In brief
iOS and Android now join each network with a random MAC address. Does that stop a guest being recognised on their second visit? Short answer: no, with conditions.
In recent years phones have joined each Wi-Fi network using a generated address rather than their real hardware address. This is MAC randomisation, and its purpose is to make it harder to track a user between venues.
Businesses setting up guest Wi-Fi ask a fair question: if the device's address keeps changing, how can "remember this device" work?
The short answer
Randomisation works per network, not per connection. The phone generates one address for your network and uses the same address when it rejoins that network.
So when a guest returns, the portal recognises them. Device remembering works.
When does it break?
Three cases:
1. The guest forgets the network on their phone. Choosing "forget this network" deletes the record for it. On the next connection the phone generates a new address, and the portal treats it as a new device. The guest is asked for a code again.
2. "Periodic refresh" on some Android versions. Some Android versions have a setting that refreshes the address at intervals for networks that were not saved. For saved networks this usually does not apply, but behaviour varies by version and manufacturer.
3. The guest turns randomisation off. They then connect with their real address; remembering still works, the address is simply different.
In practice the first is by far the most common, and it is the user's own choice.
Does this affect the records?
No. The purpose of the records is not to track a device permanently, but to show who was connected in a given session.
Within a session the device's address is fixed. The session record holds that address together with the verified contact detail, the IP address and the time. The address being different on a later visit does not reduce the value of the earlier record.
This is the real advantage of verified sign-in against randomisation: the backbone of the record is not the MAC address but the verified sign-in itself.
How to choose the remembering period
Set it against your guest profile:
| Business | Sensible period | Why |
|---|---|---|
| Café | 30–90 days | Regulars come often; asking for a code every time annoys them |
| Hotel | Length of stay | Access should not continue after check-out |
| Mall | 7–30 days | Moderate visit frequency, large area |
| Office visitors | 1–7 days | A visitor usually comes once |
A longer period lowers SMS cost; a shorter one keeps records fresher. You decide between the two.
A wrong expectation: marketing tracking
Some vendors promise "how many times did they come to the shop" analytics based on MAC addresses. Randomisation has largely made such analysis useless, and that is a good thing.
If you want to measure visit frequency, the right way is to count verified sign-ins. It is both more accurate and within the guest's knowledge.
Summary
MAC randomisation does not break device remembering; the phone returns to the same network with the same address. Remembering resets if the guest forgets the network — which should be their choice anyway. Your records are unaffected, because what they rest on is the verified sign-in, not the address.