Is it legal to use a Wi-Fi sniffer to count people?

Privacy & Location Technology

How Wi-Fi sniffers count crowds by listening to your phone, why the law has no idea what to do about them, and what that means for everyone walking past

There is a small grey box, roughly the size of a hardcover novel, bolted to a lamppost at the edge of a farmers market. It has no lens. It has no light. It makes no sound. It needs nothing but a power outlet.

It is counting you.

Not with a camera, and not by anything you did. It is counting you because the phone in your pocket is shouting a unique serial number into the air, several hundred times an hour, whether the screen is on or off, whether you are using it or not, and whether you have ever heard of the company on the other end of that box.

This is passive Wi-Fi sensing. It is a fifteen-year-old technique, it is deployed today in shopping malls, airports, stadiums, festivals, downtown business districts and city-run public spaces across the United States, and — with a handful of important exceptions — it operates in an illegal space per the latest state-level privacy regulations in the US.

This piece explains three things: exactly how these devices work, what they are legitimately used for, and why the compliance story most vendors tell about them does not survive contact with the statutes that actually govern.

Part One: Your phone's Wi-Fi is broadcasting your phone's identity

To find Wi-Fi networks, a phone has two options.

It can sit and listen. Access points broadcast a beacon roughly every tenth of a second, so a phone could just wait on each channel until it hears one. This is called passive scanning, and it is slow and expensive on battery.

Or it can ask. The phone transmits a short packet called a probe request — essentially "is anyone out there?" — hops to the next channel, and does it again. This is active scanning, and it is faster and cheaper. So essentially every phone on earth does it, continuously, in the background.

A probe request is not encrypted. It cannot be. Encryption keys are negotiated after a device joins a network, and this packet is what a device sends before it has joined anything. WPA2 and WPA3 protect your traffic once you are on a network. They have no bearing whatsoever on the packets your phone broadcasts while looking for one. Even 802.11w Management Frame Protection — the standard specifically designed to secure Wi-Fi management traffic — does not cover probe requests.

So the packet goes out in the clear, addressed to nobody in particular, and every radio within range receives it.

What is inside it

A probe request carries more than most people would guess:

A source MAC address. Forty-eight bits. The first three bytes are the manufacturer prefix, publicly searchable in the IEEE registry — so before a listener knows anything else, it knows whether you carry an Apple device or a Samsung, and often the chipset family. The remaining bytes identify the specific radio.

A sequence number. A twelve-bit counter that increments with every frame the device sends.

A network name field. Historically, phones would broadcast their entire Preferred Network List — every Wi-Fi network they had ever joined. Your home network's name. Your employer's. The hotel in Lisbon. Modern operating systems have curtailed this, but not eliminated it, and a preferred network list is close to a fingerprint of a life.

Capability information elements. Supported data rates, channel parameters, 802.11n/ac/ax capability bitmaps, extended capabilities, and vendor-specific tags. These sound like harmless plumbing. Hold that thought — they turn out to be the most identifying thing in the packet.

Phones emit between roughly 55 and over 2,000 probe requests per hour, depending on the operating system, whether the screen is on, and whether the device is already connected to something. That is the measured range from Julien Freudiger's study at ACM WiSec 2015, and it is the density that makes minute-by-minute crowd counting practical.

How the sensor listens

A normal Wi-Fi adapter throws away any packet not addressed to it. Put the same adapter into monitor mode and it hands every decoded frame on the channel up to the software, regardless of who it was for — including packets from devices that have never associated with anything.

That is the entire trick. The tooling is free and mature: airodump-ng from the Aircrack-ng suite, bettercap, and above all Kismet, which is effectively the reference implementation of a presence sensor — it logs every device it sees, the networks each one is probing for, the signal strength, and first-seen and last-seen timestamps, straight into a database.

Or you can skip the laptop entirely. Espressif's ESP32 — a Wi-Fi and Bluetooth chip that costs about three dollars — exposes a promiscuous-mode callback in about two hundred lines of Arduino code.

And here is the part that matters most: the sensor transmits nothing.

There is no probe response. No association. No handshake. No packet crosses the air in your direction. Your phone cannot know it happened, your operating system cannot log it, and no setting anywhere on your device will tell you that your Wi-Fi was sniffed and your device was counted.

There is no technical mechanism by which a person can detect that they are being counted, and no protocol-level way to say no.

Everything in Part Three follows from that one sentence.

From a headcount to a history

The physical capture produces rows in a table: an identifier, a sensor, a timestamp, a signal strength. What happens next is ordinary database work.

• Dwell time is last-seen minus first-seen.
• Bounce rate is the share of devices seen for under ninety seconds — people who walked past rather than came in.
• Journeys come from ordering the same identifier across several sensors: a path, and a transition matrix through a space.
• Repeat visitation is the same identifier appearing on Tuesday and again the following Tuesday.
• Cross-venue attribution is the same identifier at a hotel sensor and at a festival sensor — the two events now linked.
• Home and work inference is a classic result in the literature: cluster the times of day at which an identifier appears at particular sensors, and the two dominant clusters are usually where someone lives and where they work.

