MAC address randomization, explained

A factory-assigned MAC address never changes, which used to make it a convenient, silent tracking signal: retail stores, transit systems, and anyone else running Wi-Fi scanners could recognize a returning device (and by extension, a returning person) purely from the MAC address its phone broadcast while searching for known networks, no app, login, or cookie required. MAC address randomization is the industry's fix: generate a new, randomized MAC address for situations where the real one isn't needed, instead of exposing the permanent hardware one.

Where it happens

• Probe requests. Before your phone joins a network, it (or the network) sends probe frames scanning for known Wi-Fi networks. Modern phones use a randomized MAC address for these probes by default, so a scanner watching probe traffic sees a different address every so often instead of one that follows you around.
• Per-network connections. iOS and Android both go further and can use a separate randomized MAC address for each Wi-Fi network you actually join, so the same phone looks like a different device to your home network than it does to a coffee shop's.

Apple introduced randomized MAC addresses for Wi-Fi scanning in iOS 8 (2014); Android followed a few years later, with per-network randomization becoming the default from Android 10 onward. Both remain opt-out rather than mandatory, a network administrator can still request the real address for specific trusted networks (enterprise Wi-Fi with device management, for instance), but the default today is randomized.

How to tell a randomized address from a real one

This is where the bit-level structure covered in how MAC addresses are structured actually pays off directly. A randomized address sets the U/L (universal/local) bit, marking it as locally administered rather than IEEE-assigned, since it obviously isn't drawn from any vendor's registered OUI. In practice, that means:

• A universally administered address (U/L bit 0) generally isn't randomized: it maps to a real, IEEE-registered vendor OUI.
• A locally administered address (U/L bit 1) generally is, though not always. Virtual machines, Docker's virtual network interfaces, and some VPN clients also generate locally administered addresses that have nothing to do with privacy randomization.

Telling those two locally-administered cases apart from the bit pattern alone isn't fully reliable, which is exactly why our lookup tool reports a randomization confidence level with its reasoning shown, rather than a flat yes/no: it weighs the administration bit alongside other signals instead of trusting one bit in isolation.

See also: what a MAC address is, and how randomization fits into the format's broader history.