Your phone, watch, earbuds, and car key are all talking constantly — Wi-Fi, Bluetooth, and short-range radios like NRF24 — whether or not anything is "connected" to anything. That chatter is enough to fingerprint and follow a specific person through a store, a station, or a whole city, without ever learning their name.
TL;DR Your devices introduce themselves to every receiver nearby, constantly.
None of this requires you to log into anything. It just requires your devices to be turned on.
Every few seconds, your phone quietly asks the air "is any network I know nearby?" — a probe request, sent whether or not you're connected to anything. Retailers, malls, and transit systems collect these to count and route foot traffic.
Earbuds, watches, fitness trackers, and phones broadcast BLE advertising packets to announce themselves for pairing and to power "find my device" networks — audible to any BLE receiver nearby, not just the device you're paired with.
Cheap, low-power 2.4GHz radios (the NRF24 family) run a huge share of the physical beacon infrastructure — the small transmitters bolted under store shelves and near entrances that estimate your position by how strongly your device's signal lands at each one.
iOS and Android both rotate the MAC address your device broadcasts, specifically to stop exactly this kind of tracking. But probe requests and BLE ads carry more than an address: timing between packets, supported-rate lists, and vendor-specific fields form a fingerprint of their own. One 2023 field study found over 47% of BLE devices in public spaces were still re-identifiable across randomized addresses using this kind of fingerprint.
A single receiver only knows you're somewhere close. Three or more — which is normal in a modern retail store or transit hub — can triangulate a position accurate to a few meters, then stitch consecutive positions into a full walking path.
TL;DR Add noise, don't jam. One is legal and useful; the other is a felony.
If a unique, stable signal is what makes you trackable, the countermeasure researchers keep landing on is the same one used elsewhere in this toolkit: noise. Instead of going silent — which isn't really possible without leaving your devices at home — broadcast enough additional, harmless identifiers that no single one of them can be trusted as "you."
Researchers have built prototype defenses on top of Android (like SABLE, "Securing Address for BLE") that harden MAC randomization itself, and studied how probe requests get re-linked across address changes (the Cappuccino line of research) specifically to close those gaps. This is upstream, standards-level work — nothing to install yourself, but it's the reason your phone's built-in randomization keeps improving.
Research, not a productSmall ESP32-based hardware toolkits (the current reference example is the open-source nyanBOX project) include an "iBeacon Spoofer" mode that rebroadcasts extra, duplicate beacon identifiers into the environment — the goal is to reduce a positioning system's confidence in any one signal, not to disrupt other people's devices.
Hardware kit, ~$30–50 in partsThe same class of toolkit can generate a stream of fake beacon frames carrying randomized device identities, mixed in with your device's real traffic. Use this in "spam," not "DoS," mode — see the caution below on where this line actually matters.
Read the caution below firstBroadcasting extra, harmless identifiers is not the same thing as jamming. Adding noise — more beacon frames, more decoy addresses — is just your own radio transmitting slightly more than usual, under the same unlicensed rules (FCC Part 15 in the US) every Wi-Fi and Bluetooth device already operates under.
Jamming — intentionally overpowering or blocking other people's signals — is federal crime in the US (47 U.S.C. §333), independent of intent, and it's also what most "nRF24 jammer" projects you'll find alongside these tools are actually built to do. We're intentionally not linking those here. If a project's own description mentions disrupting other devices, Bluetooth, drones, or Wi-Fi rather than adding your own decoy traffic, it's a jammer, not a privacy tool.
Similarly, skip any "DoS mode" toggle on a beacon-spam tool — flooding other people's phones with pairing pop-ups protects no one and is a nuisance attack on bystanders, not a privacy technique. The goal here is noise around your own signal, not disruption of someone else's.
Everything on this page sits on top of the software-side noise covered in the toolkit's "Feed it noise" section — same logic, different layer.