons, set an explicit retention period and clear them on schedule rather than accumulating useless history indefinitely.