I checked the terminology: Apple uses Private Wi-Fi Address, and Android/Samsung commonly use Randomized MAC or Use device MAC. Apple confirms it is per-network; Android documentation also describes per-network MAC randomisation behaviour. (Apple Support)
Network-based parental controls can be extremely effective when they are set up properly. A good firewall can manage screen time, block gaming, restrict social media, filter content, monitor usage, and apply different rules to different people in the household.
However, there is one modern privacy feature that often causes confusion: MAC address randomisation.
This feature is useful, and it exists for good reasons. But on a home network, it can also stop parental controls from working as expected.
This guide explains what MAC address randomisation is, why it exists, why it can interfere with parental controls, and how to configure your home network so your firewall can reliably recognise each device. If you want the broader platform context first, see our Firewalla overview and our Firewalla parental controls guide.
What Is a MAC Address?
Every device that connects to a network has a hardware identifier called a MAC address.
MAC stands for Media Access Control. In simple terms, it is a unique network identity used by phones, tablets, laptops, games consoles, smart TVs, and other connected devices.
A firewall or router uses this identity to recognise which device is which.
For example, a firewall may see:
- Child’s iPhone
- Child’s iPad
- PlayStation
- Xbox
- School laptop
- Parent’s phone
- Guest device
Once the firewall recognises a device, it can apply rules to it.
Those rules might include:
- Bedtime schedules
- Gaming restrictions
- Social media blocking
- Adult content filtering
- YouTube or streaming restrictions
- Time limits
- Monitoring and reporting
This works well when the device always presents the same MAC address.
The problem starts when the device changes its identity.
What Is MAC Address Randomisation?
MAC address randomisation is a privacy feature built into modern phones, tablets, laptops, and other devices.
Instead of always using the same MAC address on every Wi-Fi network, the device can generate a different address for different networks.
Apple refers to this as Private Wi-Fi Address.
Android and Samsung devices usually refer to it as Randomized MAC, MAC randomisation, or may give you the choice between Randomized MAC and Phone MAC / Device MAC.
Apple helped popularise this feature, and it is now common across many modern devices.
Why Does MAC Address Randomisation Exist?
MAC address randomisation exists to improve privacy.
Before this feature became common, a device would often use the same MAC address everywhere it connected.
That meant the same phone could potentially be recognised across multiple Wi-Fi networks, such as:
- Hotels
- Airports
- Shopping centres
- Coffee shops
- Public hotspots
- Schools
- Offices
From a privacy point of view, that is not ideal.
If a device always presents the same identity, it becomes easier for networks to recognise that device when it appears again.
MAC address randomisation helps reduce that type of tracking by using a different network identity.
For public Wi-Fi, this is a good thing.
For home parental controls, it can create problems.
Why MAC Randomisation Interferes with Parental Controls
Most firewall-based parental control systems identify devices by their MAC address.
That means the firewall says, in effect:
“This MAC address belongs to this child’s device, so these rules should apply.”
If the device changes its MAC address, the firewall may no longer recognise it.
To the firewall, it can look like a completely new device has joined the network.
As a result:
- Existing parental control rules may no longer apply
- Gaming restrictions may be bypassed
- Social media blocks may stop working
- Screen time schedules may not apply
- Monitoring may become inaccurate
- The device may appear twice in the firewall app
- Parents may think the firewall has stopped working
In most cases, the firewall has not failed.
It simply no longer knows that the “new” device is actually the same phone, tablet, or laptop using a different MAC address.
A Common Example
A child’s iPhone is added to a parental control profile.
The firewall blocks gaming after 8pm.
Everything works correctly.
Then the child forgets the home Wi-Fi network and reconnects to it.
The phone may rejoin using a private or randomised Wi-Fi address.
The firewall now sees it as a new device.
The old parental control rules are still attached to the old device identity, but the phone is now using a new one.
That can make it look as though the parental controls have been bypassed.
The Correct Fix: Turn Off MAC Randomisation on the Home Network
The correct fix is to disable MAC randomisation for your trusted home Wi-Fi network.
This allows the device to use its normal, consistent identity on your home network so the firewall can apply the right rules.
This does not mean you have to disable privacy features everywhere.
It only needs to be changed for your own home Wi-Fi network.
Does This Reduce Privacy Everywhere?
No.
This is an important point.
