If you are evaluating Wi-Fi occupancy tracking accuracy because someone pitched "just use the access points you already have," you are about to inherit a measurement method that is failing on two fronts at once. On accuracy, modern phones no longer emit a single stable identifier to count, so device-counting overcounts and drifts. On privacy, every workaround that tries to claw the accuracy back is a step toward identifying the person, not just counting them. This article walks through exactly how Wi-Fi (and Bluetooth) people counting works, where it breaks, why the privacy risk is structural rather than incidental, and how anonymous, on-device edge-AI counting avoids the entire trap by never touching a device identifier in the first place.
01 · HOW DOES WI-FI OCCUPANCY TRACKING ACTUALLY COUNT PEOPLE?How does Wi-Fi occupancy tracking actually count people?
Wi-Fi occupancy tracking counts people by listening for the radio signals phones and laptops emit, then treating each unique device identifier as a proxy for one person. The core mechanism is the probe request: when a Wi-Fi device is looking for networks, it broadcasts small management frames that historically carried the device's MAC address (a globally unique hardware identifier). An access point or a dedicated sniffer captures those frames, collects the MAC addresses in range, deduplicates them, and reports the count as "people present."
That is the whole model. It is appealing on paper because the infrastructure is already on the ceiling and the marginal cost looks like zero. The problem is that the model rests on two assumptions that are no longer true: that one device equals one person, and that one device emits one stable identifier you can count. Both assumptions have quietly collapsed over the last several years, which is why Wi-Fi occupancy data is now far less trustworthy than the brochure suggests.
02 · HOW ACCURATE IS WI-FI OCCUPANCY TRACKING?How accurate is Wi-Fi occupancy tracking?
Wi-Fi occupancy tracking is roughly accurate for coarse, large-area headcounts and unreliable for anything granular. Even vendors who sell Wi-Fi analytics as a cheap add-on concede it lands around ~85% accuracy, and only across large open spaces such as a foyer, a concourse or a whole floor - not at the resolution of a single meeting room or a desk cluster. The further you push it toward room- or zone-level precision, the worse it gets, because the radio simply cannot localise a phone to a square metre and cannot tell whether the phone is even attached to a body.
The accuracy ceiling is not a tuning problem you can engineer away with a better algorithm. It is baked into what the signal can and cannot tell you. And as of the last few years, the foundation underneath it - the stable MAC address - has been deliberately removed by the phone makers.
03 · DOES MAC ADDRESS RANDOMISATION BREAK WI-FI PEOPLE COUNTING?Does MAC address randomisation break Wi-Fi people counting?
Yes. MAC address randomisation is the single change that breaks Wi-Fi people counting, because it removes the stable identifier the count depends on. To protect users from exactly this kind of passive tracking, both major mobile platforms now randomise the MAC address a device advertises.
Apple introduced randomised MAC addresses per Wi-Fi network in iOS 14 (2020), and iOS 15 (2021) extended this with a "private Wi-Fi address" that can rotate over time. Android shipped randomised MACs by default from Android 10 (2019), and Android 11+ moved toward periodically re-randomising the address even on a network you have joined before. On top of that, probe-request randomisation means a phone scanning for networks broadcasts a fresh, software-generated MAC for each probe burst - so a device that is merely walking past, never connecting, sprays a trail of different identifiers.
The practical effect is that the population a Wi-Fi sniffer sees is dominated by throwaway identifiers. Real, un-randomised hardware MACs can account for as little as ~2% of visitors in a modern crowd; the rest are rotating randomised values. Deduplication - the step that is supposed to turn "MACs seen" into "people present" - has nothing stable to deduplicate against. This is why the method is described as "device-free" only by sensors that never use it; Wi-Fi counting is the opposite of device-free.
04 · WHY DOES WI-FI OVERCOUNT PEOPLE?Why does Wi-Fi overcount people?
Wi-Fi overcounts people because it counts identifiers, and modern phones generate many identifiers each. There are two compounding errors. First, one person carries several devices - a phone, a laptop, a watch, earbuds, maybe a tablet - and each connected device shows up as a separate "person." Second, and far worse since randomisation, one device emits many rotating MACs: a single phone scanning across a few minutes can present as a handful of distinct identifiers. Both errors push the count up.