Notice the escalation, because it is the analytical heart of this whole subject.

A pure headcount needs no identifier at all. You could count distinct signal streams in a ten-second window and throw everything away. Dwell time requires holding an identifier for minutes. Repeat visitation requires holding an identifier that links across days.

Every additional metric on the product page is a longer retention requirement, encoded in the feature list.

One vendor in this space describes it with unusual candour. BlueZoo, which is refreshingly explicit that it does Wi-Fi probe sniffing, puts it this way: "We don't know who owns the phone or why they have visited, but we often know if they've been here before and sometimes where they have come from."

That is an honest description. It is also a description of a persistent behavioural profile attached to a person who was never asked.

How accurate is any of this, really?

Less than the dashboards suggest, and this deserves saying plainly.

The only distance information a passive sensor has is received signal strength. Converting that to metres requires assuming a transmit power you do not know (it varies by phone model and changes dynamically), a path-loss exponent you cannot measure (it is different in a plaza, a hall, and an urban canyon, and it changes as the crowd thickens), and no interference from the fact that a human body attenuates 2.4 GHz by three to eight decibels — so a phone in a front pocket facing you and one in a back pocket facing away look like different distances. Multipath in a crowd swings the reading ten to twenty decibels over sub-metre movements.

Realistic accuracy for locating an unmodified phone by signal strength across multiple sensors is five to fifteen metres. One vendor's own market survey puts Wi-Fi at "zone-level at best."

Then the counting errors. One person carrying a phone, a watch, and a tablet counts as three. Staff and vendors count. Cars passing on the street count. People inside the office building next door count. Devices with Wi-Fi switched off do not count. And — as we are about to see — one phone can count as dozens.

Vendors correct for all of this with proprietary multipliers, calibrated against manual clicker counts. Which means the crowd size on the dashboard is a modelled estimate with an undisclosed correction factor applied. It is not a measurement. That is a fair thing to know before a city cites it in a press release.

Part Two: What was this technology typically used for

It would be dishonest to present this technology as though it existed only to violate people. It does not. The use cases are real, and several of them are genuinely valuable.

Retail. Conversion rate — the share of people who walked past a store and came in — is one of the few metrics that tells a retailer something their point-of-sale system cannot. Queue length, staffing against actual footfall, and window-display effectiveness are all real problems that presence sensing solves.

Events and festivals. Attendance at a free, unticketed, open-footprint event is genuinely difficult to establish. Organisers have historically used visual estimates, gate clickers, and educated guesses — and then had to defend those numbers to sponsors, insurers, and city councils. A sensor gives a defensible number, and the safety case is not manufactured: crowd density in a confined space is a life-safety variable, and knowing it in real time matters.

Transport hubs. Airports and rail stations use presence analytics to predict security queue times, open and close lanes, and manage passenger flow. This is one of the strongest use cases in the category.

Destination marketing and civic planning. Tourism boards and city agencies want to know whether the summer concert series brought people downtown, how long they stayed, and whether the parking is in the right place. Public money is spent against these numbers.

Smart cities. Pedestrian volumes for traffic signal timing, sidewalk widening, and transit planning.

Real estate. Site selection and lease valuation depend on footfall.

And there is a fourth category worth naming, because it is the same technology: penetration testing and surveillance research. The Hak5 Wi-Fi Pineapple, at $250, is sold openly as a wireless auditing tool and does exactly what a commercial presence sensor does, with a friendlier interface for the operator and a less friendly one for the person being observed.

The uncomfortable economics

Here is the price ladder for the same underlying capability:

A functionally equivalent crowd counter costs between three dollars and two hundred and fifty. Commercial deployments run to five figures annually.

What is being sold is not the radio. It is calibration, uptime, deployment logistics, dashboards, someone to call — and, when the customer is a city government, a layer of institutional and legal cover.

That last item is the one that deserves scrutiny.

Part Three: The technology broke in 2020 but vendors continue to mislead

Apple and Google noticed the problem. Their fix was MAC address randomization — instead of broadcasting the real, permanent, factory-burned hardware address, the phone makes up a fake one.

The timeline matters, because the industry's marketing has not caught up with it:

(Version dates should be confirmed against current Apple and Android developer documentation before republication; Apple in particular renumbers its support articles.)

Two things broke, and the second is worse than the first.

First, persistence died — this technology no longer works as advertised. You can no longer follow a device across days or across venues using the address alone. Loyalty and repeat-visit metrics built on raw addresses stopped working. Vendors that continue to use this approach as simply deceiving their customers.

Second — and this is the one nobody advertises — counts are inflated. A phone that rotates its address every few minutes looks like many different phones. Naïve unique-device counting after 2020 can overcount by several hundred percent. Again, vendors that continue to use this approach as simply deceiving their customers.

