Below: how Wi-Fi tracking works, how to find your MAC address and tell a random one from the real one, step-by-step setup for iPhone, Android and Windows, and an honest look at when randomization is better switched off. If you also want the second layer — encrypted traffic and a different public IP — see what LiMP VPN offers on Android, Windows and in Chrome.
What a MAC address is and why it gives you away
A MAC address (Media Access Control) is the hardware identifier of a device's network module: Wi-Fi and Bluetooth. It looks like six pairs of hexadecimal characters, for example A4:83:E7:2C:9F:10. The first three pairs usually identify the chip manufacturer, the rest the specific unit. Unlike an IP address, which the network assigns and which changes, the factory MAC is tied to the module and is meant to be unique. That permanence is exactly what makes it a convenient tracking tag.
When Wi-Fi is on, your phone is not silent. To find familiar networks faster, it periodically broadcasts short probe requests. In the past, every one of them carried the real MAC address. Any access point or receiver nearby can hear these signals — no connection required. Your phone literally introduces itself to surrounding networks, even from your pocket.
The second scenario is when you do connect to Wi-Fi (in a café, hotel or airport). The access point sees your MAC address and remembers it, so the network owner can link all your visits into one history: today, yesterday, a month ago — the same device.
How exactly you are tracked through Wi-Fi
MAC address tracking is not a theory but a mature offline-analytics industry. Here is how your phone gives itself away.
- Retail analytics in stores and malls. Wi-Fi sensors count visitors by MAC address, measure how long someone lingered at a display, how often they come back and which route they take through the store — no consent or connection needed.
- Public hotspots. Free Wi-Fi at an airport or café usually sits behind a login page and an analytics platform. The MAC address becomes an anchor for the phone number or email from the login form, visit times and traffic volume.
- Outdoor Wi-Fi sensors. Standalone receivers on streets and in transit hubs listen to probe requests and map how devices move between locations.
- Home and office routers. The network administrator sees the MAC of every connected device and can match it to a specific person.
The key point: a MAC address on its own contains no name or phone number. But it serves as a stable key around which a profile is built. Once the MAC is linked to your identity — via a login form, a payment or a loyalty program — every past and future "anonymous" visit by that device stops being anonymous.
Vendors have noticed: since Android 8 and iOS 8, phones use a random address instead of the real one when scanning for networks. But scanning is only half the picture. When connecting to a saved network, devices long kept showing their permanent address, and that is where per-network randomization, described below, comes in.
MAC address vs IP address: two different tags
Beginners often confuse MAC and IP. In fact they are tags at different levels: different observers see them, and different tools hide them.
| Tag | Where it is visible | Who sees it | How to hide it |
|---|---|---|---|
| MAC address | Local network, the radio space around you | Wi-Fi access points, retail sensors, routers, nearby sniffers | MAC randomization in device settings |
| IP address | The whole path across the internet | Websites, apps, your ISP, ad networks | A VPN replaces your public IP |
| DNS queries | Between your device and the DNS server | ISP, network owner, DNS service | Encrypted DNS, VPN |
Hence a point that is often misunderstood: your MAC address does not travel across the internet. It only works on the local segment — from your phone to the nearest access point or router. The website you open never sees it. So randomization will not help against online tracking, which relies on IP addresses and browser identifiers. Conversely, a VPN replaces your IP but does not touch the MAC broadcast around you. You can check which IP websites see right now with the What is my IP tool, and what your provider can see is covered in our article on how a VPN protects you from ISP tracking.
How to find your phone's MAC address and tell a random one from the real one
A modern device usually has two kinds of address: the hardware (factory) one and private ones — a different one per network. What matters is the address a specific network actually sees.
| Device | Hardware address | Address the current network sees |
|---|---|---|
| iPhone | Settings → General → About → Wi-Fi Address | Settings → Wi-Fi → "i" next to the network → Wi-Fi Address |
| Android | Settings → About phone → Status (or Device information) → Wi-Fi MAC address (labels vary by skin) | Settings → Wi-Fi → gear next to the network → Advanced / Network details |
| Windows | Command prompt: getmac /v or ipconfig /all → Physical Address | Settings → Network & internet → Wi-Fi → network properties → Physical address (MAC) |
You can tell a random address from the factory one by its second character. Randomized addresses are marked as "locally administered": a special bit of the first byte is set, so the second character of the address is 2, 6, A or E (for example x2:…, xA:…). If the network details show something like DA:4F:… or 12:9C:…, randomization is working. An address that matches the hardware one means the network sees your real MAC.
MAC address randomization: what it is and what it does
Randomization (or a "private address") is an operating-system feature that substitutes a randomly generated MAC for the real hardware one. If the phone shows each network its own random address, and the address also changes regularly while scanning, linking your visits into a single chain becomes much harder.
In practice this means:
- Retail and street sensors see "different" devices instead of one permanent one, so end-to-end tracking falls apart.
- Different Wi-Fi networks get different addresses and cannot be automatically matched: the café won't know you were also at the airport.
- Your real, hardware-bound MAC never leaves your device.
Randomization modes differ in how long a random address lasts, which sets the balance between privacy and convenience.
| Mode | Where | How the address behaves | Privacy |
|---|---|---|---|
| Persistent random | Android 10+ (default), iOS 14+ ("Fixed" in iOS 18) | Unique per network, but stays the same on repeat connections to it | Prevents linking different networks; one network still recognizes you on every visit |
| Rotating | iOS 18 and later | Changes about every two weeks for the same network | Higher: a long visit history on one network is harder to build |
| Non-persistent | Android 12+ (for some open networks) and developer options | May refresh on new connections — for example when the old address is more than a day old | Maximum, but you will re-authenticate on public networks more often |
| Random hardware addresses | Windows 10 and 11 | Random address for all networks or a chosen one | Similar to persistent random on phones |
The good news: on modern phones randomization is on by default. But for long-saved networks, networks migrated from an old device or ones set up by an administrator, check the setting manually — sometimes the phone still shows its hardware address to "trusted" networks.
