What is MAC Address Randomisation?

Definition

MAC address randomisation is a privacy feature in modern phones and laptops that presents a different, invented hardware address to each network instead of the device's real one. It prevents venues and third parties from tracking a device across locations, and it breaks WiFi analytics and portal logic that assume a stable identifier.

Why device makers did it

The hardware MAC address is globally unique and was historically broadcast in the clear every time a device scanned for networks. That made it a durable tracking identifier: any party with sensors in multiple places could follow a phone between them without the owner ever connecting to anything. Randomisation removes that capability by presenting a synthetic address, typically stable per network so a saved WiFi connection keeps working, but different across networks and sometimes rotated over time. It is on by default on current iPhones and Android phones. Apple's support article on private Wi-Fi addresses (checked October 2026) says that from iOS 18, open and weakly secured networks get a rotating address by default, which changes every two weeks: exactly the kind of network most guest WiFi is.

What it breaks

Anything that treated a MAC address as a person now misbehaves. Unique-visitor counts inflate, because one phone can appear as many devices over time. Returning-visitor detection under-reports, because the same person looks new. Dwell sessions fragment when an address rotates mid-visit. MAC-based allow-lists and "remember this device" auto-login features become unreliable, so regulars get asked to sign in again as if they were new.

How to build around it

The durable answer is to stop identifying people by hardware and start identifying them by consent. An authenticated portal session tied to an email address survives randomisation entirely, because the guest tells you who they are. That means designing the login to be low-friction enough that guests actually complete it, keeping sessions long enough that regulars are not re-prompted every visit, and reporting on identified guests as your primary metric with device presence as a secondary, clearly-labelled estimate. Presenting randomised device counts as visitor numbers without that caveat produces confidently wrong reporting.

More in Networking