The Short Read
Your phone announces a hardware identifier before the login page even loads. Apple calls the feature Private Wi-Fi Address, Google calls it MAC randomization, and both turn it on by default.[1][3] What the guest portal does next is the part the brand does not explain. Hilton's own Global Privacy Statement says the company is not responsible for the collection, use, disclosure, or other processing of personal information by its third-party websites and applications, and it lists "(1) in-hotel internet services we may offer" among those.[6] The box in the room is not the hotel chain. The chain's privacy policy is not the document that governs it.
Three things to do before you connect: leave the private address on and set it to rotate, forget the network when you check out, and do not sign into a personal or loyalty account on a portal you did not expect to see.
The address your phone broadcasts before you sign in
Every device that joins a Wi-Fi network has to announce itself first. To communicate with a Wi-Fi network, a device must "identify itself using a unique address called a Media Access Control (MAC) address."[1] That factory address is a permanent serial number for the network hardware. The reason it matters is plain: "If the device always uses the same Wi-Fi MAC address across all networks, network operators and observers can more easily relate that address to the device's activity and location over time."[1]
Both major phone platforms now hide that factory number by default. Apple's own support documentation, updated December 5, 2025, tells you the device "uses a different MAC address for each Wi-Fi network," and calls the per-network one your private Wi-Fi address.[1] Android's developer documentation is blunter: "For devices running Android 10 or higher, the framework uses a randomized MAC address by default."[3] The setting is per network on both platforms, so one toggle does not decide the whole trip.
Apple's three settings, and which one a hotel gets
Since iOS 18, iPadOS 18, macOS Sequoia 15, watchOS 11, and visionOS 2, the private address is not one setting but three.[1][2]
Off means the device "uses its hardware MAC address," which puts the permanent identifier back on the air.[1] Fixed gives you "a private address that doesn't rotate," and that is the default for new networks using WPA2 or stronger security.[1] Rotating means the device "uses a private address that changes every 2 weeks," the default for new networks using weak or no security.[1]
Hotel networks are captive portals, and Apple's Platform Security guide lists captive portals alongside WPA, OWE, WEP, and open networks as the configurations where the rotating address is the default.[2] So on a current iPhone, joining hotel Wi-Fi hands the operator an address that changes on its own. The setting lives under Settings, then Wi-Fi, then the More Info button beside the network name.[1] Check it every time. A network you joined once at an airport or a coffee shop can still be sitting there set to Off.
One more Apple detail worth knowing at checkout: forgetting the network also drops the private address, "unless it has been less than 24 hours since the last forget."[1] The address is not reused the next time you walk into a property.
Android keeps the address, which is the part people miss
Android has the per-network control in the same place: the Network details screen in Settings.[3] The behavior is different, and for hotel Wi-Fi the difference is the whole story.
Android defaults to persistent randomization. That address "remains the same until a factory reset and does not get re-randomized if you forget and re-add the Wi-Fi network."[3] Forgetting a hotel network on Android, which is the obvious move at checkout, does not produce a fresh identifier on your next stay at the same property. The randomized address is derived from the saved network profile, so a profile you keep is a profile that keeps recognizing you.[3]
Android 12 added a non-persistent mode. The Wi-Fi module re-randomizes at the start of a new connection when the DHCP lease has expired and more than four hours have passed since the device last disconnected, or when the current randomized address for that profile is more than 24 hours old. It never disconnects mid-session to rotate.[3] Android also ships a developer switch for it: Settings, then Developer Options, then "Wi-Fi non-persistent MAC randomization," available on Android 11 and later for every network that has randomization enabled.[3] The Network details screen does not let you choose the mode, only on or off.[3]
What the network can read off your traffic
The address is the entry fee. The rest of what the operator learns comes from name lookups. When your phone or laptop resolves a domain name, that query normally travels in plaintext, where anything on the network path can read it. The IETF's RFC 8484, which defines DNS over HTTPS, states that the protocol "encrypts DNS traffic and requires authentication of the server," which the document says mitigates "passive surveillance."[4] Its abstract describes the change plainly: "This document defines a protocol for sending DNS queries and getting DNS responses over HTTPS."[4]
That distinction matters for what an operator learns. A DNS-over-HTTPS connection does not tell the reader which site you are visiting. A plain DNS query names the site before your encrypted web request ever leaves the device. Content protected by HTTPS stays protected either way, which is why the risk here is a history of where you browsed, not a transcript of what you typed into it.