Every vendor still selling this now applies an undisclosed de-duplication and correction model. When a vendor shows you a crowd counting dashboard that uses this technology, three questions are worth asking: what fraction of the addresses you observed had the randomization bit set? what multiplier did you apply to get to this figure? how did you arrive at the multiplier?

The most telling evidence that this is a real problem comes from the vendors themselves. Cisco Meraki's own documentation states that its dashboard "will be eliminating these MAC addresses from the Location Analytics computation" — Meraki simply filters randomized addresses out, and warns customers that with randomization present, "location analytics may be detecting falsified/anonymous client IDs." Purple now advocates abandoning address-based tracking entirely. Skyfii rebuilt itself around computer vision and rebranded as Beonic. Sensalytics' Wi-Fi product page is gone; its lineup is now cameras and LiDAR. Ariadne has built its entire market positioning on the argument that probe sniffing is broken.

Meanwhile, other vendors advertise having solved randomization. Blix markets an algorithm trained on "over three billion smartphone interactions" specifically to re-identify devices despite it.

Both of those things cannot be true at once. Either randomization works and the counts are unreliable, or it has been defeated and the data is not anonymous. A vendor claiming accurate unique-visitor counts and strong privacy protection in the same breath is claiming to have it both ways.

MAC randomization is a speed bump, not a privacy wall

The academic security literature has been unambiguous about this for a decade.

Vanhoef and colleagues (ACM AsiaCCS 2016) showed randomization defeated through information-element fingerprinting, physical-layer scrambler seeds, and sequence-number continuity — because the frame counter keeps incrementing across an address change, so you simply follow the counter to stitch the old and new identities together.

Martin and colleagues (Privacy Enhancing Technologies Symposium, 2017) demonstrated four attacks, one of them devastating: sending a crafted control frame to a device's real hardware address gets an automatic reply from the Wi-Fi chipset itself, below the operating system layer, confirming the true address. It worked against 100% of devices tested, regardless of operating system, because it defeats randomization in silicon, where the privacy feature does not live. They also recovered true hardware addresses from a Wi-Fi Protected Setup field in 3,187 out of 3,188 attempts.

Matte and colleagues (ACM WiSec 2016) showed that probe requests come in bursts with device-specific timing signatures that survive the address change.

And the most quotable result of all comes from Ansohn McDougall and colleagues (IFIP SEC 2024), who measured how much anonymity the packet actually provides. With the full set of capability information elements included, the largest group of indistinguishable devices contained only 25.78% of devices. Strip everything back to basic supported rates, and 82.55% become indistinguishable.

In other words: it is not your MAC address that makes you trackable. It is the capability fields your phone advertises alongside it. And the researchers showed that stripping them costs essentially nothing in connection speed — the leakage is gratuitous.

Bluetooth is no refuge. Phones use rotating Resolvable Private Addresses, but the payload betrays them: Apple's Continuity and Handoff advertisements leak device type, OS version, and activity state (Celosia & Cunche, PoPETs 2020). When the address and the payload tokens rotate at different times, you bridge the gap and track straight through (Becker, Li & Starobinski, PoPETs 2019). And physical-layer fingerprinting — carrier frequency offset, I/Q imbalance, amplifier nonlinearity — identifies the radio itself, which no software randomization scheme can touch (Givehchian et al., IEEE Security & Privacy 2022).

Worst of all: AirPods, smartwatches and fitness trackers frequently do not implement address rotation properly. After 2020, a wearable is often the only stable identifier in the room — which is precisely why hybrid sensors keep a Bluetooth radio switched on.

"We don't collect personally identifiable information"

This sentence, or a close variant, appears on nearly every product page in this category. It can be literally true and still deeply misleading, and understanding why requires separating three things that vendor language deliberately collapses.

Stage one: collection, at the antenna. The sensor necessarily ingests raw frames containing unique per-device identifiers, capability fingerprints, sequence numbers, timestamps and signal strengths. This is unavoidable. No architecture can count distinct devices without first observing distinct devices. It is the input to the algorithm.

Stage two: retention, in the pipeline. Here the vendor makes choices. Hash the identifier? Salt and rotate the hash? Genuinely discard it? Any product that reports dwell time must retain an identifier for the length of a visit. Any product that reports repeat visitation must retain an identifier that links across days.

Stage three: reporting, out of the dashboard. Aggregates only. Counts, curves, heat maps. This is where "we only produce anonymous aggregates" and "cannot be used to trace individuals" are true statements — about the output.

"PII" is doing enormous work in that sentence "We don't collect personally identifiable information". In the narrow American marketing sense, PII means name, address, email, social security number. A MAC address is none of those. So "we do not collect PII" can be perfectly accurate while the system holds a permanent hardware serial number attached to a record of where your body has been.

