TikTok MAC Address Tracking: What You Need to Know in 2026 | CapVPN Blog

The Stat That Should Terrify You

Let me hit you with this: in 2020, the Wall Street Journal revealed that TikTok's Android app had been collecting MAC addresses from millions of devices—for over a year—despite Google banning that exact practice in 2017. And get this: they did it even when you were on mobile data, not just WiFi. That's right, your phone's unique hardware ID was being slurped up every time you scrolled.

But here's the wild part: TikTok claimed they needed it for "security and personalization." Sound familiar? That's the same excuse every data broker uses. And while TikTok says the current version doesn't collect MAC addresses, the loophole they used—an Android bug that Google hasn't fully plugged—is still alive.

So, does TikTok track your MAC address over mobile data? The short answer: yes, they did. And the tools to do it are still out there. Let me show you exactly how it worked, what US and UK laws let them get away with, and what you can do right now to stop it.

Before we dive deep, here's what you need to understand: your MAC address is like a Social Security number for your phone. It's permanent. You can't change it. And once someone has it, they can tie your online behavior to your physical device forever.

Now, I've been hacking public WiFi for years on my YouTube channel, so I know a thing or two about how this stuff works. Let's get into the mechanics.

Why This Happens (Deep Dive)

Here's the technical bit—but I'll keep it simple. Every device has a MAC address: a 12-character hex code assigned by the manufacturer. Think of it as your phone's fingerprint. When you connect to a network, your device broadcasts this fingerprint to identify itself.

Now, in 2017, Google announced that Android would randomize MAC addresses when scanning for WiFi networks. But here's the catch: when the app is actually connected to WiFi, it can still access the real MAC. And TikTok exploited a specific bug: they used the WiFi API to request the MAC even when the phone wasn't connected to WiFi, bypassing the randomization. The bug was in Android's WifiManager.getConnectionInfo() method—it returned the real MAC if the WiFi chip was on, even without a connection.

But what about mobile data? You're not on WiFi, so how could they get it? Well, if you had WiFi turned on (which most people do for faster location), the API still worked. So even over 4G/5G, TikTok could grab your MAC. Sneaky, right?

This wasn't a one-off. The WSJ tested it: TikTok's app sent the MAC address every time you opened the app, along with your device model, OS version, and unique advertiser ID. That's a treasure trove for building a permanent profile.

And the legal landscape? Here's where it gets ugly. In the US, the 2017 repeal of ISP privacy rules meant companies like TikTok could collect and sell data with little oversight. The FTC has gone after them (remember the $5.7 million fine for COPPA violations?), but that's a drop in the bucket. In the UK, the Investigatory Powers Act 2016 (the "Snoopers' Charter") gives the government broad surveillance powers, but it doesn't stop private companies from harvesting data. Both countries are part of Five Eyes, meaning your data can be shared across borders.

So basically, TikTok used a known Android bug to collect MAC addresses, Google didn't fix it for over a year, and the laws in the US and UK were too weak to stop it. And the fix? It's not coming from the government.

The 5 Mistakes 90% of People Make

I've tested dozens of apps and talked to hundreds of viewers. Here are the top mistakes I see—and how to fix them.

Honestly, mistake #1 is the biggest. Most people don't realize that WiFi being on is like leaving your front door open—even when you're on mobile data. I've seen it in my own tests: the moment I turned off WiFi, the MAC address grab stopped.

Your Action Checklist

Here's what I personally do—and recommend every viewer do right now:

1. Turn off WiFi when you're out. Seriously. If you're on mobile data, switch WiFi off. It takes two seconds and kills the MAC address grab instantly.
2. Revoke TikTok's "Phone" permission. On Android: Settings > Apps > TikTok > Permissions > Phone > Deny. On iOS: there's no direct Phone permission for apps, but check under Settings > TikTok > Location and set to Never.
3. Install a privacy-focused VPN. Not just any VPN—one that blocks leaks at the system level. Cap VPN uses the TUIC protocol, which is lightweight and doesn't leak your real MAC. Plus, it's built for mobile first—only 18 MB on iOS, and uses