Apple's iOS 8 will protect users from being spied on by retailers and hackers, by randomising a key piece of information phones use to connect to Wi-Fi.

Users of Apple's next mobile operating system, due in autumn, will no longer be sharing their real "MAC address" with anyone who cares to listen – putting the brakes on attempts to use it to track shoppers.

Every networked device has a unique identifier, called a MAC (Media Access Control) address. (The MAC address is not specific to Apple devices.) That address lets networks tell whether a particular device has joined before, or block specific MAC addresses from joining, or allow only those with specific MAC addresses join. Because of how services like Wi-Fi work, phones must broadcast the MAC address widely, even to wireless networks they don't intend to join.

As a result, some retailers have used that information to track customers as they move through stores - because the MAC address from the device shows up at different Wi-Fi points, and triangulation between a number of them plus the signal strength indicates where the phone's owner is.

In May 2013, US retailer Nordstrom ended a programme that let it keep tabs on peoples' shopping habits. "The test is over and we'll now evaluate the results from it, along with results from other initiatives we have going on that are designed to better serve our customers," the company said at the time.



But devices with iOS 8 installed will not share that information by default: instead, the phone or tablet broadcasts a fake MAC address, until the user actually joins a wireless network, at which point the real address is revealed.

American Senator Al Franken, who had proposed legislation to require companies to get users' permission before they collect location data, praised Apple's change in a statement to the Washington Post, saying "Apple’s decision to protect their users against this form of tracking is a smart and powerful move for privacy".

The change protects users from one form of wireless eavesdropping, but retailers – and more nefarious actors – still have other ways of keeping tabs on their customers. One possibility is the adoption of Apple's own iBeacon feature, which lets retailers and others use small Bluetooth transmitters to interact with customers' phones.

But from a privacy standpoint, there's a key difference between iBeacons and MAC address eavesdropping: the former requires users to opt in. Customers must explicitly install the retailer's app before the phone can start listening out for iBeacons, meaning the companies need to offer something in return. And iPhone users can block iBeacon altogether by turning off Bluetooth.

There are still privacy holes in Wi-Fi which some can exploit, however. Snoopy, a tool created by security firm SensePost, demonstrates one. When smartphones try to reconnect to a wireless network they've already joined once, they do so by broadcasting the name of the network – in effect, shouting "BTHomeHub3DR4, are you there?"

Snoopy collects that information, and compares it to a public map of Wi-Fi hotspots. At its best, it can work out, not just whether a particular user has been seen before, but where their home address is, based on which Wi-Fi networks their phone is looking out for.

The tool's creators advise users to turn off Wi-Fi if they aren't using it.

• What is Apple's iBeacon?