How to turn on Private Wi-Fi Address on iPhone
On iOS the feature is called Private Wi-Fi Address and is available from iOS 14. In iOS 18 the simple toggle became a choice of three modes: Off, Fixed and Rotating. Rotating is the most private: according to Apple, the address changes every two weeks.
- Open Settings → Wi-Fi.
- Tap the "i" icon next to the network.
- Find Private Wi-Fi Address and turn it on.
- On iOS 18 and later, choose Rotating — the best option for public networks; for your home network Fixed is fine.
- Repeat for every network you join regularly.
Once enabled, the phone reconnects under a random address. On a home network where you set up MAC-based rules (a static IP or parental controls on the router), you may need to allow the device again. On a Mac, the same setting is in System Settings → Wi-Fi → Details next to the network.
How to turn on MAC randomization on Android
Android uses a randomized MAC for connections by default from version 10. Menu names differ between Samsung, Xiaomi, Pixel and other skins, but the logic is the same.
- Open Settings → Network & internet (or Connections) → Wi-Fi.
- Tap the gear next to the network and open Advanced if needed.
- Find MAC address type or Privacy.
- Choose Randomized MAC (Use randomized MAC) rather than Device MAC.
- Check all saved public networks the same way — especially those you joined on an old phone.
For maximum privacy, Android 12 and later also support non-persistent randomization: the address is not permanently tied to a network and may refresh on new connections. It can be enabled globally in Developer options (the Wi-Fi non-persistent MAC randomization item; Developer options are unlocked by tapping the build number in About phone seven times). Keep in mind that it is an experimental setting, and hotels and airports will ask you to log in again more often. For other Android privacy settings, see our guide to setting up a VPN on Android.
If a familiar network stops letting your phone in after the change, open the router settings and update the list of allowed devices — the old permanent MAC will not show up there anymore.
MAC randomization on Windows: your laptop is visible too
A laptop in a café or coworking space is just as visible to Wi-Fi access points as a phone. Windows 10 and 11 have a built-in Random hardware addresses feature, but it is not always on — that depends on the system version and the Wi-Fi adapter driver.
- Open Settings → Network & internet → Wi-Fi.
- Turn on Random hardware addresses (in Windows 10: Use random hardware addresses) — a random address will then be used for all networks.
- To configure a specific network, open Manage known networks, pick the network and set the same option for it.
If the toggle is missing, the adapter or its driver does not support the feature; updating the driver from the laptop maker's website usually helps. To encrypt traffic on the laptop you need a separate tool — LiMP VPN has an app for Windows.
When to turn randomization off
Randomization has a cost: some networks use the MAC address as an entry pass. Apple explicitly advises turning the private address off if a device cannot join a network, or cannot reach the internet or network resources after joining. Typical cases:
- MAC filtering on your home router. If the router only admits devices from an allowlist, keep a fixed private address for the home network and add it to the list once. Where to find such settings on a typical ISP router is covered in our article on router VPN setup.
- Static IP and parental controls. DHCP reservations and time limits are also tied to the MAC — when the address changes, the rules lose track of the device.
- Paid hotel or in-flight Wi-Fi. Paid access is often bound to the MAC. With non-persistent randomization the network may treat you as a new guest and ask you to log in again.
- Corporate networks. Access-control and device-inventory systems often rely on MAC addresses. If IT asks you to disable the private address for the work network, do it for that network only.
Disable randomization selectively — for one trusted network, not globally. If your connection problems have nothing to do with MAC, check our breakdown of why a VPN may not work over Wi-Fi.
What MAC randomization does not cover
It is important to understand the limits of this tool so it does not create a false sense of security. MAC randomization keeps you from being tracked as a physical device near a Wi-Fi access point. It has nothing to do with what happens on the internet itself.
- It does not encrypt your traffic. On an open public network, others can still see unprotected data and the sites you visit. Encrypting the channel is the job of a VPN.
- It does not hide you from websites. To web services you are your IP address and browser fingerprint, not your MAC.
- It does not protect against tracker apps. The advertising ID, location and app permissions are a separate layer configured in system settings.
- It does not help if you sign in under your name. If you log in to Wi-Fi with your phone number or an account, the network knows who you are regardless of the MAC.
The logic is simple: MAC randomization hides your device in the physical Wi-Fi space, while a VPN hides your traffic and real IP on the internet. Together they cover both the local and the network level of tracking. LiMP VPN encrypts your connection on Android and Windows, as well as in Chrome, and replaces your public IP — you can subscribe on the pricing page. What a VPN on a smartphone is and how it works is explained in plain words in our article on VPN on your phone.
Checklist: how to stop broadcasting your phone over Wi-Fi
- Turn on a private (random) Wi-Fi address for every network you join.
- Where you can choose a mode, use Rotating or non-persistent for public networks rather than a fixed address.
- Check the address in the network details: a second character of 2, 6, A or E means randomization is working.
- Turn on random hardware addresses on your Windows laptop too.
- Turn off Wi-Fi and Bluetooth when you don't need them, so the device stops broadcasting requests.
- Avoid joining open networks unless necessary, and delete saved networks you no longer use.
- On public networks, turn on a VPN to encrypt traffic and hide your real IP.
- Re-check the setting after system updates and after moving to a new phone.
