Can Stores Track Your Phone With Bluetooth or Wi-Fi?

Retailers have long counted visitors, timed checkout lines, and compared store layouts. Wireless measurement added a way to estimate how devices move through a space. The Federal Trade Commission held a public seminar on mobile-device tracking in 2014, when many systems relied heavily on the stable Wi-Fi MAC addresses broadcast while phones searched for networks. Apple and Android later introduced broader randomization specifically to reduce that form of persistent observation.

The old description is therefore historically important but technically incomplete today. A current privacy assessment should identify the exact collection method, the device state, whether the customer opted into an app or network, and how observations are linked.

Four different systems often called “store tracking”

1. Passive Wi-Fi or Bluetooth observation

A receiver listens for discovery or advertising traffic already emitted by nearby devices. It can timestamp observations and record receiver-side signal strength. Multiple sensors can estimate that a device pattern moved between zones. With modern address randomization, linking observations across time or stores is more difficult than it was when one factory address appeared everywhere.

2. Store Wi-Fi analytics

When a phone joins a network, the network must manage that connection. The operator can ordinarily see association time, access point, connection quality, and traffic-management metadata. A captive portal may request an email, phone number, loyalty login, or acceptance of terms. At that point the store may have a direct identity link that a passive receiver lacks.

3. Bluetooth beacons and store apps

Many beacon deployments reverse the direction assumed in casual explanations. A beacon broadcasts an identifier, and an app on the customer’s phone detects it. If the app has the necessary permissions and account context, the system can associate a place or proximity event with that account. The store is not necessarily listening for the phone over Bluetooth; the phone’s app may be reporting that it heard the store’s beacon.

4. Camera, transaction, and account data

Footfall cameras, point-of-sale records, loyalty programs, mobile ad identifiers, and app analytics are separate channels. Combining them can turn an otherwise ambiguous device observation into a more confident profile. A store may call the result “omnichannel analytics,” but the privacy consequences depend on exactly which systems are joined and under what notice or consent.

What a store may be able to learn

Depending on its sensors and data, a retailer may estimate visitor counts, repeat visits, dwell time, movement between departments, queue length, and conversion from visit to purchase. These are not equally reliable. Counting transient randomized identifiers may overcount. A phone left in a vehicle may undercount. Employees, multiple devices, radio range through walls, and people without discoverable devices introduce noise.

Signal strength can help distinguish broad zones when receivers are calibrated, but it does not give a universal exact coordinate. A human body can attenuate 2.4 GHz signals. Shelving and walls reflect them. Devices use different transmit powers. Any claim that a single received-signal number proves a precise path should be treated cautiously.

Some systems aggregate records quickly and retain only counts. Others preserve device-level events for longer periods. Those choices are policy decisions, not unavoidable properties of Bluetooth or Wi-Fi. The same sensor can support a lower-risk aggregate design or a more intrusive history depending on configuration.

When a radio observation becomes connected to a person

A temporary address is not a customer name. Identity can enter through a captive-portal sign-in, loyalty-app session, digital receipt, mobile order, location-enabled store app, or another event. Correlation can also be probabilistic: a group of devices appears near one checkout at the same time as a known transaction. Good governance should distinguish a deterministic account link from a statistical guess.

Disclosure should also state whether a vendor receives the data, whether observations are used only for operations, whether they support advertising, and whether records are shared across locations or clients. “Anonymous” deserves scrutiny. Removing a name is not the same as preventing a record from being singled out, linked, or reidentified through another dataset.

How modern phones changed passive retail tracking

Apple says its platforms use randomized MAC addresses for unassociated Wi-Fi scans on supported devices and randomize other low-level values that could otherwise support correlation. Its current Private Wi-Fi Address controls also use per-network addresses, with rotating behavior by default on weak or open networks on recent systems.

Android’s open-source documentation says devices use randomized addresses while probing for new networks starting with Android 8, and Android 10 enables randomization by default in connected client mode. Implementations and managed-device settings can vary, but the direction is clear: a store should not assume it sees the phone’s permanent factory Wi-Fi address in ordinary modern scanning.

Bluetooth has its own privacy mechanisms and application rules. Advertising still exists because discovery and broadcast use cases require it. Payloads and address behavior vary by accessory, app, operating system, and state. A privacy evaluation must test current devices rather than reuse claims from early retail-tracking deployments.

Seven questions a store or vendor should answer

1. What radio traffic or app event is collected? Name the protocol, fields, and device state.
2. Is the system passive, app-based, network-based, or combined? These create different records.
3. What is calculated? Explain how visits, paths, or dwell time are inferred and validated.
4. What creates an identity link? Identify captive portals, loyalty accounts, app sessions, or data joins.
5. How long is raw event data retained? Separate raw records from aggregate counts.
6. Who receives the data? Include analytics vendors, advertising partners, and other locations.
7. What choice does a visitor have? Describe notice, opt-out, deletion, and a way to shop without joining Wi-Fi or installing an app.

Practical choices for shoppers

Keep operating systems updated and leave private-address settings enabled. Review whether store apps need precise or background location. Remove Bluetooth or nearby-device permission when it is unnecessary. Avoid signing into venue Wi-Fi if the benefit is not worth the account link, and read the portal terms before submitting contact information.

Turning off an unused radio reduces that radio’s activity, but the exact control matters. Platform quick settings may temporarily disconnect rather than fully disable a radio. Accessories and vehicles also have independent radios. Cameras, transactions, cellular records, and app accounts remain separate even when Bluetooth and Wi-Fi are quiet.

Flock Block is designed to add decoy Bluetooth and 2.4 GHz Wi-Fi activity around the devices a user carries. That may reduce the usefulness of some passive observation, but it cannot undo an app login, captive-portal identity link, camera record, or purchase history. Start with the system’s threat model, not a promise of universal invisibility.