But that narrow sense is not what the law uses. European law names device identifiers as personal data explicitly, and holds that hashing is pseudonymisation — not anonymisation. California enumerates "device identifier" in its definition of a unique personal identifier. Most American state privacy statutes define personal data as anything "reasonably linkable" to an individual, and several define de-identified data specifically to exclude anything linkable to "a device linked to that individual."

And then there is the hashing defence, which the literature has already dismantled. A MAC address is 48 bits. Given a manufacturer prefix, the remaining search space is about 16.8 million possibilities — brute-forcible on a laptop in seconds. An unsalted hashed MAC address is fully reversible (Demir, Kumar, Cunche & Lauradoux, IEEE Communications Surveys & Tutorials, 2018).

The honest formulation is this: the output can be aggregate while the input is a stream of unique persistent device identifiers, and the entire privacy question is what happens in between — which almost no vendor in this category discloses in enough detail for anyone to audit.

A claim that could actually be verified would specify: what identifier is retained, hashed with what algorithm, using what salt, rotated how often, retained for how long, and whether raw captures are ever written to disk.

Very few product pages come close.

Part Four: The hole in US federal law that remains to be patched

Here is the finding that surprises most people, including most privacy lawyers on first pass.

Under US federal law, passive Wi-Fi sniffing in public is not unlawful — for uncomfortable reasons.

The Wiretap Act does not reach it

The federal Wiretap Act prohibits intercepting the contents of an electronic communication. "Contents" is defined as information concerning the substance, purport, or meaning of a communication.

In In re Zynga Privacy Litigation (9th Cir. 2014), the Ninth Circuit held that "contents" means "the intended message conveyed by the communication," and specifically excludes record information generated in the course of transmission — names, addresses, subscriber identities. Its most useful line: "an allegation that Facebook and Zynga disclosed personally identifiable information is not equivalent to an allegation that they disclosed the contents of a communication."

A MAC address in a probe request is a hardware identifier in a header field doing nothing but addressing. Under Zynga, it is not contents. No contents, no interception, no violation.

There is one important caveat, and it is a design decision rather than a legal accident. The Third Circuit has rejected any categorical rule, holding that the line between content and metadata is contextual. That does not endanger a bare MAC address. But it squarely endangers the network names a phone probes for — because the Preferred Network List reveals your home network, your employer, the hotels you have stayed at, and the clinics whose guest Wi-Fi you once joined. That is arguably substantive information about you, not routing information for the packet.

Capture the address; do not keep the network names. It is the single technical choice in this entire field with the most legal significance.

(A widely repeated citation needs correcting here. Many summaries state that the Ninth Circuit held unencrypted Wi-Fi is not "readily accessible to the general public." That analysis appeared in the September 2013 opinion in Joffe v. Google — and was removed on rehearing in December 2013. The surviving holding is narrowly definitional. The frequently cited "794 F.3d 1067" does not exist; those digits belong to the district court's F. Supp. 2d cite. Verify these reporter pages before relying on them.)

Neither does the Computer Fraud and Abuse Act

A passive receiver never accesses your phone. It receives a signal your phone broadcast into free space. There is no entry, no command, no interaction. Van Buren v. United States (2021) adopted a "gates-up-or-down" test for unauthorized access, and a broadcast probe request is the paradigm of a gate that is wide open. hiQ v. LinkedIn (9th Cir. 2022) confirmed that collecting publicly available data is not unauthorized access.

But there is a bright line here, and it is worth naming. Everything above assumes genuinely passive reception. A sensor that transmits deauthentication frames to knock devices off networks and force them to re-probe, or that stands up a rogue access point to elicit responses, is sending instructions to someone else's device. That is arguably access, it independently violates the federal prohibition on interfering with radio communications — the basis of the FCC's Wi-Fi-blocking enforcement against Marriott — and it may constitute an interception the passive case avoids.

Passive listening is legal. Active elicitation is not. The distinction is invisible from outside the box.

The FCC looked at this and walked away

In 2012 the FCC issued Google a $25,000 forfeiture over the Street View Wi-Fi collection. That penalty is routinely miscited as an agency finding that Wi-Fi interception is unlawful.

It is the opposite. The $25,000 was for obstructing the investigation — refusing to produce employee emails, withholding sworn declarations across five separate demands. On the substantive question, the Enforcement Bureau expressly declined to find a violation, stating flatly: "There is no Commission precedent addressing the application of Section 705(a) in connection with Wi-Fi communications."

The agency with primary jurisdiction over radio communications examined unencrypted Wi-Fi interception in 2012 and declined to act. It has issued no ruling since.

The FTC took Nomi to task for Wi-Fi sniffing

The US enforcement action against a passive MAC-address analytics company: the FTC's 2015 case against Nomi Technologies.

Nomi placed sensors in about forty-five retail clients' locations, detecting the MAC address broadcast by phones searching for Wi-Fi. It hashed the addresses before storage. It tracked roughly nine million unique devices in the first nine months of 2013.

