Apple announced at WWDC that they are starting to randomize MAC addresses of location scans and auto join scans in iOS 9, in addition to Unassociated PNO and ePNO scans (see the video around 8:00 for details).

While PNO and ePNO scans are well-defined, I could not find any details on location scans and auto join scans – they don't seem to be any official (IEEE) terms. They sound like scans to determine location or automatically join known networks – but from what I understood, this is precisely what PNO scans and ePNO scans are used for.

Could someone please clarify these terms for me?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 17:32
  • Unfortunately, no answer here really answers this question and I couldn't find an answer myself.
    – clemenslm
    Aug 13, 2017 at 10:28

2 Answers 2


This document from Apple KB provides some background on Location scans.

It looks like that part of iOS is scanning for WiFi networks in the background and sending this data to Apple, enabling them to crowdsource a geo tagged map of WiFi access points to help with positioning accuracy in other apps.

EG: Your phone is at GPS co-ordinates Latitude:37.330558° and -122.029675° and reports to apple that it can see 8 wifi networks which it has discovered via the Location services scan. The phone then reports this data to Apple which it will compare to other devices data from the same area and, probably using signal strength data, will tri-laterate the AP location.

Why? So they can use the location of WiFi AP's to enhance positioning data so your apps/device can use that to send you useful data/ads/services.

Auto Join scans (I'm making an educated guess here) will be the scans that the device performs in order to discover commonly used and remembered networks eg; ClemensimHomeWiFi.

Basically it looks like Apple are extending the conditions when the device will use an obfuscated MAC address in these scans. Following the original release of this functionality in iOS8 it was discovered that randomisation only occurred under a VERY specific set of circumstances that most users would not enable/experience.

It has to use it's real mac address as soon as authentication occurs in order to maintain compatibility with WiFi standards that rely on mac filtering/auth.

As one of those people who is measuring foot traffic via the standard WiFi probes that Apple is altering this is an area of significant interest.

One thing is clear, Apple intend to aggressively pursue this path as a way to increase use of iBeacon and Apple services for advertisers wishing to reach consumers, it is NOT about user privacy. However, there is only so much they can do until the consequences start affecting performance on different WiFi networks and/or breaking the 802.11 specification.

  • @Rollison: Thank you for your reply! What I find confusing is how the location scans and auto join scans are different from PNO and ePNO scans. Quoting apple.com/business/docs/iOS_Security_Guide.pdf "iOS 8 also uses a randomized MAC address when conducting enhanced Preferred Network Offload (ePNO) scans when a device is not associated with a Wi-Fi network or its processor is asleep. ePNO scans are run when a device uses Location Services for apps which use geofences, such as location-based reminders that determine whether the device is near a specific location." What's different?
    – clemenslm
    Jul 6, 2015 at 10:15

Documentation is quite sparse on these topics. Location scans are sent even if you are associated to a wireless network. They are used for geofencing as well as by apps and websites to help determine your location. Location scans are also used by Apple to pair up with GPS coordinates to help with allowing other people's WiFi-only devices (iPod Touch) to determine their location. This so-called 'crowd sourcing' of location info allows them to determine traffic speed, etc.

PNO scans and ePNO scans are only used when you are unassociated and the device is locked. They are used to automatically connect to networks for which you have a profile when the device is in a low-power state. In my testing the device does not probe for networks by name unless the network is configured with a hidden SSID (one more reason to not use hidden SSIDs).

Auto-Join scans are specifically associated with Captive WiFi Networks and Public Hotspots. This would include 802.11u/Hotspot 2.0/Passpoint networks, captive portal networks (Panera, Starbucks, etc.) and EAP-SIM networks.

In my testing with iOS 9.x there was no difference in the structure of the Probe Request frames sent by the device. Except in certain circumstances they are all sent to the Broadcast/Null SSID; you can't tell a Location Scan from a PNO Scan from an Auto-Join scan by looking at the packets.

Please note that most of this is from observation and packet captures using my own devices, not from Apple's documentation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.