What Passive Wireless Scanners Can Learn About Your Devices

The phrase “your phone broadcasts constantly” is memorable, but it needs qualification. A modern phone does not transmit the same identifier in every place all day. Apple and Android have added address randomization and other safeguards specifically to make passive correlation harder. The radio environment also includes watches, earbuds, vehicles, tags, laptops, access points, and sensors, each with different behavior.

The useful privacy question is therefore not whether a scanner can see “you” in one packet. It is what a collector can observe, how reliably observations can be linked, and whether a second data source connects a temporary radio pattern to a customer, account, vehicle, or place.

What “passive” scanning means

A radio receiver can listen without joining a network or pairing with a device. In Bluetooth Low Energy terminology, a passive scanner receives advertising packets without sending scan requests. The Bluetooth SIG’s Low Energy primer distinguishes this from active scanning, where a scanner replies to request more information. Because a truly passive receiver does not need to transmit, its presence cannot be proven merely by looking for a reply over the same radio channel.

“Passive” describes collection behavior, not what happens afterward. A sensor may forward observations over Ethernet, cellular, Wi-Fi, or another backhaul. Software may then deduplicate records, compare signal levels, estimate visits, or join observations with events such as an app check-in. The receiver can be quiet toward the device being observed while still participating in an active data system.

This distinction is why ordinary malware language is misleading. No password has to be guessed and no encrypted message has to be opened for a receiver to record the existence and timing of a radio transmission intended for discovery.

What a Bluetooth scanner can observe

Bluetooth LE devices use advertising for discovery and connectionless communication. Advertising packets are generally intended to be received by scanning devices in range. Depending on the packet and device, the payload may expose items such as service identifiers, manufacturer-specific data, a local name, capability flags, or application data. It also arrives with receiver-side context such as a timestamp, channel, and received signal strength.

That does not mean every advertisement contains a stable serial number. Bluetooth supports private-address mechanisms, and operating systems often restrict what applications can advertise in the background. Payloads, addresses, intervals, and behaviors vary. A pair of earbuds, a beacon, a watch, and a phone app may produce very different records.

A scanner can nevertheless construct an observation like: “a device advertising this service pattern appeared at 8:12 a.m., was strongest near sensor B, and disappeared at 8:27.” Repeating that process can support visit and movement estimates. Multiple receivers can compare signal strength, but signal strength is affected by walls, bodies, antenna orientation, congestion, and transmit power. It is not a ruler and should not be presented as exact location.

The combination of devices may matter more than one address. A phone, watch, and earbuds that often arrive together create a recurring co-presence pattern. Linking that pattern reliably is a probabilistic task, especially as addresses rotate and devices sleep, but aggregation gives an analyst more opportunities than a single packet provides.

What a Wi-Fi observer can see

Wi-Fi privacy depends heavily on whether a device is disconnected, attempting to join, or associated with a network. During discovery, clients may scan for access points. When associated, the access point necessarily handles traffic from a network address for that connection. Network operators may also have account, captive-portal, DHCP, authentication, and application-layer records that a receiver outside the network would not possess.

Apple says supported devices randomize the MAC address used for unassociated scans and also randomize fields that previously offered correlation opportunities. Android’s platform documentation says devices have used randomized addresses while probing for new networks since Android 8, with connected-network randomization enabled by default starting in Android 10. These are substantial protections against the older practice of following one factory MAC address through many locations.

Connected Wi-Fi is a separate context. A device needs an address on the network, even when that address is private and unique to the network. The operator may be able to measure connection time, access-point changes, and traffic metadata under its policies. Encryption can protect content in transit while still leaving operational metadata visible to the network providing the connection.

Separate direct observations from inferences

Responsible analysis labels the difference between a captured field and a conclusion. A timestamp is an observation. “This person entered the store” is an inference that depends on sensor placement, range, and whether the device belongs to the person assumed. A strong signal is an observation. “The device was three meters away” is usually an estimate requiring a model and environmental assumptions.

Common inferences include approximate presence, dwell time, repeat visits, paths between sensors, and co-occurring devices. Identity normally requires another link: logging into venue Wi-Fi, using a loyalty app, entering an email in a captive portal, making an attributed purchase, or matching data through another system. The quality and lawfulness of that link matter as much as the radio collection itself.

What modern privacy protections change

Address randomization raises the cost of following one device across unrelated places. Platform restrictions can reduce background transmissions or remove identifying fields. User permissions can restrict application access to Bluetooth, local networks, and location. Encryption prevents a casual receiver from reading protected content simply because it captured radio frames.

None of these controls creates universal radio silence. Some products advertise because discovery is their purpose. A phone may communicate differently while connected than while unassociated. Older devices, disabled privacy settings, managed enterprise profiles, accessories, and implementation defects can change the result. Other observation channels—cameras, payment records, app accounts, cellular systems, and vehicle records—also remain separate.

This is why blanket claims on either side are unreliable. It is wrong to say a modern randomized address is the same permanent tag used a decade ago. It is also wrong to conclude that all passive observation disappeared once operating systems introduced randomization.

Practical ways to reduce unnecessary exposure

1. Keep private-address features enabled. Review the privacy setting for each Wi-Fi network rather than disabling it to satisfy outdated network equipment.
2. Turn off radios you are not using. Use the operating system’s full settings controls when you need a radio disabled; quick controls may behave differently by platform.
3. Review permissions. Remove Bluetooth, nearby-device, local-network, and location access from apps that do not need it.
4. Be deliberate about venue Wi-Fi. Joining and signing in can create a much clearer relationship than remaining an unassociated passerby.
5. Inventory accessories. Watches, tags, earbuds, cars, and other devices have their own software and privacy behavior.
6. Demand clear policies. Ask venues what sensors collect, whether data is aggregated or linked, how long it is retained, and how to opt out.

Flock Block is designed as an additional wireless layer: it adds decoy Bluetooth and 2.4 GHz Wi-Fi activity and may alert on compatible scanner signatures. It does not erase real transmissions, identify every passive receiver, or replace platform privacy settings. Read the product’s threat-model boundaries before deciding whether that layer fits your concern.