The FTC brought two counts, both for deception:

• Nomi's privacy policy promised consumers could opt out "at any retailer using Nomi's technology." No in-store opt-out existed.
• Nomi promised consumers would be notified when a store was using the service. No notice was given.

The FTC has not been idle since 2015 —between 2024 and 2026 it brought a wave of location-data cases against X-Mode/Outlogic, InMarket, Gravy Analytics/Venntel, Mobilewalla, and Kochava.

Two of those matter enormously here.

In Mobilewalla, the FTC alleged it was an unfair practice to collect and retain data harvested from advertising exchanges even on auctions the company did not win. The structural parallel is close: data is broadcast into an environment for one purpose, and a third party with no relationship to the consumer harvests it for an entirely different one.

In Kochava, a federal court held that invasion of privacy is a standalone substantial injury, and — critically for anything operating at street scale — that "an act or practice can cause substantial injury by doing a small harm to a large number of people."

Every doctrinal component needed to bring an unfairness case at the federal level against silent MAC sniffing now exists. It has simply never been fired. And the strength of such a case would turn almost entirely on where the sensors are rather than on the technology: a single retail store with short retention is a weak case; a network reconstructing movement across a city, crowded events within a city, sensors near clinics, houses of worship, shelters, or protests, is a strong one.

Which brings us to the states.

Part Five: The states are where this falls apart

Federal law has a hole. Several states have filled it — and a few have done so with language that names this technology directly.

First principle: your MAC address is personal data

Every US state with a comprehensive privacy law treats device identifiers as personal data. California's statute enumerates "device identifier" by name in its definition of a unique personal identifier, and reaches identifiers that recognise "a device that is linked to a consumer" — it does not require knowing who the human is. Most other states define personal data as anything "reasonably linkable" to an individual, and define de-identified data to exclude anything linkable to "a device linked to that individual."

The obvious defense is randomization: if the address rotates every few minutes, is it really "persistent"?

It is a real argument, and it fails for three reasons.

First, a meaningful minority of devices still emit stable hardware addresses — older phones, IoT devices, and any device already connected to a network, including the venue's own guest Wi-Fi.

Second, the moment a vendor defeats randomization through fingerprinting — which is the entire selling point of the "we solved randomization" products — it lands inside California's definition of a probabilistic identifier, meaning identification "to a degree of certainty of more probable than not." That is expressly personal information.

Third, and decisively: the commercial value proposition of dwell time, repeat visitation and cross-venue journeys is re-identification across time.

You cannot simultaneously sell "unique visitors" and "repeat visitation" and argue that the identifier is not persistent. The more effective the product is at its stated purpose, the more certainly its inputs are regulated personal data. Randomization is a defence only for a system that does not work.

California: precise geolocation, and a notice requirement nobody can satisfy

California classifies precise geolocation as sensitive personal information, defining it as locating someone within a circle of radius 1,850 feet.

A sensor with a 250-foot range resolves a device to roughly one fifty-fifth of that area. The argument that presence sensing is not precise geolocation is simply unavailable.

The "we only report aggregates" defence fails at the threshold, for a reason that catches people out. California defines "collect" to include obtaining personal information "by any means," and expressly includes receiving information passively. The moment the sensor ingests the address — in RAM, before hashing, for microseconds — collection of personal information has occurred, and the notice, purpose-limitation and sensitive-data obligations all attach at that instant. Aggregating afterwards is downstream mitigation, not a jurisdictional escape.

And the statute's de-identification safe harbour has three affirmative conditions: reasonable technical measures, a public commitment never to re-identify, and contractual obligations flowed down to every recipient — the venue, the city, every downstream partner. Failing the second or third alone forfeits the harbour even if the mathematics is sound.

Then there is notice. California requires notice at or before the point of collection, and the regulations' illustrative offline method is signage. That rule was written for a checkout counter, where a customer chooses to approach and can read the sign before handing anything over.

Signage cannot plausibly discharge that duty for a sensor on a lamppost detecting devices at 250 feet — because a large share of the devices it detects belong to people who never came within reading distance of any sign, or who passed on the far side of the street, or who were inside a bus.

No regulator has resolved this. But the burden sits on the business to show it gave notice to the population it actually sensed, and that burden cannot be discharged.

Two live obligations are worth flagging: since January 2026, processing sensitive personal information triggers a mandatory risk assessment under California's new regulations — which means any Wi-Fi sensing deployment in California requires one. And under the DELETE Act, a company that collects and sells data about consumers with whom it has no direct relationship is a data broker; a sensor company has no relationship with anyone it senses. Broker registration and processing of deletion requests through the state's DROP platform became mandatory on 1 August 2026, with penalties accruing at $200 per day.

There is also a low-probability, catastrophic-severity tail risk. California's wiretap statute contains a pen register and trap-and-trace provision — prohibiting any process that captures "addressing and signalling information reasonably likely to identify the source" of an electronic communication — carrying $5,000 per violation with no injury requirement. A wave of litigation has tried to apply it to website tracking scripts, with mixed success, because a website is an awkward fit for a statute about communications facilities.

