What is MAC Address Randomisation?

Definition

MAC address randomisation is a privacy feature in modern phones and laptops that presents a different, invented hardware address to each network instead of the device's real one. It prevents venues and third parties from tracking a device across locations, and it breaks WiFi analytics and portal logic that assume a stable identifier.

Why device makers did it

The hardware MAC address is globally unique and was historically broadcast in the clear every time a device scanned for networks. That made it a durable tracking identifier: any party with sensors in multiple places could follow a phone between them without the owner ever connecting to anything. Randomisation removes that capability by presenting a synthetic address, typically stable per network so a saved WiFi connection keeps working, but different across networks and sometimes rotated over time. It is on by default across current mobile platforms.

What it breaks

Anything that treated a MAC address as a person now misbehaves. Unique-visitor counts inflate, because one phone can appear as many devices over time. Returning-visitor detection under-reports, because the same person looks new. Dwell sessions fragment when an address rotates mid-visit. MAC-based allow-lists and "remember this device" auto-login features become unreliable, occasionally locking out a regular or, worse, silently granting a new device someone else's session state.

How to build around it

The durable answer is to stop identifying people by hardware and start identifying them by consent. An authenticated portal session tied to an email address survives randomisation entirely, because the guest tells you who they are. That means designing the login to be low-friction enough that guests actually complete it, keeping sessions long enough that regulars are not re-prompted every visit, and reporting on identified guests as your primary metric with device presence as a secondary, clearly-labelled estimate. Presenting randomised device counts as visitor numbers without that caveat produces confidently wrong reporting.

More in Networking