When free Wi-Fi becomes a tracking network

Free public Wi-Fi feels like a small convenience: connect your phone, accept the terms, and get online while waiting for a train, shopping, or drinking coffee. Yet the network can also become a sensor. The hotspot operator, its technology suppliers, and advertising companies may collect signals that reveal where devices appear, how long they remain, and which places they visit next.

This does not mean that every café or shopping centre is secretly reading the contents of every message. The more common practice is quieter. Network identifiers, login details, browsing events, and location patterns can be combined into marketing profiles. In Australia, where people move between council Wi-Fi, airport networks, shopping-centre services, and carrier hotspots, the boundary between connectivity and commercial surveillance deserves close attention.

What a public hotspot can observe

A Wi-Fi access point necessarily handles technical information about connected devices. It can see a device’s network address, the time it connects, the access point used, the amount of data transferred, and often the websites or services contacted at the domain level. A captive portal may also collect an email address, mobile number, social-media login, or acceptance record before granting access.

Modern phones make some older forms of tracking harder. Apple and Android devices commonly use rotating or private MAC addresses, which can prevent a hotspot from relying on one permanent hardware identifier. This protection is useful, although it is not absolute. A user who logs in with the same email address, installs a network app, accepts a persistent cookie, or presents a distinctive device and browser configuration may still become recognisable.

The hotspot can also record nearby devices that are searching for networks, although operating systems have reduced the value of these probe requests. More sophisticated systems compare timing, signal strength, access-point changes, and repeat visits. That can produce an estimate of movement through a venue even when the operator does not know a person’s name. “Anonymous” in a database may therefore mean “not labelled yet”, rather than impossible to identify.

How advertising companies enter the picture

Ad companies do not need to run the café’s router to benefit from its data. A venue might install a managed Wi-Fi platform that includes analytics, audience measurement, loyalty tools, or advertising integrations. The platform provider can then offer insights to retailers, media agencies, and demand-side advertising systems. Information about visits may be linked with mobile advertising identifiers, hashed contact details, or other records held by data brokers.

A typical chain can be difficult for an ordinary visitor to see. The property owner supplies the venue, a telecommunications or software firm supplies the hotspot, an analytics company processes the connection events, and an advertising intermediary turns audience segments into targeting options. Each party may describe its role in different language, such as “customer experience”, “footfall intelligence”, “personalisation”, or “location analytics”. Those labels can make commercial surveillance sound less intrusive than it is.

The resulting profile may say that a device frequently appears near gyms, medical precincts, supermarkets, or university buildings. It may infer a home suburb, workplace area, travel routine, or likely interests. Such conclusions can be wrong, especially when a family shares devices or a person uses public transport, but inaccurate inferences can still affect which advertisements, prices, or offers they receive.

Australian privacy rules and their limits

Australia’s Privacy Act and the Australian Privacy Principles can apply when an organisation covered by the law handles personal information. The relevant question is not simply whether a name was collected. A persistent device identifier, precise or reasonably linkable location history, or a profile connected to an individual may fall within the broader concept of personal information. APP 3 concerns collection, APP 5 concerns notification, and APP 6 limits how information is used or disclosed.

Consent is often presented through a portal notice containing a long privacy policy. Selecting “connect” may be treated as agreement, yet genuine consent should be informed, voluntary, and reasonably specific. A person who needs internet access to check a train platform or contact someone may have little practical choice if refusing tracking means losing the service. Bundling necessary network access with advertising permission creates a meaningful fairness issue.

The legal position also depends on the organisation, the data involved, and the stated purpose. Small businesses may fall outside parts of the Privacy Act, while larger shopping-centre operators, airports, universities, and technology providers may have more extensive obligations. The Office of the Australian Information Commissioner can investigate privacy complaints, but enforcement does not automatically reveal every commercial relationship behind a hotspot. Australian users should examine the privacy notice and look for the operator, service provider, retention period, overseas disclosures, and opt-out process.

Where Australians encounter this system

In Sydney and Melbourne, public connectivity can appear across shopping precincts, transport hubs, libraries, universities, and large events. A person moving through Central station, a major retail centre, and a nearby food court may encounter several networks managed by different companies within a short walk. Each connection may create a separate event, while data partnerships can make the overall journey more legible than any individual hotspot suggests.

Airports are especially valuable to marketers because travellers often carry charged smartphones, use maps and booking applications, and spend time in identifiable zones. Wi-Fi at Melbourne Airport, Brisbane Airport, or Perth Airport may be provided under terms that differ from the surrounding city network. The practical need to check a boarding pass or contact family can make visitors more likely to accept a broad policy without reading it closely.

The same pattern appears in everyday local settings. A council network in a public library, a free connection at a café in Adelaide, or Wi-Fi offered by a shopping centre in Brisbane can support legitimate services such as visitor information and congestion management. The concern arises when those functions are expanded into cross-context advertising profiles. Australians may reasonably expect a library connection to help them get online, not to become one component of a commercial map of their routines.

Why the data matters beyond advertisements

An advert based on a visit to a sports shop may seem harmless. Location histories become more consequential when they reveal visits to a hospital, addiction clinic, religious service, union office, domestic-violence support organisation, or political meeting. Even if a company never receives a plainly named record, repeated location points can expose sensitive associations through pattern and timing.

The risks also include data breaches, insider misuse, opaque sharing, and decisions made by automated systems. A broker may combine hotspot events with purchase histories, public records, app activity, and loyalty data. The resulting audience category can follow a person across websites and apps. Someone may never have agreed to a specific profile, yet still be sorted into a segment that affects credit marketing, insurance promotions, employment advertising, or political messaging.

This is part of a wider commercial infrastructure in which ordinary household products and public spaces become observation points. The same logic appears in connected televisions, where viewing behaviour can be collected and monetised; a detailed account of that problem appears in smart television surveillance. Public Wi-Fi is less visible because the tracking equipment is embedded in a service people think of as temporary and neutral.

Reducing exposure without abandoning public internet access

The simplest protection is to avoid joining a hotspot unless its benefit is worth the information exchange. Mobile data can be preferable for sensitive tasks, particularly banking, health appointments, work communications, and account recovery. On a device that supports it, private or randomised Wi-Fi addresses should remain enabled. Automatic connection to open networks should be disabled, and old hotspot profiles should be removed when they are no longer needed.

A virtual private network can reduce what the local network sees about the contents and destinations of internet traffic, although it does not make a person invisible. The hotspot still knows that a device connected, when it connected, and how much data moved. A VPN provider also becomes an important intermediary, so its business model and logging policy matter. Encrypted websites, updated operating systems, tracker-blocking browsers, and separate browser profiles can further limit the information available to advertising systems.

Users should also treat captive portals as a point for scrutiny. Check whether access requires an email address, whether guest access exists, who operates the service, and whether marketing messages can be refused. Avoid using a social-media login merely to obtain Wi-Fi. Where a company offers an access, correction, or deletion channel, a person can ask what information is held and how it was obtained. Resources and essays on privacy and digital rights, including privacy and technology writing, can help place these individual choices within the larger policy debate.

Free connectivity has value, especially for people managing limited mobile data, travelling, or dealing with an unreliable home connection. The issue is whether the exchange is clear, proportionate, and genuinely optional. A hotspot should not quietly turn a visit to a public place into a durable advertising record simply because the terms were difficult to understand.

The important distinction is between providing internet access and extracting a behavioural map. A rotating device address may help, but it cannot substitute for honest notice, limited retention, careful security, and meaningful refusal. Remember that a public Wi-Fi connection is a place where your device can be observed, and convenience does not require surrendering the history of where you go.