How to Enable and Configure Rotating Private Wi-Fi Addresses in macOS Sequoia

Whenever a Mac connects to a wireless local area network, it communicates using a unique physical hardware identifier known as a Media Access Control (MAC) address. Because a device’s factory MAC address is globally unique and permanently associated with its network interface controller, third-party network operators, commercial Wi-Fi providers, and public hotspot routers can track device movements across multiple venues over extended periods.

Starting with macOS Sequoia, Apple enhanced private networking by introducing Rotating Private Wi-Fi Addresses. Rather than retaining a single private MAC address indefinitely for a saved network, macOS Sequoia periodically rotates the virtual hardware address, significantly reducing tracking risks across domestic, commercial, and enterprise networks.

How Rotating Private Addresses Work in macOS Sequoia

Private Wi-Fi addressing decouples your Mac’s physical hardware identity from the local network environment:

• Off: Your Mac transmits its genuine factory hardware MAC address to the router. This setting is typically required only on closed enterprise networks or educational institutions using MAC-based hardware authentication.
• Fixed: Your Mac generates a unique random MAC address specifically for that Wi-Fi network and retains it indefinitely. This prevents cross-network correlation while allowing local routers to assign consistent static DHCP leases.
• Rotating: Your Mac regularly generates a new, randomised MAC address for the Wi-Fi network. The address rotates every few weeks or whenever the Mac reconnects after an extended period, preventing network tracking and profiling.

Configuring Rotating Private Wi-Fi Addresses

You can adjust private address behaviour on a per-network basis in macOS Sequoia:

1. Click the Apple menu in the top-left corner of your menu bar and select System Settings.
2. In the left sidebar, click Wi-Fi.
3. Locate the Wi-Fi network you are currently connected to at the top of the pane.
4. Click the Details button located directly next to the active network name.
5. In the network configuration sheet, locate the setting labelled Private Wi-Fi address.
6. Click the dropdown menu and select Rotating.
7. Click OK to apply the changes.

Your Mac will briefly renegotiate its connection with the router, renew its local IP address via DHCP, and begin operating under the newly generated rotating MAC identity.

Resolving Network Conflicts and Captive Portal Warnings

While Rotating Private Wi-Fi Addresses provide superior privacy, certain network environments may exhibit unexpected behaviour:

• Captive Portal Re-Authentication: If a hotel, airport, or cafe requires accepting terms of service via a browser landing page, address rotation will cause the router to treat your Mac as a brand-new device, requiring you to re-authenticate periodically.
• DHCP IP Address Leases: On home routers configured with strict static IP address reservations mapped to specific MAC addresses, changing the address to Rotating will cause the router to assign a generic dynamic IP address instead.
• Enterprise 802.1X Networks: If your workplace or university network restricts access to registered device MAC addresses, switch the setting for that specific network from Rotating to Off or Fixed.

Verifying the Active Private MAC Address via Terminal

To verify the exact virtual MAC address currently assigned to your wireless interface, you can inspect network interfaces using macOS Terminal:

ifconfig en0 | grep ether

Compare the output against the physical hardware MAC address listed under System Settings > General > About > System Report > Network > Wi-Fi. If Private Wi-Fi addressing is operational, the ifconfig output will display the randomised address rather than the factory hardware value.