What MAC Address Randomization Hides, and What It Doesn't

A MAC address is a hardware identifier your network adapter presents to the local network. It never travels beyond the first hop, so websites cannot see it and a VPN has nothing to do with it. Randomizing it changes what the Wi-Fi network you join can recognise about your device — a real privacy gain, but in a narrow and often misunderstood place.

The confusion is worth clearing up, because people sometimes treat it as an online privacy measure and get no benefit, while others miss the actual benefit it provides.

Where the address lives and stops

MAC addresses operate on the local link only. When your laptop sends a packet to a website, the packet is addressed with IP addresses at one layer and MAC addresses at another. The IP addresses persist end to end; the MAC addresses are rewritten at every hop.

So your router sees your device’s MAC address. Your internet provider does not — it sees your router’s, on its own segment. The website sees neither. There is no mechanism by which a site could learn it from an ordinary connection.

That immediately tells you what randomization cannot do: it cannot affect what sites see, cannot substitute for address privacy, and cannot help with anything a VPN addresses. It also tells you what it can do, since the local network is precisely where it is visible.

What the local network learns from it

A stable MAC address makes your device recognisable to every network it joins.

For a home network that is convenient — it is how a router can assign the same device the same address each time, how per-device rules work, and how you identify devices in a router’s client list.

For networks you do not control, it is a tracking identifier. A venue’s Wi-Fi can recognise a returning device even if you never connect, because devices announce themselves while scanning for networks. Chains of venues sharing infrastructure can recognise the same device across locations. That is passive, requires no cooperation from you, and works whether or not you join.

This is the actual problem randomization addresses, and it is a genuine one.

How randomization works

Devices present a fabricated address instead of the hardware one, and vary it.

The behaviour differs by platform and version. Common patterns: a random address while scanning for networks, and a per-network address that stays stable for a given network so things keep working but differs between networks. Some platforms rotate the per-network address periodically; some let you choose per network.

The design goal is to break cross-network correlation without breaking within-network function. A stable-per-network address means your home router still recognises your laptop while a coffee shop cannot match it to the airport’s records.

Most current phones and laptops do this by default. It is worth checking rather than assuming, since the setting can be off, and joining a network with a manually configured address can pin it back to the hardware value.

What it does not hide

Everything above the local link, which is most of what people worry about.

Your IP address. Sites see your public address regardless. That is what a VPN substitutes, per what a VPN hides about your IP address.
Your hostnames. Lookups go to a resolver that sees them all, unaffected — see who runs your DNS resolver.
Your accounts. Signing in identifies you far more precisely than any hardware identifier, and it works across every network and every address.
Your browser characteristics. Fingerprinting operates on what the browser reveals, which has nothing to do with the adapter.
Device names. Devices often announce a human-readable name on the network, and if that name is your own name, randomizing the MAC address accomplishes little. Worth renaming.
Captive portal accounts. If you log into a venue’s Wi-Fi with an email address or room number, you have identified yourself directly and the hardware identifier is irrelevant.

What it does complement

It pairs sensibly with a VPN because they cover adjacent, non-overlapping layers.

On an untrusted network, randomization stops the network operator recognising your device across visits and locations. A VPN stops that same operator reading your traffic and stops sites seeing your address. Together they cover the local-link identity and the network-path visibility, and neither substitutes for the other.

Two practical notes. A kill switch matters more than usual on networks you do not control, because the window between joining and the tunnel establishing is when unprotected traffic goes out. And captive portals need to be completed before a tunnel can come up, which means some traffic to the portal happens outside it by necessity.

Where it causes problems

Randomization occasionally breaks things that depend on recognising a device.

Address reservations and per-device rules on your home router stop matching when the address changes. Fix by disabling randomization for your home network specifically, which most platforms allow.
Networks with device registration — many campus, office, and hotel networks — may not recognise a device that presented a different address last time, requiring re-registration.
Parental controls and filtering keyed to a device stop applying.
Troubleshooting gets harder, since identifying which client in a router’s list is which device is less obvious.

The reasonable configuration is randomization on everywhere by default, off for your own trusted networks where you want the device recognised.

Getting the scope right

Randomization is a defence against being tracked by the physical places you take your device. That is worth having, it is mostly on by default, and it costs almost nothing.

It is not a defence against anything online. If your concern is what websites, your internet provider, or advertisers know, the relevant tools are elsewhere: address substitution, resolver choice, and account hygiene. Reaching for the wrong layer is the mistake to avoid — and the general habit that prevents it is naming the party you want to hide from before choosing a tool, because each layer has exactly one set of observers it can do anything about.