Privacy protection

BlueZoo goes to extreme lengths to protect consumer privacy. We do not resell data. We collect MAC addresses, but encrypt them on our sensors at the moment of collection and delete their encrypted form after transmission to our servers. By design, our systems cannot correlate MAC addresses with any personal information–though more than one company has asked us to do so.

BlueZoo products have been certified compliant with General Data Protection Regulation (GDPR) by ePrivacy based in Hamburg, Germany. Unlike mobile apps that share a consumer’s location determined via GPS, BlueZoo products collect no personal information, and depend on the MAC (media access control) address broadcast by mobile phones only to distinguish one mobile phone from another on a Wi-Fi network.

BlueZoo products do not seek to track individual mobile phones but only to statistically calculate the number of phones present in a space and how they relocate to other spaces during limited time intervals. BlueZoo sensors detect smartphones by passively listening for “addresses” that they spontaneously and continually broadcast.  These addresses, called “Media Access Control (MAC) addresses” in Wi-Fi frames and “Device Addresses” in Bluetooth Low Energy (BLE) frames are comparable in size and purpose and we’ll refer to them simply as “addresses”.

Generally, these addresses are selected at random from a set of trillions of possible numbers and intended to differentiate one phone from all others in the vicinity.  Indeed, multiple phones worldwide will have the same randomized MAC address over time, but the chances of a collision–when only thousands of smartphones are present–is infinitesimally small.

At the same time, because two different mobile phones can broadcast the same randomized address, it is impossible to unequivocally identify a phone knowing only its broadcast randomized  address. Further, because these randomized addresses regularly rotate over time, identifying an individual mobile phone based on a randomized address embedded in the broadcast frame is virtually impossible.

All smartphones broadcast addresses that differentiate one phone from another, as described above.  These addresses have different names in the domains of Bluetooth Low Energy (BLE) versus Wi-Fi as summarized in the table following.

Because BLE device addresses are always randomized and change frequently (median 4 minutes), they present no privacy risk. On the other hand, Wi-Fi MAC addresses change less frequently and because 15% of smartphones (in 2026) broadcast fixed MAC addresses, they present a small privacy risk. BlueZoo addresses this risk by applying layers of anonymization and protection when counting.

Smartphones broadcast MAC addresses in order to seek out Wi-Fi access points and for purposes of geolocation. MAC addresses are 12 hexa-decimal characters (6 bytes or 48 bits) long. Originally, MAC addresses were created as unique identifiers of any networked device and, as a result, every networked device has at least one fixed MAC address. To allow MAC addresses to be unique across all devices, the Institute of Electrical and Electronics Engineers (IEEE) allocates MAC addresses worldwide. The MAC addresses have two parts that are each 3 bytes long: an organizationally unique identifier (OUI) that represents the company manufacturing the device and a serial number assigned by the manufacturer.

Beginning in the mid-1990s, following revelations of Edward Snowden, Apple and Google stopped broadcasting global (fixed) MAC addresses, and started broadcasting local (randomized) MAC addresses in their Wi-Fi probes.

The 15% of smartphones that broadcast fixed global MAC addresses permit a phone to be uniquely identified, though they share no information about the owner/user of the mobile phone. Individuals whose phones broadcast global MAC addresses can register their addresses with BlueZoo at no charge to ensure that the presence of their phone is not accounted for in our statistical estimates. Use this form to opt out.

All phones, whether broadcasting local or global MAC addresses can contribute to our real-time count of the number of visitors, visits, and dwell time. The 15% of mobile phones that broadcast global MAC addresses contribute to our measurement of unique visitors and unique visitor recurrence. This share of phones provide a very accurate picture of the behavior of phone users over time. Consumer identity and privacy are protected by BlueZoo whether the consumer’s phone broadcasts a global or local MAC address.