Introduction: the device that talks even when you stay silent
You walk through a shopping mall, phone deep in your pocket, screen off, no app open. You haven't scanned anything, accepted anything or installed anything. And yet, in fifteen minutes of walking, your device has probably announced its existence several hundred times to anyone willing to listen.
That's the very principle of wireless radios: to be able to connect quickly, a smartphone doesn't wait passively. It transmits. It sends out Wi-Fi "probes" to ask whether a known network is within range. It broadcasts Bluetooth frames to signal its presence to your earbuds, your watch, your car. These signals contain neither your name nor your messages, but they do contain something that is quite enough for many players: an identifier, a signal strength, and a timestamp.
With three sensors, you get a position. With thirty sensors spread across a city, a shopping centre or an airport, you get trajectories. And with an identifier that remains stable over time, you get a visit history that looks remarkably like personal data — a point the CNIL regularly makes in its opinions on footfall counting and flow tracking.
This guide is not an invitation to throw your phone into a lead-lined bag. It explains how this physical tracking actually works, what the rules are in France, and which settings cut most of the leak without making your device useless.
Part 1 — Anatomy of a signal: what your phone really broadcasts
Wi-Fi: probes sent out blindly
When Wi-Fi is switched on, a smartphone periodically sends out probe requests. Translation: "Hello, is network X here?". Historically, those probes contained two rather alarming things:
- the device's MAC address, a unique identifier for the network chip, comparable to a licence plate;
- sometimes the list of previously saved networks — that is, indirectly, the story of the places in your life: "Livebox-4A2C", "Wifi-Hotel-Barcelona", "Hospital-Visitors", "SNCF-Wifi".
Since iOS 14 and Android 10, manufacturers have rolled out MAC address randomisation across the board: the device presents a randomly generated address, different for each network and renewed periodically. That is genuine progress. It is not invisibility: academic work presented notably at the CNIL's research days has shown that other elements of the frame (field order, advertised capabilities, transmission rate) form a fingerprint that sometimes makes it possible to piece things back together.
Bluetooth: the chatty neighbour
Bluetooth Low Energy (BLE) works by continuously broadcasting small announcements. That's what lets your earbuds reconnect in a second. It's also what lets a beacon installed on a shelf detect that a compatible device spent four minutes in front of the personal care products.
The important nuance: a beacon on its own does not identify you. It becomes powerful when an app installed on your phone listens for it and reports the information along with your advertising identifier. This is the classic proximity marketing model: a retailer's, media outlet's or game's app asks for Bluetooth access "to improve your in-store experience".
Ultrasound and image sensors: the discreet cousins
Two further techniques complete the picture:
- ultrasonic beacons, inaudible, emitted by a speaker or a TV advert and picked up by the microphone of an app that has been granted permission;
- video analytics of camera feeds, which don't read an identifier but count people, segment them by silhouette, estimate age or gaze direction. The CNIL has published a clear position on "augmented cameras": anonymous counting may be acceptable, but individualised tracking requires a solid legal basis and that people be informed.
| Technology | Typical range | What it captures | Main defence |
|---|---|---|---|
| Wi-Fi probes | 30 to 100 m | Chip identifier, known networks | Turn Wi-Fi off when not in use, MAC randomisation |
| Bluetooth LE | 5 to 50 m | Presence, duration, proximity to a beacon | Turn BT off, deny app access |
| Ultrasound | One room | TV/phone correlation | Deny microphone access |
| Augmented camera | Field of view | Flows, silhouettes, dwell time | Right to information and to object |
Part 2 — Who is listening, and what for
Retailers: measuring physical audiences the way you measure a website
The stated aim is simple: to know how many people walk past the window, how many come in, how many come back, how long they stay. It's the physical counterpart of online traffic statistics. The CNIL accepts these counting systems under strict conditions: anonymisation or very short-lived pseudonymisation, no tracking of an individual from one store to another, visible notice at the entrance, minimal retention period.
What tips things into another category:
- cross-referencing store visits with a loyalty card;
- multi-site tracking of the same identifier;
- reselling trajectories to a third party.
Ad networks and location data brokers
An entire market lives off "mobility data": advertising SDKs embedded in mainstream apps (weather, games, transport, news) harvest positions, aggregate them and resell them to brokers. Several European and American journalistic investigations have shown in recent years that supposedly anonymous datasets made it possible to trace people back to their homes and workplaces, because a trajectory is almost a signature: four space-time points are often enough to re-identify a person in a mobility database.
Local authorities and venue operators
Cities, airports, stations and festivals measure flows in order to size their services. The purpose is legitimate; the problem arises when the data stays granular and is kept for a long time. The right instinct as a citizen: check whether the organisation publishes its record of processing activities and the name of its data protection officer (DPO), which is mandatory for public bodies.
Item trackers, the new arrival
Small Bluetooth trackers for keys and luggage rely on the millions of nearby phones, turned into relays. The service they provide is real, and so is the documented misuse: cases of people being tracked led Apple and Google to deploy a common standard for detecting unwanted trackers, built into iOS and Android. If your phone notifies you that "an unknown accessory is moving with you", take the alert seriously and follow the identification procedure the system offers.
Part 3 — The French framework: what you can demand
Three legal points are directly useful.