Toggle for this is DNS over HTTPS or DNS over TLS in your device or browser settings. It costs nothing, works on any network, and it is one of the few privacy switches where nothing about your plan has to change.
The hotel brand is not the network operator
Here is the gap that makes hotel Wi-Fi different from coffee-shop Wi-Fi. When you connect, you are joining a network that a separate company runs, and the chain's privacy policy does not speak for it. Hilton's Global Privacy Statement puts it directly: the company is not responsible for "the collection, use, disclosure, or otherwise processing of personal information by our third-party websites or applications," and that list includes "(1) in-hotel internet services we may offer."[6] The statement does not describe what the network collects or who reads the logs, because the network is not Hilton's.
The consequence for you is practical. The chain's privacy policy is not the notice that applies to the box in the room. The notice that applies is the one printed on the captive portal, often reachable only through the certificate warning your browser shows when it first opens the login page. Read that page. It is the only document in the room that tells you who you are actually talking to.
What the brand does collect once you sign in
The other half is what the chain keeps after you check out. Marriott's U.S. Consumer Privacy Statement lists its stay-related activities, including booking and guest registration and on-site reception and stay services, among the purposes for which it processes personal data. The same statement lists "Internet or network activity information, such as browsing history and interactions with our and other websites and computer systems" among the data it collects.[5]
It also states that it "sells" or shares personal data for marketing and online advertising with recipients it labels Advertising Partners and Authorized Licensees, and that it does so for members and non-members alike.[5] For 2025, the statement puts a number on what that data is worth: it estimates the value of a member's personal data, for the purposes of the California privacy law, at approximately $0.49 per consumer. Opting out runs through the individual rights portal, a phone number, or the Global Privacy Control signal your browser can send.[5]
Be honest about what that sentence does and does not say. It does not say the property Wi-Fi network reports your browsing to the brand. The network is a third party and the brand says so. The link between your stay and your identity is the login you type on the portal, not the traffic that crosses it. Sign in with a personal or loyalty email and you have joined the session to your member profile yourself.
What to change before you connect
Check the private address before you join, not after. iPhone and iPad: Settings, Wi-Fi, then the More Info button next to the network name, then Private Wi-Fi Address.[1] On current versions you get Off, Fixed, or Rotating; Rotating is the one you want on a network with no password.[1] Android: the same per-network switch in the Network details screen.[3]
On Android, do not rely on forgetting the network. Persistent randomization means the saved profile keeps its address until a factory reset.[3] If you want a new identifier on each visit, use the developer option for non-persistent randomization and leave randomization enabled.[3]
Turn on encrypted DNS. DNS over HTTPS or DNS over TLS closes the one part of your browsing the network reads by default.[4]
Read the portal notice. The captive portal page, not the chain's marketing site, is the operator's own statement.[6] If it asks for an email address to get online, decide whether that address is one you want attached to the visit.
Do not sign in with the account that matters. The portal does not need your identity to hand out an address. If a page asks you to log into a personal or loyalty account to reach the internet, close the tab and reconnect without it.
Use a tunnel for anything you would not do on a stranger's network. A VPN moves the traffic off the network you joined. It does not make a fake login page trustworthy, which is the scam that hotel networks are genuinely good at.
What a private address does not buy you
A rotating MAC address is a costume, not a disguise. The network still sees a device join, sees it make requests, and sees it repeatedly if the address rotates slowly. Apple's documentation notes that router administrators are notified when a device first joins with a private address.[1] The presence of a random address does not make you invisible, it makes you harder to follow from one trip to the next, which is the actual goal.
It also does nothing about the portal. A device that identifies itself anonymously still types an email address into a login form when you ask it to. The network part of this problem has a settings menu. The portal part has one rule: read what you are agreeing to before you click.