A Wi-Fi probe-request sniffer is not an awkward fit. It is a process that captures incoming electronic impulses; those impulses are management frames; the source address is quintessential source-identifying signalling information; and it captures headers and not contents — which is exactly the pen-register category rather than the wiretap category. Arguably it is the most textually perfect trap-and-trace device deployed in American commerce. Nobody has tried it yet, and the courts are currently moving against plaintiffs on the website cases, but $5,000 per person for everyone who walked past a downtown sensor is not a number anyone wants to model.

Washington: the state that named the technology

Washington has no comprehensive privacy law. It has something sharper.

The My Health My Data Act defines "consumer health data" to include "precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies" — and, critically, any information processed to associate a consumer with health status "derived or extrapolated from nonhealth information… including algorithms or machine learning."

You do not have to intend to collect health data. "Device X was at these coordinates at this time" is nonhealth information. If it can be extrapolated to "device X visited a methadone clinic," the statute converts it into consumer health data automatically.

And then there is the geofencing prohibition, which reads as follows:

"It is unlawful for any person to implement a geofence around an entity that provides in-person health care services where such geofence is used to: (1) Identify or track consumers seeking health care services; (2) collect consumer health data from consumers; or (3) send notifications, messages, or advertisements to consumers related to their consumer health data or health care services."

And the definition that supplies the scope:

"'Geofence' means technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, Wifi data, and/or any other form of spatial or location detection to establish a virtual boundary around a specific physical location, or to locate a consumer within a virtual boundary… a virtual boundary that is 2,000 feet or less from the perimeter of the physical location."

Four things make this the most dangerous single provision in American law for this business model.

"Wifi data" appears in the statute. This is not an analogy or a strained reading. The Washington legislature expressly listed Wi-Fi-based spatial detection as geofencing technology.

"Any person." Not "regulated entity." No small-business exemption, no revenue floor, no consumer-count threshold. One sensor, one operator.

2,000 feet from any entity providing in-person health care services. In a downtown core, that approaches blanket coverage — every clinic, urgent care, dentist, and hospital projects a 2,000-foot circle.

There is no consent defence. Other sections of the act have consent exceptions. This one does not. It is a flat prohibition conditioned only on purpose — and the only available defence requires proving a negative about a system whose entire function is detecting people within a boundary.

Washington also did something structurally unusual: it declared that violating the act is per se an unfair or deceptive practice under the state consumer protection act. That legislatively establishes three of the five elements a plaintiff would otherwise have to prove, leaving only injury and causation — and it opens the door to actual damages, treble damages, and attorney's fees. It is the only statute of its kind in the country with a private right of action.

Two MHMDA class actions have been filed so far, both against app SDKs and web pixels. None has yet been brought against a physical sensor. Given that the statute names "WiFi data," that is a gap in the case law, not a gap in the statute.

Nevada enacted a close analogue in 2024, including its own geofencing ban — without a private right of action. And California joined the club with a law operative from January 2026 that prohibits deploying a geofence — defined, technology-neutrally, as "any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual's presence within, a precise geolocation" — around health care facilities, carrying civil penalties up to $25,000 per violation plus a private right of action for treble damages.

Three states have now prohibited proximity-based location detection around health facilities, technology-neutrally, two of them with private rights of action. This — not comprehensive privacy law — is where American law has actually named and outlawed the thing these sensors do.

Texas: no threshold, and no way to get consent

Texas's privacy act has no revenue threshold and no consumer-count threshold. It applies to anyone doing business in Texas who processes personal data and is not a federally defined small business. California exempts companies below $25 million in revenue and 100,000 consumers. Texas exempts almost nobody.

A mid-sized analytics company deploying ten sensors in Austin is covered on day one. Texas is the broadest-applicability comprehensive privacy law in the country.

It classifies precise geolocation — defined at 1,750 feet — as sensitive data, and prohibits processing sensitive data without consent, defined as "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement," and expressly excluding acceptance of general terms.

There is no mechanism by which a person walking down Congress Avenue performs a clear affirmative act consenting to a lamppost sensor. Signage is notice, not an affirmative act. Ticket terms are general terms, expressly excluded. Hashing does not help — Texas's definition of pseudonymous data relieves controllers of some obligations but does not remove the data from the statute's scope.

This is a harder wall than California's notice problem, and Texas has the most aggressive privacy enforcement operation in the country: a dedicated enforcement team since 2024, a $1.4 billion biometric settlement with Meta, a $1.375 billion settlement with Google, and — in January 2025 — the first enforcement action ever brought under any state comprehensive privacy law, against Allstate and its subsidiary Arity, over an SDK that passively collected precise location from roughly forty-five million Americans' phones and sold it.

Substitute "sensor" for "SDK" and that complaint reads the same. It also establishes that Texas will pursue the upstream data supplier, not merely the consumer-facing app.