The system was built to deduplicate one stable MAC per person. It now has to deduplicate many rotating MACs per device, across many devices per person - and it has no reliable key to do it with.
Vendors try to compensate with heuristics: clustering MACs by timing, signal strength and probe patterns to guess "these twelve identifiers are probably three people." That guess is fragile in exactly the situations occupancy data matters most - busy rooms, transition periods, mixed crowds. And, critically, every one of those heuristics is an attempt to re-link identifiers back to an individual, which drags the method out of "anonymous counting" and into "tracking." For an honest treatment of counting that never depends on a device, see how to measure office occupancy without cameras or device tracking.
05 · DO BLUETOOTH (BLE) OCCUPANCY SENSORS TRACK YOUR PHONE, AND ARE THEY ANY MORE ACCURATE?Do Bluetooth (BLE) occupancy sensors track your phone, and are they any more accurate?
Bluetooth Low Energy occupancy sensors work the same way as Wi-Fi - they listen for BLE advertising packets and count device identifiers - and they inherit the same problems. BLE advertisements also use randomised, resolvable private addresses on modern phones, so the stable-identifier assumption fails there too. BLE can be slightly better at short-range presence in a small zone because its range is shorter and easier to bound, but it is not meaningfully more accurate at counting bodies, and it raises the identical privacy question: are you capturing a per-device identifier from people who never opted in?
The honest summary is that BLE and Wi-Fi belong to the same sensing class. Both count radios, not people. Both depend on identifiers the platforms are actively scrambling. And both create a record that, the moment it is captured, is a per-device identifier tied to a person walking through your space. If your goal is to know how full a room is - not which devices were in it - neither is the right tool. The alternative is to measure occupancy without cameras or device tracking at all.
06 · CAN WI-FI OR BLUETOOTH IDENTIFY INDIVIDUALS?Can Wi-Fi or Bluetooth identify individuals?
Yes - and that is the part that should worry a privacy reviewer more than the accuracy gap. The techniques used to rescue accuracy after randomisation are, technically, re-identification methods. Probe-request fingerprinting uses the order of advertised network names, vendor-specific information elements, supported data rates and timing to build a signature that re-links randomised MACs to a single device. De-randomisation research has repeatedly shown that randomised identifiers can be stitched back together because the randomisation is imperfect or the surrounding metadata is distinctive.
It gets sharper. Newer Wi-Fi sensing research - for example the Karlsruhe Institute of Technology "BFId" work using channel beamforming feedback - reports person identification accuracy as high as ~99.5% in some configurations, in certain setups even when the target's handset is switched off, by reading how a body perturbs the radio environment. The direction of travel is unmistakable: this entire sensing class is drifting from "count anonymous devices" toward "identify specific people." A system whose accuracy improvements are identification improvements cannot credibly promise to stay anonymous. We make the broader version of this argument in why privacy-first needs architecture-first.
07 · IS WI-FI PEOPLE COUNTING LEGAL AND PRIVACY-COMPLIANT UNDER THE AUSTRALIAN PRIVACY ACT?Is Wi-Fi people counting legal and privacy-compliant under the Australian Privacy Act?
A MAC address captured from an identifiable person is personal information, and capturing it without consent puts the deployment squarely inside the Australian Privacy Act's concerns. Under the Privacy Act 1988 (Cth), "personal information" is information about an identified individual or an individual who is reasonably identifiable - and a persistent device identifier that can be linked to a person can meet that test. The moment a Wi-Fi or BLE system reads a MAC or a probe fingerprint from a passer-by, it may have collected something the Act regulates: it can trigger obligations around notice, purpose, consent, retention and security.
This is not a hypothetical. Regulators internationally have already treated MAC-based footfall analytics as personal-data processing requiring a lawful basis and, often, individual notice that is impractical to give to everyone walking past. Building a counting programme on top of identifier capture means building your compliance posture on the weakest possible foundation. A method that counts people without ever collecting an identifier - privacy by design - sidesteps the entire question, because there is no personal information to justify, secure or eventually breach.
