Private Wi-Fi Address: What It Hides, and From Whom

Most people meet this setting the wrong way around: a hotel network stops recognizing their laptop, and a support page tells them to turn off Private Wi-Fi Address or randomized MAC. It defends well against one observer and barely at all against another.

The address your device broadcasts before joining

A Wi-Fi client does not wait to be discovered. To find networks quickly it sends probe requests: short frames broadcast across channels, each carrying a source MAC address. Every access point in range hears them, and so does anyone with a cheap adapter in monitor mode. Before platforms randomized the address used while scanning, a phone in a pocket emitted a permanent, globally unique identifier every few seconds, connected or not.

That is what made passive footfall analytics cheap — sensors counting devices, measuring dwell time, stitching visits together across months from the address alone. Randomization broke that cheap version, not the expensive one. Probe requests also carry supported rates, capability bits, vendor-specific information elements, and frame sequence numbers; published research has repeatedly re-linked devices across randomized addresses from those leftovers alone. Randomization raises the cost of tracking; it does not deliver invisibility.

What changes the moment you associate

Association is a different regime. Once the network hands you an IP address, your device needs a stable link-layer identity there: ARP tables, DHCP leases, firewall rules, and captive-portal sessions all assume the client keeps one address. So platforms use per-network stable randomization — one private address per network profile, reused on every reconnect. Android derives it from the profile's parameters, including SSID and security type, and keeps it until a factory reset: forgetting the network and rejoining returns the same address. Apple's Fixed mode keeps one address per network too, with one difference: forgetting the network discards it, so a later rejoin starts a new one.

The consequence people miss: the coffee shop cannot correlate you with the airport lounge, but it can correlate you with yourself. Every visit for the next year arrives under one address.

Rotation answers that one problem — Apple's Rotating mode moves to a new private address about every two weeks, Windows offers Change daily, Android hides non-persistent randomization in developer options. It shortens how long a single address stays useful as a join key. It changes nothing about what the operator observes during a session, and helps nothing if anything else about you is stable: a portal account, a hostname, a device fingerprint. It also costs something: rotation can push you back through a captive portal and break DHCP reservations.

What the network you joined still learns

Once associated, the address is one identifier among several, and rarely the loudest.

• The DHCP hostname. Clients may volunteer a name in the DHCP request (option 12). Behavior varies sharply: Android stopped sending one in Android 8, current Apple devices send a generic name or nothing, and plenty of Windows and Linux laptops still send the machine name their owner typed at setup. A randomized address in the lease table next to Anna-PC defeats most of the point — and the requested-option ordering and vendor class string beside it name the operating system anyway.
• The rest of the local name surface. mDNS/Bonjour, AirPlay and AirDrop advertisements, SMB and printer discovery broadcast device names on the local segment independently of DHCP. That is usually where a personal first name shows up.
• The captive-portal identity. An email address, room number, or verified phone number is a durable account key that survives every address change.
• DNS and traffic metadata. Without encrypted DNS, every hostname you resolve goes to the resolver the network handed you — see what a DNS leak exposes — and destinations, TLS server names, and timing stay visible on any unencrypted path.

You can check the first item on any network you control: open the router's admin page and look at the lease table. If your first name sits there beside a randomized address, randomization did its job and something else undid it.

Two observers people keep merging

The first is passive: it never authenticates you, never hands you an IP address, and is often not the venue's Wi-Fi at all — just a receiver counting frames. It sees your device whether or not you connect, and randomized scanning addresses target it squarely. The second is the operator of the network you signed into, holding your session, lease, DNS queries, portal account, and traffic. There, a private address only changes which pseudonym appears in the log.

How this layers with a tunnel

A tunnel starts one layer above: it encapsulates IP packets, and the 802.11 frame carrying them is built fresh by your radio for the hop across the room. Your MAC address, real or private, is still what the access point sees and the DHCP server records. A tunnel changes nothing about link-layer identifiers, and randomization changes nothing about confidentiality.

The reverse misconception deserves a plain statement: websites cannot see your MAC address. It lives in the layer-2 frame header, and every router strips that header and writes a new one for the next hop, so the server sees a header written by its own upstream switch. No web page, browser API, or fingerprinting script reads it — that layer is cookies, storage, IP addresses, and browser fingerprints.

When to deliberately turn it off

• Networks that filter by MAC address. A registered device list will not recognize a private address. As a security control this is weak, since addresses are trivially spoofed, but as a gate it is real.
• Home network bindings. DHCP reservations, port forwarding, per-device QoS, and parental controls are keyed to an address that must stay put.
• Corporate and campus access control. Registration portals and NAC systems bind an approved device to its hardware address, and rotation forces repeated re-registration.

What you trade away: that network now holds your permanent hardware identifier, the same one every other network with randomization off also sees — exactly the cross-network linkage the feature exists to prevent. The choice is per network, so leave it on everywhere and switch it off only where required.

Where the setting lives

• Apple platforms: on iOS and iPadOS, Settings → Wi-Fi → the i button next to the network; on macOS, System Settings → Wi-Fi → Details. The control is Private Wi-Fi Address, with Off, Fixed, and Rotating. Current versions default to Fixed on WPA2 and WPA3 networks, and to Rotating on open, WEP, WPA, and captive-portal ones.
• Android: Settings → Network & internet → Internet → the gear next to the network → Privacy, offering "Use randomized MAC" (the default) or "Use device MAC". Samsung puts it under Connections → Wi-Fi → gear → View more → MAC address type. Android 11 and later also expose Wi-Fi non-persistent MAC randomization in Developer options, applied globally.
• Windows 11: Settings → Network & internet → Wi-Fi for the global switch, then Manage known networks → a network → Random hardware addresses, with Off, On, and Change daily per network.