Maryland: on the text, a prohibition

Maryland's law, effective October 2025, contains a data-minimization standard unlike any other state's. Collection of personal data must be:

"limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer."

Every other state ties necessity to purposes the controller chooses. Maryland ties it to a product or service the consumer affirmatively requested.

A person walking past a sensor has requested nothing. There is no product, no service, no request. Under Maryland's text there is no quantum of personal data about a non-requesting passer-by that satisfies the standard, because the denominator is zero.

And Maryland's minimization rule is not consent-waivable — its signature departure from the rest of the country. Sensitive data may not be collected except where strictly necessary for a requested service, and may not be sold at all.

On the text, Maryland is a prohibition on commercial ambient sensing of identifiable devices. It is not a compliance-cost problem. It is a legality problem.

The statute is uninterpreted by any court, and vendors will press the argument that the venue's request suffices. That reading is probably wrong, since "consumer" is defined as an individual acting in an individual capacity — but it is the fight that is coming.

The machinery does not fit

Colorado was the first state to require companies to honor universal opt-out signals — the Global Privacy Control, transmitted by a browser, which a company must detect server-side and propagate downstream.

A pedestrian cannot transmit anything to a lamppost.

This is not a Colorado quirk. It is the general condition, and it is the most important structural observation in this entire piece:

The entire architecture of American privacy law — notice at collection, informed consent, opt-out mechanisms, rights requests, universal opt-out signals — presupposes an interactive channel between the person and the company. Passive physical sensing has no such channel. This is not a hard compliance case. It is a category the statutory machinery cannot process.

"MAC address is broadcast in public, so it's publicly available information" does not work either. The statutory exemptions are about provenance, not interceptability: information from government records, or that the consumer made available, or that appeared in widely distributed media.

A phone emits probe requests through autonomous firmware behavior. The human being neither knows nor decides. Radio emission is not disclosure. And a 2.4 GHz management frame with a 250-foot range, existing for microseconds, received by one sensor, is not media and is not a record. It is closer to the sound of a person's footsteps than to a published directory.

State attorneys general have already treated passive Wi-Fi collection as actionable: the Google Street View matter produced a $7 million settlement with 38 states and the District of Columbia in 2013.

And if the customer is a city

This last point matters more than almost anyone in the industry accounts for, because a large share of these deployments are bought by tourism boards, business improvement districts, transportation departments and parks agencies.

A dozen or more American cities — Seattle, San Francisco, Oakland, Berkeley, Portland, Nashville, New Orleans, Cambridge, Boston and others — have surveillance technology ordinances. They bind government agencies, not vendors. But when a city department deploys or funds a sensing network, the deployment is the regulated act.

Those ordinances typically define surveillance technology as anything "capable of collecting, capturing, recording, retaining, processing, intercepting, analyzing, monitoring, or sharing audio, visual, digital, location, thermal, biometric, olfactory, or similar information specifically associated with, or capable of being associated with, any individual or group."

Note the word capable. The standard vendor argument — "it's anonymous, so it isn't surveillance" — fails under these ordinances specifically, because the definition turns on capability, not on what the vendor does with the data afterwards. A sensor that can read a MAC address is capable, full stop. That is a materially harder standard than the state statutes' "reasonably linkable."

In Seattle, which has the most demanding regime, deploying such a system requires a Council-approved Surveillance Impact Report including a racial equity assessment and a public comment period — before acquisition, and again before any new use of existing technology.

For a vendor, this means procurement timelines of six to eighteen months rather than weeks, and full public disclosure of the system's capabilities, data flows, retention periods and error rates in a permanent public record. Your impact report in one city becomes the opposition's exhibit in the next.

It is also, almost certainly, where the first serious public controversy in this industry will originate — because the impact-report process is designed to generate public debate.

Part Six: So what is the actual harm?

It is worth being precise here, because the strongest objection to everything above is: it's just a headcount. Nobody knows who I am.

That objection is right about intent and wrong about structure. Five things follow from the architecture regardless of anyone's intentions.

One: the identifier is more persistent than anything else attached to you. A hardware MAC address survives clearing cookies, resetting your advertising ID, deleting apps, reinstalling the operating system, changing your phone number, and factory-resetting the device. It is strictly more durable than every tracking identifier that consumers have been taught to manage. Randomization has substantially mitigated this — for phones. Your watch and your earbuds frequently still emit a stable address.

Two: you cannot detect it, and you cannot decline. There is no light, no notification, no log entry, no permission prompt, and no protocol-level opt-out. The one opt-out the industry ever built required consumers to submit their real hardware address to a central registry — which is both self-defeating and largely meaningless now that most phones no longer broadcast one. Whether that registry is even still operating is itself unclear.