On modern devices, MAC randomisation settings are normally applied on a per-network basis.
That means if you turn off Private Wi-Fi Address on an iPhone for your home Wi-Fi, you are only changing the setting for that specific Wi-Fi network.
The device can still use private or randomised addresses on:
- Public Wi-Fi
- Hotels
- Airports
- Coffee shops
- Shopping centres
- Schools
- Universities
- Offices
- Other networks
You are not turning off privacy globally.
You are simply telling the device:
“On this trusted home network, use your normal identity so parental controls can work properly.”
For most families, this is the right balance.
You keep privacy protection where it matters most, while allowing your home firewall to recognise and manage devices reliably.
What About the Privacy Warning?
After turning off Private Wi-Fi Address or Randomized MAC, some devices may show a privacy warning.
The wording varies depending on the device.
It may say something like:
- Privacy warning
- This network can track your device
- Private Wi-Fi address is off
- Randomized MAC is disabled
- This network has reduced privacy
This can look alarming, but on your own home network it is normally expected.
The warning does not usually mean your Wi-Fi has been hacked, compromised, or made unsafe.
It is simply telling you that the device is using its normal network identity on that Wi-Fi network.
That is exactly what you want for firewall-based parental controls.
As long as your home Wi-Fi is protected with a strong password and modern encryption such as WPA2 or WPA3, turning off MAC randomisation for your own home network is normally fine.
How to Turn It Off on Apple Devices
Apple calls this feature Private Wi-Fi Address.
On iPhone or iPad:
- Open Settings
- Tap Wi-Fi
- Tap the information icon next to your home Wi-Fi network
- Find Private Wi-Fi Address
- Turn it off for your home network
- Reconnect to Wi-Fi if prompted
On some newer Apple software versions, you may see slightly different wording or additional privacy options, but the setting you are looking for is Private Wi-Fi Address.
Do not confuse this with Limit IP Address Tracking. That is a separate privacy feature and is not the main setting that affects firewall device identification.
For parental controls, the key setting is Private Wi-Fi Address.
How to Turn It Off on Samsung and Android Devices
Android wording varies between manufacturers and software versions.
On many Samsung and Android devices, the setting may be called:
- Randomized MAC
- MAC randomisation
- Privacy
- MAC address type
- Use randomized MAC
- Use phone MAC
- Use device MAC
The general process is usually:
- Open Settings
- Go to Connections or Network & Internet
- Tap Wi-Fi
- Tap your home Wi-Fi network
- Open the network settings or advanced settings
- Look for MAC address type or Privacy
- Change from Randomized MAC to Phone MAC or Device MAC
- Reconnect to Wi-Fi if needed
The exact wording varies, but the aim is the same: use the device’s real MAC address on your trusted home network.
Why This Alone Is Not Enough
Turning off MAC randomisation solves the main problem, but there is still a loophole.
A child may be able to:
- Forget the Wi-Fi network
- Rejoin the Wi-Fi network
- Re-enable Private Wi-Fi Address or Randomized MAC
- Appear as a new device
- Avoid the existing parental control rules
This is why a good firewall setup should not rely only on changing the setting on the device.
You also need a rule for new and unknown devices.
The Best Practice: Use a Quarantine Group
The best way to close this loophole is to use a quarantine group for new devices.
This is a feature available on firewall platforms such as Firewalla.
If you are deciding whether the platform fits your household, the Firewalla parental controls guide is a good companion read.
The idea is simple:
Any new or unknown device that joins the network is automatically placed into a restricted group.
That group can have its own rules.
For example, the quarantine group might block:
- Gaming
- Social media
- Adult content
- Streaming
- App stores
- VPN services
- Known bypass tools
This means that if a child forgets the Wi-Fi and rejoins using a randomised MAC address, the firewall does not simply allow unrestricted access.
Instead, the device is treated as unknown and placed into quarantine.
Should the Quarantine Group Block Everything?
There are two main approaches.
Option 1: Block All Internet Access
This is the strictest option.
Any new device that joins the network gets no internet until it is approved.
This is very secure, but it can be inconvenient.
For example, if a guest visits your home and connects to Wi-Fi, their device may not work until you manually approve it.
Option 2: Block Gaming and Social Media
For most homes, this is the more practical option.
Instead of blocking all internet access, the quarantine group blocks the services that matter most for parental control.
