GPS is slow to acquire and useless in most buildings. So around 2003, a company called Skyhook Wireless started driving cars through cities, recording the unique hardware identifier of every Wi-Fi access point it could hear along with the coordinates where it heard them. Match what a phone can currently hear against that map and you get a location fix in under a second, no satellites required. Early iPhones used Skyhook's database before Apple built its own.
Today the major Wi-Fi positioning systems belong to Apple, Google, and Microsoft, and they no longer need cars. Every phone with location services enabled acts as a survey instrument: when your phone gets a GPS fix, it can report the access points it currently hears, with signal strengths, back to the vendor. Hundreds of millions of phones doing this continuously produces a self-updating map of the world's Wi-Fi infrastructure. When Google's Street View cars were found in 2010 to be collecting not just access point identifiers but fragments of unencrypted network traffic, the resulting investigations put the collection itself in the news. The identifier mapping never stopped. It just moved into everyone's pocket.
What a BSSID gives away
Every Wi-Fi access point broadcasts a BSSID, which is essentially the MAC address of its radio. It is globally unique, assigned at the factory, and transmitted in the clear many times per second whether or not your network is encrypted and whether or not your SSID is hidden. Encrypting your Wi-Fi does nothing here. The BSSID is addressing information, not payload.
Two properties make it a tracking identifier rather than a network detail. First, it is stable: your router will broadcast the same BSSID for its entire service life. Second, it is bound to hardware, not to a place. If you move apartments and take your router with you, the database updates within days, because your new neighbors' phones start reporting your BSSID at the new coordinates. The identifier follows you.
Modern phones randomize their own Wi-Fi MAC addresses precisely so they cannot be tracked as they move through the world (see our post on MAC address randomization). No equivalent protection exists on the access point side. The client got privacy engineering; the infrastructure stayed trackable, because trackable infrastructure is what makes the positioning system work.
There is also a public, hobbyist version of the same map. WiGLE, a wardriving database running since 2001, holds billions of crowdsourced observations and is searchable by anyone. If your SSID is distinctive, the pseudonymous network name you thought was private is one lookup away from a street address.
What researchers pulled out of Apple's database
In 2024, Erik Rye and Dave Levin at the University of Maryland published a study titled "Surveilling the Masses with Wi-Fi-Based Positioning Systems" at the IEEE Symposium on Security and Privacy. They looked at the query side of Apple's positioning system and found two design decisions with large consequences: the API required no authentication, and a query for a single BSSID returned not just that access point's location but the locations of up to 400 others nearby.
BSSIDs are not random. The first half of the address identifies the manufacturer, which collapses the search space enough to guess plausible identifiers in bulk. By querying guessed BSSIDs and harvesting the hundreds of neighbors each answer volunteered, the researchers assembled a location database covering hundreds of millions of access points worldwide, from a laptop, at essentially no cost.
The demonstrations were the alarming part. Because Starlink user terminals ship with Wi-Fi routers, the researchers could observe terminals appearing and moving inside Ukraine, mapping activity in a war zone from the other side of the planet. They tracked devices moving into and out of Gaza as the war there began. They showed they could identify people who had moved house, because a BSSID that geolocates to one address in January and a different address in March is a change-of-address record nobody consented to file. Travel routers turned their owners into trails of dated location fixes.
A database built so phones can find themselves is also, unavoidably, a database of where everyone's equipment is.
Apple subsequently limited the API and announced it would honor an opt-out. But the technique generalizes to any positioning provider whose query interface is permissive, and the underlying data collection is inherent to how every one of these systems works.
Who this actually affects
For most people, being one BSSID among hundreds of millions is not a practical threat. The people with reason to care are specific:
- Anyone who moved to escape someone. A domestic violence survivor who relocates but keeps their router has published, to anyone who recorded their old BSSID, a forwarding address. Shelters and advocates rarely mention this, because almost nobody knows it.
- People using satellite or cellular hotspots in conflict zones. The Ukraine and Gaza findings were not hypothetical. Equipment that announces a stable identifier over radio is a beacon, whatever the marketing says about the traffic being encrypted.
- Anyone carrying a travel router or mobile hotspot. The convenience of your own network in every hotel comes with a dated, geolocated breadcrumb trail keyed to one identifier.
- Organizations with distinctive infrastructure. A fleet of access points that appears in a new building before any public announcement is a signal to anyone watching the databases.
The opt-outs, and what they do not cover
The available controls are thin. Google has honored an opt-out since 2011: append _nomap to your SSID (so myhome becomes myhome_nomap) and its positioning system is supposed to exclude the access point. Microsoft uses _optout. Apple announced in 2024, after the Maryland study, that it would begin honoring _nomap as well. Since one suffix cannot spell both, _nomap is the one to pick; it now covers the two largest databases.
Understand what this does not do. It does not remove past observations already sold or scraped. It does not bind hobbyist wardrivers or any collector who simply ignores the convention. It advertises, to anyone scanning nearby, that this network's owner thought about surveillance, which in some threat models is itself information. And it depends entirely on the goodwill of the database operators, with no audit mechanism behind it.
A few practical measures go further than the suffix. If you move and your threat model includes a person rather than an advertiser, replace the router, or check whether yours allows changing the BSSID, which a small minority of firmware (including some OpenWrt builds) does. Treat portable hotspots as location beacons and disable their radios when you do not need them; a phone hotspot is better here, since modern phones randomize their hotspot BSSID. And remember that this is one layer of a stack: the same infrastructure that maps access points feeds the broader trade in movement data we covered in location data brokers, and radio-layer exposure is a family of problems that includes Wi-Fi sensing and Bluetooth trackers.
The design lesson
Nothing in this story required a breach or a warrant. Every piece works as designed: access points announce themselves because the protocol requires it, phones report what they hear because positioning needs the data, and the databases answer queries because that is their function. That is worth keeping in mind whenever a new piece of infrastructure asks to know where things are so it can be helpful: the map it builds outlives the help, and the map is what someone else will eventually want.