A MAC address identifies a network interface at the local link layer. Historically, Wi-Fi devices exposed a stable hardware MAC to each network, making long-term tracking easier. Modern operating systems can instead generate a private/randomized MAC per SSID or over time. From the router’s perspective, that privacy identity may look like a new device even though the physical phone or laptop has not changed.

A randomized MAC changes the network-visible identity

This feature is usually beneficial, but it interacts with network controls that assume identity equals MAC address. DHCP reservations, MAC allowlists, parental-control schedules, static device names, and captive portals can all behave differently when the client identity changes. The solution is to design controls with the privacy feature in mind rather than automatically turning it off everywhere.

Compare the device identity with router records

  • Check which MAC address the device reports for the specific Wi-Fi network.
  • When creating a DHCP reservation, bind it to the identity the router will consistently see for that SSID.
  • If a parental-control rule stops applying, verify whether the client identity changed after an OS update or privacy setting change.
  • On managed networks, use authentication methods stronger than MAC allowlists for real security.
  • Disable private addressing only when a trusted network has a documented operational need and you understand the privacy tradeoff.

Per-network identities and lease behavior

MAC filtering is weak security because MAC addresses are visible on the local radio/link and can be spoofed. Private MAC features make this limitation more visible. Strong Wi-Fi authentication, segmentation, and per-user/device credentials where available are more meaningful security controls. The router’s device list should be treated as an operational inventory, not proof of human identity.

A reservation stops matching after identity changes

A phone was named “Sara’s iPhone” in the router and had a bedtime rule. After the phone changes its private Wi-Fi identity, the router lists a new device and the old rule no longer matches. The router is not necessarily hacked; its policy was tied to an address the client no longer presents.

Avoid mistaking a private MAC for an intruder

  • Calling every unfamiliar MAC an intruder without checking privacy identities.
  • Using MAC filtering as the primary Wi-Fi security mechanism.
  • Creating reservations for the hardware MAC while the client presents a different private MAC.
  • Disabling privacy globally to fix one badly designed network rule.

Why does my phone appear twice in the router list?

A changed private MAC or multiple interfaces can create multiple historical identities.

Is a randomized MAC fake?

It is a valid locally used link-layer identity chosen for privacy rather than the permanent hardware identifier.

Should I disable it at home?

Usually not unless a specific trusted-network feature depends on a stable identity and cannot be configured another way.

Does changing MAC change my public IP?

No. MAC addressing is local-link behavior; the public IP is assigned/routed elsewhere.

Video walkthrough for Private MAC Addresses and Randomized Wi-Fi Identities Explained

Explains how MAC addresses differ from IP addresses and why local-network identity is not the same as a routable address. Modern private/randomized MAC features can intentionally change the address seen by a Wi-Fi network.