How Wi-Fi Probe Requests Leak Information Elements That Bypass MAC Randomization

Mobile operating system developers argue that rotating a device's hardware address every 24 hours effectively blinds the retail tracking sensors mounted in shopping malls. Privacy researchers counter that the rotation is a cryptographic illusion, because the device continues to broadcast a highly specific, static signature alongside the fake address.[2]

Neither side disputes that modern smartphones disguise their Media Access Control (MAC) addresses when scanning for networks. The disagreement centers on what else the phone transmits during that scan.[5]

To connect to a wireless network, a smartphone must first find it. The device achieves this by broadcasting a "probe request," a radio signal asking nearby access points to identify themselves.[1]

"The probe request is the digital equivalent of walking into a crowded room and shouting the names of everyone you know," says the Electronic Frontier Foundation's 2025 privacy whitepaper. These broadcasts occur continuously while the Wi-Fi radio is active.[4]

To prevent stores from logging these broadcasts and mapping a customer's physical movements, Apple and Google introduced MAC randomization. iOS 14 and Android 10 began replacing the device's true hardware address with a temporary, rotating identifier.[3]

The Information Element Payload

But a probe request contains more than just a sender address and a network name. The IEEE 802.11 standard requires devices to declare their technical capabilities so the router knows how to communicate with them.[1]

These technical declarations are called Information Elements (IEs). They occupy up to 256 bytes of the probe request payload and dictate the specific parameters of the wireless connection. Without them, the router cannot determine how fast the device is capable of transmitting data.[1]

A standard probe request includes IEs for supported data rates, high-throughput (HT) capabilities, extended capabilities, and vendor-specific tags. A modern smartphone might broadcast dozens of these elements in a single packet.[2]

Because different manufacturers use different Wi-Fi chipsets, and different OS versions configure those chipsets uniquely, the exact sequence and value of these IEs vary wildly. An iPhone 15 running iOS 18.1 broadcasts a different IE sequence than a Samsung Galaxy S24 running Android 15.[3]

"The combination of these capability flags creates a fingerprint that is often unique to the specific device model and software build," researchers note in the Proceedings on Privacy Enhancing Technologies.[2]

Calculating the Fingerprint Entropy

The uniqueness of this fingerprint is measured in cryptographic entropy. The higher the entropy, the easier it is to distinguish one device from millions of others. Privacy researchers use this metric to evaluate how easily a single device stands out in a crowd.[5]

Academic analysis of real-world probe requests reveals that the IE sequence contains approximately 33.4 bits of entropy. This is enough mathematical variation to uniquely identify a device among roughly 11 billion possibilities.[2][5]

When a smartphone rotates its MAC address, it generates a new random identifier to mask its identity. However, the physical Wi-Fi chipset and the operating system remain exactly the same.[3]

Consequently, the new randomized MAC address broadcasts the exact same 33.4-bit Information Element fingerprint as the old MAC address. The payload survives the rotation boundary completely intact.[5]

Tracking systems exploit this continuity. If a sensor sees MAC address A broadcasting fingerprint X at 1:59 PM, and then sees MAC address B broadcasting fingerprint X at 2:01 PM, the system simply links the two addresses together.[2]

The Retail Tracking Reality

This linkage defeats the primary purpose of MAC randomization. Retail analytics providers can maintain continuous physical tracking of a device, even as it dutifully rotates its address every 24 hours.[4]

The linkage confidence is remarkably high. By cross-referencing the static IE fingerprint across the rotation boundary, tracking systems can deterministically link the old and new randomized addresses with 99.8% confidence. The mathematical certainty of the payload match overrides the anonymity provided by the new MAC address.[5]

"We observed that MAC randomization provides almost no sustained privacy against an adversary who simply looks at the rest of the packet," the PoPETs researchers concluded in their 2024 study.[2]

Retailers use this data to measure foot traffic, calculate dwell times in specific aisles, and determine whether a customer who saw a digital billboard subsequently walked into the store. The hardware sensors cost less than $50 each.[4]

The marketing language surrounding MAC randomization often overstates its protective value. While it prevents casual tracking by amateur observers, it poses little obstacle to commercial analytics platforms designed to parse 802.11 frames.[5]

Balancing Privacy and Connectivity

Fixing this vulnerability is not as simple as randomizing the Information Elements. The IEs exist for a functional reason: they tell the router how fast the device can talk.[1]

If a smartphone broadcasts fake capability flags, it risks failing to connect to the network entirely. A router might attempt to use a high-throughput modulation scheme that the phone's chipset does not actually support.[1]

"You cannot randomize the physics of the radio," notes the Android Open Source Project documentation regarding Wi-Fi scanning behaviors. The device must accurately report its hardware limits to establish a stable connection.[3]

However, OS developers are attempting to minimize the leakage. Recent updates to both iOS and Android have begun stripping non-essential IEs from probe requests, broadcasting only the bare minimum required by the standard.[3]

Apple's iOS 18, for example, removes several vendor-specific tags that previous versions broadcasted freely. This reduction in data lowers the overall entropy of the fingerprint, making it harder to distinguish between identical phone models.

The Hidden Network Problem

The most severe fingerprinting occurs when a user manually connects to a "hidden" Wi-Fi network. Because hidden networks do not broadcast their own names, the phone must actively search for them.[4]

To find a hidden network, the smartphone includes the specific name (SSID) of the network in its probe request. If a user has saved three hidden networks, the phone constantly broadcasts all three names wherever it goes.[1][4]

The combination of a static IE fingerprint and a unique list of saved hidden network names provides a tracking signature that is virtually impossible to anonymize. Retail sensors simply log the combination of the fingerprint and the unique network names to build a permanent profile.[2]

Privacy advocates recommend that users delete saved Wi-Fi networks they no longer use, particularly hidden ones. "Your phone's memory of past connections is its most vocal privacy leak," the EFF warns.[4]

Some modern OS configurations now disable active probing for hidden networks by default, requiring the user to manually trigger the scan when they are actually in range of the router.[3]

The Limits of Protocol Patches

The Information Element vulnerability highlights a fundamental tension in wireless protocol design. The 802.11 standard was engineered in the late 1990s for reliability, not anonymity. Engineers prioritized getting devices connected as quickly and reliably as possible, leaving anonymity as an afterthought.[1][5]

Retrofitting privacy onto a protocol that requires devices to publicly announce their capabilities is an ongoing mathematical struggle. Every byte of data removed to protect the user slightly degrades the efficiency of the connection.[5]

Until the underlying Wi-Fi standard is rewritten to encrypt probe requests—a change that would require replacing millions of existing routers—smartphones will continue to leave a distinct digital wake as they move through the physical world.[1][5]

The Future of Wi-Fi Privacy

The IEEE 802.11 working group is currently drafting new amendments aimed at encrypting probe requests entirely. This proposed standard would require devices to establish a secure handshake before transmitting any Information Elements.[1]

However, implementing encrypted probes presents a massive logistical hurdle. It requires not only software updates for billions of smartphones but also hardware replacements for nearly every commercial Wi-Fi router currently deployed in retail spaces.[5]

Until that hardware transition occurs, MAC randomization will remain a partial shield. It protects users from basic tracking scripts, but it cannot hide the fundamental physics of how modern radios negotiate their connections.[5]