Not legal in Europe? That's a bold claim, can you cite any documentation please? I'm in Europe and I know of many local shops, plus at least two pub chains that do this right now.
The pub chains are registered with our Information Commissioners office and I am struggling to understand how every one of those people (including the ICO!) could have missed this.
I note Bluetooth also uses MAC addresses, so this issue is not limited to WiFi. Spoofing your WiFi MAC on a mobile phone with Bluetooth may not be making you as anonymous as you hope to be.
> A business uses Wi-Fi analytics data to count the number of visitors per hour across different retail
outlets. It is not necessary to know whether an individual has visited an individual store (or multiple
stores) before.
> This involves the business processing the Media Access Control (MAC) addresses of mobile devices
that broadcast probe requests to its public Wi-Fi hotspots. MAC addresses are intended to be unique
to the device (although they can be modified or spoofed using software).
> If an individual can be identified from that MAC address, or other information in the possession of
the network operator (the business, in this example), then the data is personal data.
Indeed, collecting unique MAC addresses, potentially from multiple endpoints, can reveal a lot of personal, sensitive, information (location, trips, time you go to the coffee shop or which hospital you visit, etc.).
The only ways to properly collect and store MAC addresses are either using privacy-protecting methods (e.g. cutting the last bits of the MAC address, potentially using bloom filters) or immediately aggregating the collected MAC addresses.
The pub chains are registered with our Information Commissioners office and I am struggling to understand how every one of those people (including the ICO!) could have missed this.
I note Bluetooth also uses MAC addresses, so this issue is not limited to WiFi. Spoofing your WiFi MAC on a mobile phone with Bluetooth may not be making you as anonymous as you hope to be.