A screenshot of Apple's privacy Web site, describing its privacy feature on iOS 8.

A highly praised privacy function in Apple's latest operating system that is designed to thwart tracking may not be as effective as originally thought, according to a new post from Bhupinder Misra, a principal systems engineer of the WiFi analytics firm AirTight Networks. The feature, first revealed in June, is designed to prevent unwanted retail tracking that occurs as consumers move around malls and retail shops by randomizing the unique code that smartphones use to identify themselves as they search for nearby WiFi networks.

Misra found that the Apple privacy feature only works on select phones, namely the iPhone 5s, when the phone is locked and location capabilities such as GPS are disabled. That means the privacy protections go away if you use a fitness-tracking app or check your text messages briefly while shopping.  Older iPhone users are also out of luck.

According to Misra, most iPhone users won't benefit from the feature, which is only active when users have disabled all location privacy sharing and their phones aren't in use. That significantly narrows the likelihood that users will use this feature, he said. If, for example, you wake up your phone to send a text message or check Twitter, your phone will still broadcast the unique code -- known as a MAC address -- as normal, even when you're using your carrier’s data connection and not WiFi.

"If you're using the phone, it doesn't randomize," he said in an interview with The Post. "It's only randomizing if the location services are off and [the phone] is in sleep mode. There's only a small percentage of people who would do that."

In his post, Misra also said that the randomization only appears to work with newer devices running iOS 8 -- the iPhone 5s and 5c. He has not yet had the opportunity to test Apple's newest phones, the iPhone 6 and iPhone 6 Plus.

Apple declined to comment on Misra's findings. Location services are turned off by default on new iOS devices; users have the option to turn them on during set-up in order to use location-aware apps such as Maps or Runkeeper.

Privacy has been one way in which Apple is striving to distinguish itself from competitors such as Google and Microsoft. And the randomization feature is one that Apple specifically highlights as a privacy strength on its a page it set up to describe its privacy policies to consumers.

"When you’re out running errands with your phone in your pocket, Wi-Fi hotspots have the ability to track your movements and behavior by scanning your Wi-Fi MAC address," the company's page says. "Because your MAC address now changes when you’re not connected to a network, it can’t be used to persistently track you."

But it's not clear from that blurb -- or the company's privacy policy -- that the feature only works when users have disabled the location tracking that many common apps for mapping, fitness and photo apps often rely on to function.  The company has disclosed those limitations in a publicly available white paper on security, although this does not mention location services.

Misra said that it was difficult, even for him, to figure out exactly how and when randomization will work. "I thought it would be a mainstream feature, where out of the box, it would work," he said. But even as a person familiar with Apple's documentation, he said it was not clear how the feature worked.

Airtight Wireless provides WiFi security and analyzes WiFi data for businesses -- including some customer-tracking features. Hemant Chaskar, the firm's vice president of technology and innovation, said that he doesn't think the Apple privacy feature will hurt his company's ability to do that at all.

A recent study by mobile marketing professionals pointed out that the average smartphone user reaches for his or her phone approximately every 6 minutes, or roughly 150 times per day. So unless you're in and out of the store in that time, they’re going to have a record of your visit.

 

Have more to say about this topic? We take your questions every week in our weekly livechat, Switchback, Fridays at 11 a.m. ET. The comment box is open, so submit your questions now.