A MAC address is personal data as soon as it makes it possible, alone or in combination, to single out a device and therefore the person carrying it. The GDPR applies: specified purpose, legal basis, information, limited retention, data subject rights.
1. Prior information. A footfall measurement system must be signposted: notice at the entrance, identity of the data controller, the DPO, the retention period and how to object. No sign = grounds for a first complaint.
2. The right to object. For processing based on legitimate interests — a frequent case with counting — you can object. In practice, the simplest way remains technical (switching off the radio concerned), but a written request has one virtue: it forces the retailer to document its system.
3. Complaints. The CNIL has recorded a record level of complaints and penalties in recent years, and "video and sensors" cases are among the recurring grounds. An online complaint, well argued, with a photo showing the absence of signage, is a useful and free step.
Worth noting: the so-called "ePrivacy" directive, transposed into French law, also governs access to information stored in a terminal device. European authorities largely take the view that capturing signals emitted by a terminal device falls under the same protective logic.
Part 4 — Concrete steps, from the simplest to the most radical
Level 1 — Basic settings (ten minutes, zero inconvenience)
- Turn Wi-Fi off when you go out. This is the highest-return measure. On Android as on iOS, the control centre button sometimes only drops the connection, not the radio: go through Settings for a genuine shutdown.
- Disable automatic network scanning and automatic connection to public hotspots.
- Forget saved networks you no longer need: last summer's hotel, the station, the café. Every name you keep is a clue.
- Check MAC randomisation: on iOS, "Private Wi-Fi Address"; on Android, "Use randomised MAC" per network.
- Bluetooth: switch it off when not in use. If you wear earbuds all day, accept the trade-off, but turn it off in shops.
Level 2 — Taking back control of your apps
This is where most of the game is played, because a beacon without a complicit app can't do much.
- Review your Location permissions: switch everything that doesn't need it to "Never" or "While Using the App", and refuse precise location when approximate is enough (weather, news, retail).
- Deny Bluetooth and Microphone access to any app with no obvious functional reason for it.
- Reset, then disable your advertising identifier: on iOS, "Tracking" → refuse globally; on Android, "Privacy → Ads → Delete advertising ID".
- Delete retailer apps you never open: the most effective blocker is uninstalling.
Level 3 — Separating your uses
For those who want to go further, the logic is compartmentalisation. Many readers of this site use a second device for outings, demonstrations, sensitive business trips or errands they don't want linked to their ordinary life: a basic mobile phone with no apps mechanically reduces the transmission surface, since it has neither an advertising SDK nor beacons to listen for.
Along the same lines, a signal-blocking pouch — the kind of case known as a Faraday pouch for smartphones — puts a device out of reach for a specific journey, without having to turn it off. It's brutal, but it's the only method that neutralises every radio at once, including cellular.
Level 4 — The accessories that make a difference
A few simple items genuinely reduce your dependence on radios:
- wired earphones with a microphone spare you from having Bluetooth on from morning to night, whether commuting or at the office;
- a compact power bank lets you switch off power-hungry functions without fear of running flat, and therefore stay in airplane mode for longer;
- a portable Bluetooth tracker detector complements the built-in alerts for anyone with a reason to fear targeted tracking;
- on the understanding side, a book on personal data protection written by a French lawyer helps distinguish what belongs to fantasy from what belongs to the law.
None of these objects is a magic solution. They merely make a more discreet everyday behaviour sustainable.
Part 5 — Three real-life situations
Saturday at the shopping centre
Wi-Fi off, Bluetooth off, no retailer apps: your visit becomes an anonymous data point in a footfall counter, which is precisely the limit the CNIL sets for measurement systems. If you use your loyalty card at the till, on the other hand, you are the one re-attaching your identity to your behaviour — a topic we have covered elsewhere in relation to grocery shopping.
The demonstration, the sensitive meeting, the discreet appointment
Airplane mode isn't always enough: on some devices, Wi-Fi and Bluetooth remain switchable and turn themselves back on. Switch them off explicitly, or leave the device at home. A phone switched on in a crowd is an identifier in a crowd.
The business trip
Hotels, airports and trade shows are full of captive portals asking for an email address in exchange for Wi-Fi access. Use a disposable address, decline the marketing checkbox, and prefer tethering from your own data plan. For exchanges where you'd rather not expose your number, an anonymous SMS sending service avoids tying a one-off conversation to your main line.
Conclusion: stop transmitting by default
Tracking via radio signals has one unpleasant feature: it asks for nothing. No consent to click, no account to create, no cookie to refuse. It simply exploits the fact that a modern phone is designed to be always ready to connect.
The good news is that the countermeasure is symmetrical and fits in one sentence: only let your phone transmit what you need, when you need it. Wi-Fi off outdoors, Bluetooth off when not in use, apps stripped of location and microphone access, advertising identifier deleted. These four steps, which take a quarter of an hour once and for all, remove the vast majority of the traces you unknowingly scatter in streets, stations and store aisles.
The rest is a matter of law: demanding signage, questioning a DPO, taking a case to the CNIL when a system goes beyond simple counting. Privacy in physical space is not lost — it is merely poorly defended, because too few people realise the battle is being fought there too.