08 · THE "WE IRREVERSIBLY ANONYMISE THE MAC" DEFENCEThe "we irreversibly anonymise the MAC" defence
The standard vendor rebuttal is "we hash the MAC immediately, so it's anonymous." This is a collect-then-scrub model, and it does not solve the problem - it relocates it. The system still captures a per-device identifier first and de-identifies it afterwards. That means, for a window of time and inside that pipeline, you held personal information; you are trusting a policy, a configuration and a vendor's code path to scrub it correctly, every time, forever. A salted hash of a MAC can also be reversible in practice (the MAC space is small enough to brute-force), and a consistent hash is itself a persistent pseudonymous identifier that can re-link the same device across visits.
This is the difference between privacy by policy and privacy by architecture. "We promise to anonymise it" is a policy; it can change with a config flag, a new product manager, or a court order. "We never captured it" is an architecture; it cannot be reversed by a setting because the data was never recorded. Our position - and our build - is the second one. We expand on the discipline of collecting no biometrics, no demographics, no exceptions.
09 · WI-FI TRACKING VS DEDICATED OCCUPANCY SENSORS: WHICH IS MORE ACCURATE?Wi-Fi tracking vs dedicated occupancy sensors: which is more accurate?
Dedicated anonymous occupancy sensors are more accurate and lower-risk than Wi-Fi or BLE tracking, because they count bodies directly instead of inferring people from radios. Here is the point-by-point comparison.
| Attribute | Wi-Fi MAC counting | Bluetooth (BLE) counting | Badge / access logs | Anonymous edge-AI counting |
|---|---|---|---|---|
| What it actually counts | Device identifiers | Device identifiers | Card swipes (entries) | People present in a zone |
| Typical accuracy | ~85%, large areas only | Similar; better at short range | Counts entries, misses tailgating | High, at room/zone granularity |
| Identifies individuals? | Yes - fingerprinting / de-randomisation | Yes - resolvable addresses | Yes - named cardholder | No - anonymous count only |
| Survives MAC randomisation? | No - breaks (real MACs ~2%) | No - BLE addresses also randomise | N/A | N/A - no MAC dependency |
| Captures personal information? | Yes - MAC/probe is PII | Yes - BLE identifier is PII | Yes - identity-linked | No - no identifier captured |
| Counts people without a phone? | No | No | No (need a card) | Yes - counts the body |
| Privacy model | Collect-then-scrub (policy) | Collect-then-scrub (policy) | Identity-linked by design | Never-collect (architecture) |
The table makes the trade explicit. Wi-Fi and BLE buy you "free" infrastructure at the cost of accuracy you cannot fix and a privacy exposure you cannot easily defend. A dedicated counting layer inverts both: it is built to count, not to identify, so accuracy and privacy move in the same direction instead of against each other. The same logic applies when you compare it to office utilisation without a badge log.
10 · WHAT IS DEVICE-FREE OCCUPANCY COUNTING?What is device-free occupancy counting?
Device-free occupancy counting measures how many people are in a space without requiring those people to carry, connect or be associated with any device. It does not read a phone, a laptop, a watch or a card. Instead, it detects the presence of a human body directly - in Occivar™'s case, by running computer-vision inference on a small sensor and emitting only an anonymous number.
The word "device-free" matters because it is precisely what Wi-Fi and BLE are not. Those methods are device-dependent: a person with no phone, a flat battery, or Wi-Fi switched off is invisible to them, while a person with three gadgets is counted three times. Device-free counting has no such bias. It counts a child, a visitor, a contractor and a CEO identically, because it counts the body in the room - not the radios in their pocket. This is why it is the right substrate for genuine occupancy analytics.
11 · HOW OCCIVAR COUNTS PEOPLE WITHOUT EVER TOUCHING A DEVICE IDENTIFIERHow Occivar counts people without ever touching a device identifier
Occivar™ is architecturally different from every method above: it is anonymous, on-device, edge-AI counting that never captures a MAC, never captures a Wi-Fi or Bluetooth probe request, and never derives a per-person identifier. The presence of a person is resolved to an anonymous count on the device itself. No video is stored, no biometrics, no demographics, no device tracking. There is no identifier to anonymise later, no hash to reverse, and nothing to re-identify - because the thing surveillance needs was never recorded. Here is how that lands against each Wi-Fi failure:
- Overcounting → counts bodies, not devices. Occivar™ counts the person in the zone once, regardless of how many phones, watches or laptops they carry, and counts the person who has no phone at all. There is no device-to-person mapping to get wrong.
