You spin me right round (like a Wi-Fi identifier)

It seems like everyone—hackers, governments, corporations—want to track everything we do online and in the physical world. Apple has a multi-year history of rolling out new methods of deflecting, deterring, or blocking new forms of unwanted tracking. One that may have slipped under your radar could affect how your devices connect and stay connected over Wi-Fi at your home or office and while using hotspots on the ground or in the air.

Called Private Wi-Fi Address by Apple, it’s really just one example of a more generic kind of networking component that dates back decades, tracing its roots to Ethernet addressing over local networks. Network interfaces need a way to identify themselves, so that when one device wants to send information to another, it can stamp a data packet uniquely so that the recipient device will receive it.

A big MAC attack

On local area networks, or LANs, that method is a MAC: Media Access Control address. The MAC is one of several layers in a network model. The important aspect of this model is that each layer is “responsible” for a different task. The lowest layer in the simplest model covers the physical interface, like Wi-Fi or Ethernet, and how data packets are addressed to traverse that layer.1

Simplified mapping of services and protocols to the TCP/IP and OSI network layer models. There will not be a test. (Figure via Ardika6879, Wikimedia Commons.)

The MAC address—distinct from a Mac’s address—defines a network interface uniquely. If you have several interfaces on your device, like Ethernet, Wi-Fi, Ethernet-over-Thunderbolt, and so forth, each has its own MAC address.

For fixed devices, like desktop computers and routers, having an unchanging MAC address doesn’t give much away, because the MAC addresses can only be seen on a LAN. That address is stripped when traffic is routed over the Internet, which uses Internet Protocol (IP) addresses, which operate at a higher network layer.

The emergence of laptops and, more so, mobile devices like phones, tablets, and oodles of other gear that connects to Wi-Fi whenever they can means that it’s far easier for people and organizations to sniff the MAC address of a device. Whenever that device connects successfully to a wireless LAN (WLAN), its MAC address is exposed.

Now, that doesn’t sound so bad. Except that people with insidious goals—criminal or marketing—who have access in the LAN and to Web sites can associate your MAC address with certain activities you might perform. This requires the collaboration (or subversion) of companies offering Wi-Fi access with marketers who infer individuals’ identities by actions they connect. This might allow them to know who you are, where you are, and some of what you’re doing.

As Apple explains it, “If the device always uses the same Wi-Fi MAC address across all networks, network operators and other network observers can more easily relate that address to the device’s network activity and location over time. This allows a kind of user tracking or profiling, and it affects all devices on all Wi-Fi networks.”

Private Wi-Fi Address provides a deterrent effect by taking that fixed, unique MAC address, and changing it from time to time.

Long before Apple introduced this option—I think back in the early 2000s—I remember reading up on how Linux and Windows users had utilities that let them change the MAC address on their Wi-Fi adapters for improved anonymity. Having that process automated as a privacy feature feels like a big step up.

However, it can bite you, as you don’t always want to appear like a unique device every time the MAC address shifts over. Apple offers controls that can help.

Each network, a new MAC Address

For starters, with your iPhone, iPad, or Mac, Apple automatically generates a unique private MAC address for two kinds of Wi-Fi networks:

Networks with no password: These are typically publicly available ones that may be completely open, or require a click to agree to policies and join (or an email address or other personal information) or payment to use.

Networks with weak security: While the oldest form of Wi-Fi network encryption is essentially dead, a slightly newer form, the original WPA flavor, remains in use while having many weaknesses.2 WPA2 and WPA3 are considered strong.

A rotating private address changes every two weeks to try to deter unwanted inferential tracking.

This prevents tracking across networks that attempt to associate your behavior. In the two cases above, the default setting for Private Wi-Fi Address is Rotating: the MAC address changes about every two weeks. Apple offers Off, in which your actual physically assigned MAC address is used, and Fixed, which creates a MAC address for a network and then never changes it.

Because sometimes you want to keep the address the same over time, you might switch from Rotating to Fixed or even Off. Public networks often track you over time not for nefarious purposes, but because they’ve added your MAC address to their approved list and you don’t have to authenticate again! If you trust the network, you may want to change the setting for it to Fixed. I believe that some airline Wi-Fi is quite sensitive to MAC addresses, and setting those networks to fixed can keep you connected and prevent session expiration.3

Private Wi-Fi Address automatically obscures your hardware identity on exposed networks, but you can override it if useful.

Here’s where to make the change:

On a Mac, go to Apple Menu: System Settings: Wi-Fi. Click Details next to an active network or click the More… button next to another listed network and choose Network Settings. You can then choose Fixed or Off from the “Private Wi-Fi address” menu.

On an iPhone or iPad, open the Settings app, tap Wi-Fi, and then tap the info (i) icon to the right of a network in the main Wi-Fi list and change the MAC rotation from the Private Wi-Fi Address menu.4

Note that the Wi-Fi/MAC address appears below the Private Wi-Fi Address menu in each of these views. If you need to provide a MAC address to a network administrator, after setting it to Fixed, copy that address. If your address is set to Fixed on your own network, or you change it to Fixed, most routers let you use a MAC address to assign a specific local private IP address—or, for kids, control their access to the Internet!

For further reading

I address (sorry) private Wi-Fi addresses and many other practical and security issues in two books:

Take Control of Securing Your Apple Devices offers a broad overview of iOS, iPadOS, and macOS security largely from the perspective of protecting access to your physical devices and intrusion into them from people, apps, and Web sites, and protecting data at rest.

Take Control of Wi-Fi Networking and Security goes deep on setting up and tweaking Wi-Fi networks, while keeping them as secure as you want them to be.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

There’s the simplified four-layer TCP/IP model, linked above, and a more general Open Systems Interconnection, created by the ISO standards group, with seven layers, teasing apart some functions into greater separation for clarity (see figure). In the OSI model, the bottom layer is physical (transmitting bits over hardware), and the next one up is data link (connecting two nodes). ↩

The first standard, WEP (Wired Equivalent Privacy), was meant to be a very thin protective layer, as the assumption was Wi-Fi would be used in offices and homes. It was broken within a few years, and WPA was a firmware-upgradable replacement for most older devices that provided far better protection, but is quite weak by standards of 20 years ago! ↩

I haven’t flown enough to test this rigorously, but I definitely had problems in 2024, where setting the airline network to Fixed appeared to solve the problem. It may have been coincidence. ↩

Only in iOS and iPadOS, you can tap Edit at the top-right corner of the Wi-Fi menu in Settings and then edit stored private address settings. You can click Advanced on a Mac in the Wi-Fi view and click the More icon, but it doesn’t reveal network settings. ↩