Machine Learning Defeats MAC Randomization: Devices Are Still Trackable

Background: Why MAC Randomization Exists

Modern phones and laptops constantly broadcast probe request frames while scanning for Wi-Fi. Early on, these frames carried the device's real MAC address, letting malls and airports track your movements over time. To counter this, iOS and Android introduced MAC randomization: a software-generated random address replaces the real hardware address and is rotated periodically.

A randomized address sets a specific flag bit to "locally administered," distinguishing it from the factory-burned "globally unique" address that contains the OUI.

The New Research: Randomization Isn't Enough

A June 2026 paper, Can Machine Learning Break Wi-Fi Privacy?, reached a clear conclusion: even as a device keeps changing its MAC, machine learning can re-link those different random addresses back to the same device.

The reason is that a probe request carries far more than a MAC address — it includes many unencrypted fields that together form a device fingerprint.

How the Attack Works

The researchers exploit three classes of side-channel signals:

• Bitwise decomposition of the HT (High Throughput) capabilities field: different chipsets and drivers declare their 802.11n capabilities with subtle differences. Breaking this field down to the bit level sharply increases how distinguishable devices become.
• Inter-Probe Frame Arrival Time (IFAT): the rhythm at which a device emits probe frames is shaped by its chipset and OS scheduling, forming a timing fingerprint.
• Signal strength (RSSI) features: physical-layer signal modeling further narrows the identification.

Fed together into a machine-learning model, these features let an observer pick out, from a sea of unrelated-looking random MACs, the ones that actually come from the same device.

What It Means

• For ordinary users: randomization alone ≠ anonymity. Real anonymity needs layered measures — reducing background scanning, turning off Wi-Fi when unused, and combining randomization with other protections.
• For enterprises and IT: since a random MAC was never trustworthy, using it for network access or auditing was always fragile. Move to strong identities like 802.1X and device certificates.
• For security research: another reminder that privacy techniques must be reassessed as computing power grows.

What the Real MAC Reveals: Vendor Information

Note that randomization only happens at the "broadcast" layer. The device's real, factory-burned hardware MAC still exists, and its first three bytes (the OUI) are assigned by the IEEE to each manufacturer — that's exactly how you identify who made a device.

If you have a real (non-randomized) MAC address, you can look up its vendor directly with our MAC address lookup, backed by Wireshark's official IEEE OUI database. To understand the full structure of a MAC address, read our post What Is a MAC Address.

Takeaway

MAC randomization is an important step for privacy, but it is not the finish line. The rise of machine-learning fingerprinting shows that as long as unencrypted side-channel information exists, simply "changing the address" won't stop a determined tracker. Privacy is never a single switch — it's a system that must be continuously hardened.