- MAC randomisation → no MAC dependency to break. Because Occivar™ never reads a MAC address or a probe request, the platform changes that demolished Wi-Fi counting (iOS 14+, Android 10+, probe-request randomisation) simply do not apply. The accuracy does not erode with each OS release.
- Identification creep → no identifier to fingerprint. There is no probe signature, no resolvable address and no beamforming feedback being logged, so the de-randomisation and fingerprinting techniques have nothing to operate on. The system cannot drift into identifying people because it never collects what identification requires. This is the spine of our security model.
- Privacy Act exposure → nothing personal is ever collected. With no MAC, no probe, no per-person identifier and no stored video, there is no "reasonably identifiable" individual in the dataset to bring it inside the Act's collection obligations. Privacy review gets shorter, not longer.
This is privacy-by-architecture, not privacy-by-policy. The guarantee is not "we promise to delete it" - it is "the device emits a number and the raw frame never leaves it." That distinction is exactly why institutions with strict review processes, such as universities, can deploy it where a tracking layer would never clear procurement.
12 · HOW DO YOU CHOOSE: A TRACKING LAYER OR A COUNTING LAYER?How do you choose: a tracking layer or a counting layer?
Decide by asking what you actually need to know. If you genuinely need to track which device or person went where - for security forensics, say - that is a tracking problem with all the consent, retention and legal weight that implies, and you should treat it as such, explicitly and with notice. But if your question is "how full is this space, by zone, over time?" then you need a counting layer, and a counting layer should never collect an identifier to answer a question about quantity.
Most occupancy programmes only ever needed the count. They reached for Wi-Fi because the hardware was already there, not because it answered the question well. Once you separate "count" from "track," the choice is clear: use a method whose accuracy improves over time instead of eroding with each OS update, and whose privacy posture is structural instead of promised. If you are still weighing the broader category, our piece on occupancy rate vs utilisation rate helps frame what the count is actually for.
13 · FAQFAQ
Is Wi-Fi tracking accurate for occupancy? Only coarsely. It runs around 85% accuracy in large open areas and degrades at room or desk level, and MAC randomisation has made even that figure unstable because real un-randomised identifiers can be as little as ~2% of a crowd.
Does MAC randomisation make Wi-Fi people counting unreliable? Yes. With iOS 14+ (2020) and Android 10+ (2019) randomising MACs, and probe-request randomisation generating fresh identifiers per scan, the deduplication step that turns "MACs seen" into "people present" no longer has a stable key to work with.
Are Bluetooth occupancy sensors more private than Wi-Fi? No. BLE counting captures device identifiers the same way Wi-Fi does, BLE addresses also randomise, and both create a per-device record that is personal information once linked to a person.
Can anonymous occupancy counting work without tracking devices? Yes. Device-free edge-AI counting detects the presence of a body and emits an anonymous number on-device, without reading any MAC, probe request or per-person identifier.
14 · SOURCESSources
- Apple, Use private Wi-Fi addresses on Apple devices - randomised, rotating Wi-Fi (MAC) addresses from iOS 14 onward.
- Android Open Source Project, MAC randomization behavior - randomised MAC by default since Android 10.
- Android Developers, MAC address updates in Android 11 - per-network and non-persistent randomisation.
- A Study of MAC Address Randomization in Mobile Devices and When It Fails (arXiv) - probe-request fingerprinting and where randomisation breaks down.
- OAIC, What is personal information? - the Australian Privacy Act test for reasonably identifiable information, including device identifiers.
- TechCrunch, London's Tube network to switch on Wi-Fi tracking by default - a real-world passive Wi-Fi/MAC tracking deployment and the privacy backlash it drew.
You should not have to choose between knowing how full your spaces are and respecting the people in them. Occivar™ counts bodies, never devices, and never stores video or an identifier - so the data is accurate today and still accurate after the next OS update, with nothing personal to defend in a privacy review. Book a demo and see anonymous, device-free occupancy counting running on the edge.