You walk into a mall on a Saturday afternoon. You pass through the main entrance, drift toward a sportswear store, spend twelve minutes browsing, leave without buying anything, and end up at a food court. You’re not logged into anything. You didn’t scan a QR code. You haven’t touched the mall’s Wi-Fi. Your phone is in your pocket.
You were still tracked. The whole time.
Bluetooth beacons: the hardware you walk past without noticing
Retailers and mall operators deploy small, inexpensive devices called Bluetooth Low Energy (BLE) beacons throughout their spaces — mounted near entrances, attached to shelving units, placed at aisle intersections. Each beacon broadcasts a constant signal. When a Bluetooth-enabled phone comes within range, the beacon logs the device’s MAC address, its own beacon ID, and a timestamp.
Do this across dozens of beacons in a single store, and you have a movement trace. It shows which entrance the device came through, how long it spent in each section, whether it stopped at the display near the checkout, and which store it came from immediately before. Chain together the logs from every retailer in a mall, and the picture becomes a detailed floor-by-floor path through the entire building.
The device doesn’t need to be actively using Bluetooth. It just needs to have Bluetooth on — which it almost certainly does, because turning Bluetooth off entirely breaks headphones, car connections, and smartwatch pairing.
Wi-Fi probing: your phone searching for familiar networks
There’s a second tracking mechanism that runs even when you’ve never touched the mall’s Wi-Fi. Smartphones constantly broadcast what are called Wi-Fi probe requests. These are short signals asking nearby networks “Are you the one I already know?” Each request includes the device’s MAC address, the same hardware identifier used by Bluetooth beacons.
Companies like RetailNext, Euclid Analytics, and Density deploy Wi-Fi receivers throughout retail spaces specifically to capture these probe requests. The result is the same: a timestamped movement log tied to a device ID, built from signals your phone sent without your involvement.
RetailNext’s platform combines this Wi-Fi data with in-store cameras and point-of-sale systems. That gives retailers metrics on dwell time, path analysis, and conversion rates: how many people who passed a display actually bought something. Density uses infrared sensors to count and track people without cameras. Placer.ai doesn’t deploy any hardware at all. It buys location data that already exists inside mobile apps you’ve installed, then builds foot traffic analytics for any physical location it chooses to analyse.
The MAC address randomization partial fix
Apple recognised this problem. iOS 14, released in September 2020, introduced MAC address randomization. Instead of broadcasting your device’s permanent hardware identifier, your iPhone sends a different randomized address for each network, changing over time. Android followed with the same feature in Android 10.
This created real friction for beacon and probe-based tracking. Retail analytics systems that had built longitudinal profiles on stable MAC addresses suddenly found their data fragmenting. But it didn’t end the problem. Many retailers already held years of data built on stable MACs before randomization arrived. Some analytics vendors shifted toward additional fingerprinting signals — timing patterns, signal strength combinations, device capability broadcasts — that can partially re-link randomized identifiers over time. And the profile-linking problem, described below, means randomization only helps if nothing else in your visit connects your device to your identity.
The profile doesn’t need your name — until it does
A device ID tracked across a mall visit is genuinely anonymous in isolation. The analytics company doesn’t know your name. They have a pseudonymous identifier moving through a physical space.
This anonymity collapses the moment something links your device to your identity. The most common bridge: you pay by credit card. Your card transaction — store, amount, time — gets matched against the movement log showing a device in that store at that time. The anonymous trace gets a name. Every future visit by the same device is now attributed.
Loyalty apps are a direct link. When you scan a loyalty card or open a retailer’s app inside the store, you’ve handed over your identity voluntarily. Mall loyalty programmes — common across DLF, Phoenix, Prestige, and Nexus properties in India — collect email addresses, phone numbers, and purchase history. A mall app open on your phone while you walk through a beacon-equipped corridor means your physical path is now part of your loyalty profile.
Placer.ai’s model makes the hardware question largely irrelevant. Say an app on your phone has location permissions and sells that data onward. It could be a weather app, a flashlight app, or a game. Placer.ai may already be using that feed to log which retail locations you visit, how often, and when. No beacon required. No Wi-Fi connection required.
India: the mall Wi-Fi problem
In India, major malls typically offer free Wi-Fi. Connecting requires registering your phone number, sometimes via OTP verification. The Wi-Fi network was already collecting movement data from your probe requests. Once you register, the mall operator can attach your phone number to the device identifier that’s been logging your path through their property.
India’s Digital Personal Data Protection Act 2023 requires explicit, informed consent before processing personal data for purposes beyond what’s reasonably expected. Consider a Wi-Fi login screen with a “By continuing you agree to our Terms of Service” button. Buried in those terms is consent to movement tracking and marketing analytics. That does not meet the DPDPA standard in any meaningful sense. Whether enforcement will reach this specific practice remains to be seen. As of mid-2026, the implementing rules are still being finalised and enforcement is in its earliest stages.
Indian retail analytics also runs through loyalty infrastructure. Capillary Technologies, which works with major Indian retail chains, combines loyalty programme data with location analytics. If you’ve enrolled in a retailer’s loyalty programme in India, some version of your in-store movement data is very likely part of your profile there.
What you can do
Turn off Bluetooth when you’re not using it. This is the single most effective step. A beacon can only log your device if it receives a signal from it. No signal, no log.
Turn off Wi-Fi when you’re not connected to a network. On Android, the Quick Settings Wi-Fi toggle works. On iOS, the Control Centre toggle temporarily disables scanning but re-enables after a few hours — go to Settings > Wi-Fi to turn it off completely.
Verify MAC address randomization is active. On Android 10 and later, go to Settings > Network & Internet > Wi-Fi, tap your connected network, and confirm “Randomized MAC” is shown under MAC address type. For new networks, randomization is on by default — but checking costs nothing.
Don’t connect to mall Wi-Fi. The registration process is the link between your phone number and your movement data. Mobile data works fine for most purposes inside a mall.
Skip the mall loyalty app. A loyalty app that requests location permissions is a direct real-time feed of your physical location to the retailer. The discounts rarely justify it.
Disable location permissions for shopping apps you aren’t actively using. On both iOS and Android, set location access to “While Using App” rather than “Always.” Better still: deny it entirely and grant it only when needed.
None of these steps require technical expertise. They take about five minutes across your phone’s settings screens. They significantly reduce what retail analytics systems can collect — not to zero, but meaningfully.
The companies doing this tracking are not acting illegally under most current frameworks. They are, however, building detailed profiles of your physical movements using infrastructure you walk past without any visible sign it’s there. Whether that’s acceptable is not a question the industry will answer for you.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.