Your phone can reveal you to networks it never joins.

Picture a Tuesday. You wake up on your home network, catch the train, stop at a café, work at the office, walk the mall at lunch, and drive home. You never do anything you would call risky. Along the way your phone and your home give a handful of companies, and a few strangers, pieces of a picture: when the household wakes, where you sit at work, which corridor you walked at lunch, and where the router you sleep near sits on a map.

None of this requires hacking you, and none of it on its own names you. It is how Wi-Fi works out of the box. A current phone already handles much of the scanning layer by itself; what still leaks on a current device is mostly what you sign in to, what you hand over, and what your home equipment reports. The table walks through the day moment by moment.

It helps to sort the problem by your relationship to the network, because each kind leaks something different and needs a different fix.

The third kind surprises people most. You never joined the mall's network, but its sensors can still hear your phone scanning and estimate how long you stayed. And your own router, sitting still at home, is a landmark that phones passing on the street report to Apple, Google, and others so the next phone can find its position. In 2024 researchers at the University of Maryland showed that Apple's positioning system could be queried to locate more than two billion access points and follow some of them as they moved.

Three layers, three different fixes

Across all three kinds of network, what your phone gives away sits on one of three layers. Most confusion about Wi-Fi privacy comes from treating them as one thing.

• Scanning. What the phone says while looking for networks, before it joins anything. Current iPhones and Android phones randomize the address they scan with and only name a saved network when it is hidden. This layer is mostly handled by keeping the phone updated, and made worse by hidden networks.
• Identity on the network. Who the phone says it is once it joins: its hardware address and, to devices that look for it, its name. This is what a private Wi-Fi address and a generic device name protect, and what logging in or handing over an email undoes.
• Traffic. What passes through the network once you are on it. Different tools protect different parts of it.

Observed is not identified

A phone can be detected without being identified. A router can be located without revealing who owns it. Neither observation by itself names a person. The risk starts when records are joined: a device seen near a home, an authenticated session at work, a customer record, and repeated visits can each supply part of the answer. Randomized addresses make those joins harder; they do not stop an observer from connecting activity through other identifiers. The aim is to reduce what each observer collects and make what remains harder to connect.

Six of these live on your phone and one on your router. Every one is worth turning on. None is complete by itself, so the right column matters as much as the middle one. The layer each one works on is noted under its name.

Where to find them

On iPhone and Android, the first three live in Wi-Fi settings, under each network and in the list of saved networks. The device name is under General or About. Encrypted DNS is Private DNS on Android, and on iPhone arrives through a profile or app. The router change is a rename in your router's admin page. Wording varies by phone and version.

When you need the phone to stop looking

For a sensitive meeting or a visit you would rather not leave a radio trail around, turn Wi-Fi off, not just disconnect. On iPhone, the Wi-Fi button in Control Center only disconnects; turning Wi-Fi off fully is done in Settings. On Android, Wi-Fi scanning can keep running for location even with Wi-Fi off; it has its own switch in the location settings. Expect weaker location accuracy while it is off. This is a tool for specific moments, not an everyday default.

If you are a likely target

Two hardening modes tighten the network side further, at the cost of some convenience. On iPhone, Lockdown Mode stops the phone from automatically joining non-secure Wi-Fi networks and turns off 2G cellular. On Android 16, Advanced Protection is designed to block 2G connections and stop automatic reconnection to insecure networks; check that those protections show as active on your own phone, because availability varies by device. Field Guide 03 covers when the modes are worth it.

At this level, three residual vectors matter more than they do for most people. Devices can be fingerprinted from how they scan, not only from their addresses. Bluetooth announcements from phones, watches, earbuds, and trackers travel alongside Wi-Fi and are often easier to follow. And many smart-home and travel devices do not randomize at all. Use a VPN with a kill switch that blocks traffic when the tunnel drops, check it for DNS leaks, and prefer an established provider over a free proxy. Whether any of this is material depends on who is looking: a home router's location matters a great deal to someone with a stalker and very little to someone without one.

Six of the eighteen moments do not pass through anything a Wi-Fi setting controls. Four are handled by another setting or a choice; two by almost nothing you control.

Your employer

On a network your employer runs, assume they can see when you arrive and which access point you sit near. On a laptop they manage, security software or a trusted inspection certificate can let them read much of what you browse, including encrypted sites. Owning the Wi-Fi alone does not let them open that traffic; managing the device does. This is normal and usually lawful. The answer is separation: do personal things on your personal phone, on cellular data, not on the work device.

Smart devices and your TV

Speakers, doorbells, and TVs report to their makers by design, and many smart TVs identify what is on screen through automatic content recognition. In December 2025 Texas sued five TV makers over that viewing data; Samsung and LG have since agreed to require consent. Turn off viewing-data or "content recognition" options in the TV's own settings, decline the sharing prompts you can, and put these devices on an isolated guest network (section 05). That limits what they can reach. It does not stop them calling home.

The email you traded for Wi-Fi

A login page that asks for your email is buying something. Give it a forwarding alias you can switch off, not your real address, or use your phone's cellular connection instead.

Your route home

Your phone uses the routers around you to work out its own location, and depending on settings it can keep that history. Review which apps can see your location, turn off location history you do not use, and on Android review the Wi-Fi scanning switch in the location settings. Field Guide 05 covers it in full.

Your router can outlive your settings

Positioning systems learn your router from the phones that pass it, without you submitting anything. Renaming it with _nomap limits future participation with supported services. It does not establish that earlier observations have disappeared, or that every other provider and crowd-sourced map has dropped it. For a high-risk household the task is broader than the network name: know which access points and wireless devices are in the house, reduce what they broadcast, and assess whether their identifiers can be tied to the residence or the people in it. Protecting the router is not the same as protecting the address. Field Guide 02 covers the address.

Travel routers and satellite terminals move with you and can be followed through the same maps. Some randomize their identifiers; Starlink terminals have since 2023. Many travel routers keep a fixed one, and a network name you reuse everywhere is itself a pattern. If yours travels, use _nomap, vary the name, and check whether the hardware randomizes.