This might include:
- Gaming
- Social media
- Adult content
- Streaming platforms
- High-risk apps
Guests can still use basic internet access, messaging, email, browsing, and work-related services.
But if a child is trying to bypass restrictions by reconnecting as a “new” device, the result is not very useful to them.
They may get basic internet, but not the things they were trying to access.
For most households, this is the best balance between security and convenience.
How This Stops Bypass Attempts
Here is how the setup works in practice.
A child’s device is correctly added to the firewall.
Private Wi-Fi Address or Randomized MAC is turned off.
The device is added to the correct parental control profile.
The child later forgets the Wi-Fi network and reconnects.
If the device appears with a new MAC address, the firewall treats it as a new device.
Instead of getting normal access, it is placed into the quarantine group.
The quarantine group blocks gaming and social media.
The child now has limited access.
To restore normal access, the device needs to be identified, MAC randomisation needs to be turned off again, and the device needs to be moved back into the correct parental control profile.
This does not make bypassing impossible, but it removes one of the most common and easiest loopholes.
Recommended Home Setup
For a reliable parental control setup, we normally recommend the following approach:
- Use a proper firewall with device-level parental controls.
- Create profiles for each child or device group.
- Turn off Private Wi-Fi Address on Apple devices for the home Wi-Fi.
- Turn off Randomized MAC on Android and Samsung devices for the home Wi-Fi.
- Add each device to the correct parental control profile.
- Enable quarantine for new or unknown devices.
- Configure the quarantine group to block gaming, social media, and unsuitable content.
- Review new devices regularly.
- Keep the Wi-Fi password private where appropriate.
- Avoid relying only on device-based parental controls.
This gives you a much more stable setup.
The firewall can recognise each device properly, apply the right rules, and stop unknown devices from quietly bypassing restrictions.
Important Note: This Is About the Home Network Only
It is worth repeating this point.
Turning off MAC randomisation on your home network does not mean your child’s phone or laptop loses privacy protection everywhere.
The setting is normally specific to that Wi-Fi network.
On public Wi-Fi, hotels, airports, cafés, and other networks, the device can continue using private or randomised addresses.
For a trusted home network, using the real device identity is usually the correct choice because it allows parental controls, monitoring, and security policies to work properly.
Final Thoughts
MAC address randomisation is a useful privacy feature.
It was designed to make devices harder to track across different Wi-Fi networks, especially public networks.
The issue is that the same privacy feature can unintentionally interfere with home parental controls.
If your firewall suddenly seems to stop applying rules to a child’s device, MAC randomisation is one of the first things to check.
The best setup is simple:
- Keep MAC randomisation enabled for public networks
- Turn it off for your trusted home Wi-Fi
- Use a firewall profile for each child or device
- Put new devices into a quarantine group
- Block gaming and social media for unknown devices
- Review the Firewalla overview for setup context when you are planning the network
This gives families a practical balance between privacy, security, and reliable parental controls.
FAQ
1. Is turning off Private Wi-Fi Address unsafe?
Not normally, provided you are only turning it off for your own trusted home Wi-Fi network.
Your device may show a privacy warning, but that warning is usually just telling you that the device is using its normal network identity on that network.
For parental controls to work properly, the firewall needs that consistent identity.
2. Does turning off MAC randomisation affect public Wi-Fi privacy?
No, not if you only change the setting for your home network.
Modern devices normally manage this per Wi-Fi network.
That means you can use the real device MAC address at home while still using private or randomised addresses on public Wi-Fi networks.
3. Why does my child’s device keep appearing as a new device?
This is often caused by Private Wi-Fi Address or Randomized MAC being enabled.
If the device changes its MAC address, the firewall may think it is a completely new device.
Forgetting and rejoining the Wi-Fi network can also trigger this behaviour.
4. Should I block all internet access for quarantined devices?
You can, but it may be inconvenient.
A more practical option for many homes is to allow basic internet access but block gaming, social media, adult content, and other restricted services.
That way, guests can still use the Wi-Fi, but children cannot easily bypass parental controls by reconnecting as a new device.
5. Why not just use parental controls on the phone or tablet itself?
Device-based parental controls can be useful, but they are not always enough.
Network-based parental controls add another layer by applying rules at the firewall level.
This is especially helpful for games consoles, smart TVs, tablets, laptops, and devices where built-in parental controls may be limited or inconsistent.
