Wi-Fi on GrapheneOS is very privacy-friendly and is essentially anonymous as long + as apps do not leak uniquely identifying information to the network. GrapheneOS avoids + allowing itself to be fingerprinted as GrapheneOS, other than connections which are + documented (see the FAQ) and can be easily disabled or forced through a VPN + service.
+ +MAC randomization is always performed for Wi-Fi scanning. Pixel + phones have firmware support for scanning MAC randomization going + significantly beyond a native implementation + On many other devices, there are identifiers exposed by Wi-Fi scanning beyond the MAC + address such as the packet sequence number and assorted identifying information in the + probe requests.
+ +Avoid using hidden APs (i.e. APs not broadcasting their SSID) since known hidden + SSIDs end up being broadcast to find them again. SSIDs are not broadcast for standard + non-hidden APs.
+ +Wi-Fi and Bluetooth scanning for improving location detection are disabled by + default, unlike the stock OS. These can be toggled in Settings ➔ Location ➔ Wi-Fi and + Bluetooth scanning. These features enable scanning even when Wi-Fi or Bluetooth is + disabled, so these need to be kept disabled to fully disable the radios when Wi-Fi and + Bluetooth are disabled. GrapheneOS doesn't yet have an implementation of a coarse + location service to supplement GPS location, so enabling these options doesn't + actually do anything at the moment. Implementing a supplementary location service is + planning but we need a robust, secure and private implementation via a local database. + The initial focus will likely be a cell phone tower database, so these features still + wouldn't be relevant.
+ +The DHCP client uses the anonymity profile rather than sending a hostname so it + doesn't compromise the privacy offered by MAC randomization.
+ +Associated MAC randomization is performed by default. This can be controlled + per-network with Settings ➔ Network & Internet ➔ Wi-Fi ➔ <network> ➔ + Advanced ➔ Privacy.
+ +In the stock OS, the default is to use a unique persistent random MAC address for + each network. It has 2 options available: "Use randomized MAC (default)" and "Use + device MAC". In GrapheneOS, the default is generating a new random MAC address when + connecting to a network. It has 3 options available: "Use per-connection randomized + MAC (default)", "Use per-network randomized MAC" and "Use device MAC".