A new explainer from ad-tech vendor Advision, published in November 2026, asks a question that matters well beyond the advertising industry: is Wi-Fi tracking for advertising legal in Europe? The piece promises a plain answer on MAC addresses, anonymization and consent, and on what European regulators have already decided. For anyone who walks past a digital billboard or through a shop with a phone in their pocket, the topic of Wi-Fi tracking, GDPR and your MAC address is worth understanding.
A note on sourcing: the published summary of the Advision article outlines its questions but not its detailed conclusions. This post therefore explains the underlying concepts and the practical steps you can take, without claiming to report specifics of regulatory rulings that the summary does not spell out.
Why your phone's Wi-Fi signal is trackable
Phones do not stay quiet when they are not connected to a network. Technical write-ups on the subject describe a mechanism called a "probe request," a message your device transmits that includes its MAC (Media Access Control) address, even when it is not connected to a Wi-Fi network. Sensors placed in a shop, a transit hub or inside a digital out-of-home (DOOH) screen can listen for those messages.
A MAC address is a hardware identifier. If it stays the same, a sensor can recognize the same device again and again. That is what makes it attractive for counting visitors, estimating how long people linger near a screen, or tracing movement between locations. It is also what makes it a privacy concern: a stable identifier tied to a device, which is usually tied to one person, is a way of following someone over time.
Modern phones have tried to blunt this. Features such as Apple's Private Wi-Fi Address rotate or randomize the address your device presents. Security researchers note that when addresses constantly change, location tracking can't rely on them to identify a device over time. But the picture is not perfect: reports have questioned how well some of these protections work, and discussions among privacy practitioners point to ways randomized addresses can in some cases be "de-randomized."
What GDPR says about MAC addresses and anonymization
The core legal question in this debate is whether the data collected counts as personal data. The General Data Protection Regulation is built around information relating to an identifiable person, and everyday activity such as walking around with a phone generates exactly that kind of data, as our GDPR explainer for everyday users outlines.
The Advision piece frames the issue around three concepts:
- MAC addresses: whether a device identifier collected passively counts as personal data.
- Anonymization: whether processing the data so that individuals can no longer be identified takes it outside the regulation's scope, and how robust that process must be.
- Consent: whether, and when, people must be asked before their device signals are logged.
These are distinct issues. Anonymization claims deserve scrutiny, because the value of the data to advertisers often depends on recognizing repeat visits, which sits uneasily with true anonymity. Whether a given system meets the bar is a question for regulators and courts, not for a vendor's marketing.
What European regulators have decided on Wi-Fi tracking
The Advision article says it covers what European regulators have already decided, but its public summary does not list the decisions, so we will not characterize them here. What can be said is that European data protection authorities are actively willing to enforce rules on location-related data. Ireland's Data Protection Commission, for example, fined Google €403 million over its handling of users' location data, a case we covered in our report on the DPC fine. That case concerned a different kind of location processing, not Wi-Fi sensors in advertising, but it shows that location data is firmly on regulators' radar.
If you want the specifics of Wi-Fi tracking rulings, read the original Advision explainer and, ideally, the regulators' own published decisions, since a vendor has a commercial interest in how those outcomes are described.
How to limit Wi-Fi probe tracking on your phone
You cannot control what sensors are installed in public spaces, but you can control what your phone broadcasts.
- Use randomized MAC addresses. On iPhone, look for the Private Wi-Fi Address setting for each network. Heed the "Privacy Warning" if it appears, since it signals that a network could track your real MAC address because the setting is off or failing. Android and other platforms offer similar randomization options in their Wi-Fi settings.
- Turn off Wi-Fi scanning. If your phone offers background Wi-Fi scanning for location accuracy, disable it. When Wi-Fi is off entirely, your phone is not sending probe requests.
- Forget old networks. Saved networks can be requested by name in some probe behavior, so remove ones you no longer use.
- Keep your operating system updated, since vendors regularly adjust how addresses are handled.
- Remember the limits. Randomization reduces Wi-Fi-based tracking but does not stop tracking through other means, such as the cellular network.
What This Means For You
The legal answer to whether Wi-Fi tracking for advertising is allowed depends on how the data is collected, whether it is truly anonymized, and whether consent is obtained. That is exactly why the questions raised in the Advision explainer matter to you as a person, not just as an advertising target. In the meantime, the technical protections sit in your own settings. The same logic applies at home: our smart TV privacy guide shows how everyday devices collect data you may not expect.
Key takeaways
- Enable randomized or private Wi-Fi addresses on every network you join.
- Switch off Wi-Fi, and Wi-Fi scanning, when you are not using it, especially in shops and transit areas.
- Treat anonymization claims with healthy skepticism and read primary regulator sources.
- Read our GDPR explainer to understand your rights over location-related data, then use them: ask companies what they collect and why.
Wi-Fi tracking, GDPR and your MAC address will remain a live topic as DOOH networks expand. A few minutes in your phone's settings is the most direct protection available today.