Three: the sensitivity is entirely a function of siting, and siting is invisible to you. A sensor at a farmers market measures how many people bought vegetables. The identical sensor, with identical firmware and identical marketing copy, positioned 300 feet from a methadone clinic, an immigration law office, a union hall, a mosque, an abortion provider, or a protest, produces a list of devices that were at those places. The device does not know the difference. The data does not know the difference. Only the person who chose the mounting location knows. This is exactly why three states now regulate proximity to health facilities rather than regulating the technology.

Four: aggregation is a policy choice, not a physical property. The raw capture is always individual. Whether it stays that way depends entirely on retention configuration, salt rotation, contractual terms with the venue and the city, and the vendor's business model — all of which can change next quarter without anyone outside the company knowing. The claim "we only produce aggregates" describes today's software configuration, not a constraint of the technology.

Five: it composes. One sensor is a headcount. A network of sensors across a downtown is a mobility graph. Joined against a mobile advertising panel — which is exactly what several vendors in this space explicitly offer, pairing sensor counts with panel-derived origin, demographic and spending data — it becomes something with a much older name.

And there is a sixth thing, which is not about data at all.

Presence sensing in public space is a civic decision that is currently being made by procurement. Whether a city logs the passage of everyone who walks down its main street is the kind of question that ought to be settled in public, by people who were elected, after argument. In most of the country it is instead settled by a line item in a tourism board's annual budget, described in the vendor's language, approved by people who have not been told what radio the box contains — because in most cases the vendor does not say.

What cities, counties, and states should actually ask their vendors

If you buy this technology, deploy it, regulate it, or simply want to know what is on the lamppost outside your building, these are the questions that produce real answers. They are deliberately specific, because vague questions get vague answers.

On the technology

1. Does the device capture 802.11 probe requests, Bluetooth LE advertisements, or both?
2. Does it ever transmit on the sensing path — deauthentication frames, probe responses, or an access point of any kind? (This is the passive/active line, and it is the one place where "definitely legal" becomes "definitely not.")
3. Are probed network names — the Preferred Network List — captured or retained at any point?

On the data

1. Is the raw device address written to persistent storage at any point? For how long?
2. Is it hashed? With what algorithm, and what salt? Is the salt rotated, and is the old salt destroyed?
3. Does aggregation happen on the device before anything is written or transmitted, or in the cloud after upload? These have completely different legal consequences.
4. Do dwell time or repeat-visitation metrics require an identifier that persists across sessions or across days? (If the product reports repeat visitors, the answer is yes, and the "fully anonymous" claim needs revisiting.)

On accuracy

1. What percentage of observed addresses had the randomization bit set?
2. What correction factor or multiplier was applied to reach the published crowd number, and how was it calibrated?
3. What is the margin of error, and has any independent party ever validated it?

On siting and compliance

1. Is there a proximity screen against health care facilities at the site-selection stage? (1,850 feet in California and Colorado; 2,000 feet in Washington and Nevada.)
2. What notice is given to people in range, and what fraction of detected devices belong to people who could plausibly have seen it?
3. Is the vendor registered as a data broker where required, and is it processing deletion requests?
4. Does the deploying city have a surveillance technology ordinance, and has the review been completed?
5. Does the vendor's published privacy policy actually describe the sensor? This one is easy to check and is failed startlingly often — many privacy policies in this category describe a mobile-data-panel business and never mention radio sensing, Wi-Fi, Bluetooth, or MAC addresses at all.

If a vendor cannot answer questions 1, 4, 5 and 8 specifically and in writing, the honest conclusion is that nobody outside the company knows what the device does — which means no one, including the vendor's customers, is in a position to say whether it complies with anything.

The bottom line

Passive Wi-Fi sensing is not a scandal. It is a legitimate measurement technology with real uses, sold mostly by people with ordinary commercial motives, solving problems that genuinely need solving.

It is also a technology that:

• collects a persistent unique identifier from every person in range,
• provides no way to know it is happening and no way to refuse,
• is described to the public in terms ("we don't collect PII") that are technically defensible and substantively misleading,
• has been quietly broken by mobile operating system changes in ways vendors rarely disclose,
• sits almost entirely outside federal law, under a precedent that actively punishes vendors for being specific about privacy,
• and is now flatly prohibited in several states in circumstances that are hard to avoid and easy to trip over accidentally.

The most useful thing to understand about this technology is not that it is dangerous. It is that the safeguards everyone assumes exist — notice, consent, opt-out, the ability to say no — structurally cannot exist for a device that only listens.

That is not a gap someone forgot to fill. It is what happens when a legal regime designed around a conversation between a person and a company gets applied to a box on a pole that never speaks.

This piece draws on peer-reviewed security research (PETS, ACM WiSec, AsiaCCS, IEEE S&P), FTC enforcement records, state statutory text, and vendor documentation. Legal citations were verified where primary sources were reachable; several remain unverified and are flagged as such in the accompanying research file. Nothing here is legal advice — anyone deploying or regulating this technology should have counsel review the specific statutes in the specific jurisdictions where sensors will sit, because in this field the answer genuinely does depend on the address.