MAC Randomization
A privacy feature where a device probes or advertises from a random, locally-administered MAC instead of its real burned-in one, to resist passive tracking over Wi-Fi and BLE.
MAC randomization is a privacy feature in which a device uses a randomly generated, locally-administered MAC address, instead of its real, globally-unique, burned-in one, when it probes or advertises over Wi-Fi or BLE. It exists to break the long-term correlation that made passive device tracking trivial.
What it is
A network interface has a factory MAC address, 48 bits, globally unique, permanent. That permanence is exactly the problem: any listener who hears the address can recognise the same device again anywhere, forever. MAC randomization substitutes a throwaway address whose "locally administered" bit (the second-least-significant bit of the first octet) is set to 1, marking it as not a real vendor-assigned MAC. The device rotates through these random addresses so a passive observer sees a stream of unrelated identities rather than one stable one.
Why it matters
The burned-in MAC is a perfect tracking beacon. Historically, a phone scanning for known networks broadcast probe requests carrying its real MAC, and anyone with a monitor-mode radio in a mall, station, or street could log those addresses to follow a person across locations and over time, no consent, no connection required. Randomization degrades that capability, which matters for user privacy and equally for attackers or trackers who rely on a stable MAC to fingerprint and follow a target.
How it works
When a device is not associated to a network, modern operating systems (iOS, Android, Windows, Linux) emit probe requests from a randomized locally-administered address, and rotate it periodically. Many platforms also use a per-network random MAC even while connected, so a given device shows a different, stable-per-SSID address to each network it joins. BLE has its own scheme: resolvable private addresses (RPA) that rotate on a timer and can only be tied back to the device by a peer holding the shared Identity Resolving Key (IRK), plus non-resolvable random addresses for pure anonymity.
From an attacker's view
Randomization degrades passive tracking but does not end it. Several residual signals survive the rotating address:
- Probe-request contents: the list of SSIDs a device actively probes for is a near-unique fingerprint of where its owner has been.
- Information-element fingerprints: the exact set and ordering of 802.11 capability tags in a probe often identifies the chipset and driver.
- Sequence numbers and timing: the 802.11 sequence counter and inter-burst timing can stitch a rotating MAC's frames back into one device.
Crucially, the real, stable MAC usually reappears the moment the device associates to a known network, so an attacker who can trigger or wait for association recovers the permanent identifier anyway.
Pitfalls
- Randomization is a passive-tracking mitigation, not authentication, it says nothing about whether traffic is encrypted or whether the device can be spoofed.
- Implementations vary widely: some devices randomize only when idle, some reuse an address too long, some leak the real MAC in a non-probe frame. Do not assume "randomized" means "un-trackable".
- A randomized MAC is still a valid
802.11/BLE address you can target or impersonate; the privacy bit changes tracking, not spoofability.