You went to a game. You tailgated in the parking lot for two hours, walked to the stadium, found your seat, left at halftime because the traffic gets brutal, and took a different route back to your car than the one the event guide suggested.
The transportation team knew all of that.
Not because you checked in anywhere. Not because you used an app. Not because you connected to any Wi-Fi. Because your phone's Bluetooth radio was on — and it almost certainly was, because your earbuds, your car, your wireless speaker, or your hearing aids need it — and Bluetooth broadcasts a unique device identifier to anything in range, constantly, whether you're using it or not.
I know this because I ran one of these systems.
This article explains how Bluetooth passive scanning works, what it can actually see, and why "I never connected to anything" is no protection against it. It also covers where this technology is deployed today — which is considerably beyond the stadium parking lot.
Most people's mental model of being tracked involves doing something: downloading an app, logging in, connecting to a network, accepting a terms of service. Passive Bluetooth scanning requires none of that. It requires only that your Bluetooth radio is powered on — which, for most people, it always is.
The gap between what people think is required for tracking and what is actually required is where this technology lives. It has been in active use by transportation agencies, municipalities, retailers, and venue operators for over a decade. The equipment is inexpensive, the data is rich, and the people being tracked have no idea it's happening.
That gap is worth understanding.
What Bluetooth actually broadcasts
Every Bluetooth-enabled device — phone, tablet, laptop, wireless headphones, smartwatch — has a hardware address called a MAC address. When Bluetooth is active, the device periodically broadcasts probe signals to discover and connect to known devices. Those signals include the MAC address.
Any Bluetooth receiver in range can log that broadcast. The receiver doesn't need to pair with your device. It doesn't need your permission. It just needs to be listening — and the receivers used for passive scanning are always listening.
Modern phones use MAC address randomization: they generate a temporary, changing address for these probe broadcasts to make passive tracking harder. This is a meaningful protection, and we'll come back to it. But it is not complete protection, and it was not in place for most of the decade this technology has been widely deployed.
What a sensor network looks like
At a stadium event, the setup is straightforward. Bluetooth receivers — small, inexpensive hardware boxes — are placed at defined points throughout the area: parking lot entrances, pedestrian gates, transit stops, major intersections, stadium entry points. Each sensor logs the device identifiers it detects, along with a timestamp.
When the same identifier appears at multiple sensors, you can reconstruct a route. Sensor A at 4:12pm, Sensor C at 4:31pm, Sensor F at 4:45pm — that's a device that took nineteen minutes to walk from the parking lot entrance to the stadium gate, moving through a specific corridor. Multiply that by tens of thousands of devices and you have a detailed picture of how an entire crowd moved through a space.
The system doesn't know your name. It doesn't know what you look like. It knows exactly what you did, when you did it, and how long each part took.
What the data actually reveals
For transportation and event planning purposes, the data answers questions that were previously impossible to answer at scale:
Route compliance. Did visitors follow the suggested pedestrian routes, or did they cut through areas that weren't designed for that volume? Where did the unofficial routes form and why?
Dwell time. How long did people spend in each zone? The tailgate area, the merchandise corridor, the transit waiting area — dwell time tells you whether people are moving efficiently or bottlenecking.
Funnel tracking. Of the devices detected in the tailgate zones, what percentage later appeared at stadium entry sensors? That's your tailgate-to-game conversion. Of the people who parked but weren't detected at tailgate sensors, how many went directly to the game? How many left early?
Deviation flagging. Devices that appeared at entry points but not at expected intermediate sensors took an unplanned route. Cluster enough of those and you've found a path people are using that your plan didn't account for — a gap in a barrier, a shortcut through a service area, a natural flow your designers didn't anticipate.
All of this was used for exactly what it sounds like: planning better traffic flow for the next event, adjusting messaging and physical barriers, understanding how people actually behave versus how the plan assumed they would.
The technology was used for legitimate operational purposes. The point isn't that this particular use was malicious. The point is that the capability exists, was deployed without anyone's knowledge or consent, and is now far more widespread and commercially available than it was a decade ago.
Where this is deployed today
Stadiums and event venues were early adopters, but the technology spread quickly once the value was demonstrated and the hardware costs dropped.
Retail. Large retailers use sensor networks to measure foot traffic patterns the same way — which departments customers walk through, how long they spend near specific displays, which routes lead from the entrance to the checkout. The data informs store layout, product placement, and staffing decisions.
Transit systems. Airports, train stations, and bus terminals use passive scanning to measure platform crowding, boarding patterns, and flow through security checkpoints. It's framed as capacity planning. It is also a complete record of how your specific device moved through the facility.
Smart city infrastructure. Municipalities have deployed sensors on public streets to measure pedestrian and vehicle flow. Some of this data is aggregated and anonymized before storage. Some of it isn't.
Shopping districts and downtowns. Business improvement districts in major cities have funded sensor networks to measure foot traffic on public sidewalks. You don't need to enter a store to be logged.
Airplane mode is not protection. On most phones, Bluetooth continues to function in airplane mode unless you manually disable it after enabling airplane mode. The radio stays on. The broadcasts continue.
The randomization question
MAC address randomization, now standard on modern iPhones and Android phones, makes persistent tracking harder. Your device presents a rotating temporary address to passive scanners rather than its permanent hardware address.
This is genuine progress. A scanner that logs your temporary MAC address today won't be able to match it to the same device tomorrow if the address has rotated.
But there are limits. Within a single event — a few hours in a defined space — your temporary MAC address is typically stable. That's long enough to reconstruct your full route through a venue. And research has shown that devices can sometimes be fingerprinted by the timing, interval, and pattern of their probe broadcasts even when the MAC address itself is randomized. The hardware address changes; the behavioral signature of how the radio operates can remain consistent.
The honest answer is that in dense public spaces, some passive detection is difficult to avoid entirely. But you can make yourself significantly less useful to these systems.
Turn Bluetooth off when you don't need it. This is the only complete solution. If your device isn't broadcasting, it can't be logged. The inconvenience is real — you'll need to reconnect your earbuds when you turn it back on. That trade-off is yours to make.
Don't assume airplane mode is enough. If you use airplane mode for other reasons, check that Bluetooth is actually off. On most phones you have to disable it separately.
Keep your OS updated. MAC address randomization has improved with each major OS version. Running current software means you're getting the best available protection against persistent cross-session tracking.
The surveillance infrastructure in public spaces is real, has been operating for years, and will not disappear. What you control is the signal your device contributes to it.