MAC Address Randomisation
Definition
A privacy mechanism in modern operating systems that substitutes a randomly generated MAC address for the device's globally unique burned-in address during Wi-Fi scanning and connection. Present in Android 8+, iOS 14+, and Windows 10 v1903+. Complicates cross-network tracking but does not eliminate all device-linking artefacts.
- Present in
- Android 8+, iOS 14+, Windows 10 v1903+
- Function
- Random MAC during Wi-Fi scanning and connection
- Effect
- Complicates cross-network device tracking
- Limitation
- Does not eliminate all device-linking artefacts
Common questions
Does randomisation defeat all forensic Wi-Fi tracking?+
No. While it prevents simple MAC-based tracking across different networks, a per-network randomised address can still be persistent within a single network, and other artefacts such as probe request timing or higher-layer identifiers can still link activity to a device.
Why did manufacturers add this feature?+
It was introduced primarily as a consumer privacy protection, to stop retailers and other third parties from silently tracking a phone's movements between Wi-Fi access points using its fixed hardware address.
Related terms
- BSSID
- Basic Service Set Identifier. The MAC address of a specific access point radio. Used in association logs and packet captures to uniquely...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Preferred Network List (PNL)
- The list of previously joined Wi-Fi networks stored on a client device. The device automatically probes for networks on the PNL when...
- Probe Request
- An 802.11 management frame broadcast by a client device when actively scanning for Wi-Fi networks. Contains the device MAC address and, in...
- RSSI
- Received Signal Strength Indicator. A value, typically expressed in dBm, recorded in access-point logs and packet captures that indicates how strongly a...