I would like to ask about what kind of information that they can collect from this?
Having your MAC address facilitates in analyzing log files.
Network log files often contain an IP address and some information about the connection.
For example, the following fictional log entry would indicate that a device with the IP address 10.10.100.123 connected to a system with the IP address 220.127.116.11 (google.com) on port 443 (HTTPS).
TIMESTAMP | SOURCE IP:PORT | DEST IP:PORT
2016-08-05 12:11 | 10.10.100.123:123456 | 18.104.22.168:443
Further research in other log files (e.g. DHCP leases) could indicate that the internal IP address 10.10.100.123 was handed out to the MAC address 01:23:45:67:89:01.
IP ADDRESS | MAC ADDRESS | LEASE START | LEASE END
10.10.100.123 | 01:23:45:67:89:01 | 2016-08-03 09:35 | 2016-08-10 09:35
That MAC address can then be matched to the network adapter of the device of a certain student.
This allows the school, or any authority that is able to request the school's log files (e.g. Law Enforcement agencies), to trace back certain online activities.
If some criminal investigation shows that the public IP address of the school is linked to certain illegal activities, the school could be requested to hand over their log files and list of 'MAC address - student' combinations.
It could also be the case that the school wants to track down which student spent 10% of their bandwidth on browsing 18+ websites.
Whether this information can be used for these reasons depends on local legislation in regards to privacy and computer crime.
Would they be able to track our browsing history or more?
They cannot detect your complete browser history using this information. However, as I explained before, the MAC address could be used to link your device to certain activity on the network.
What if I use Tor Browser? Would it have any effect?
Using Tor does not change anything to the fact that your device's network adapter has a certain MAC address and that this MAC address could be linked to your device and to you.
If they can track me, what measures can I take to prevent them from invading my privacy?
It is fairly trivial to change the MAC address of your device's network adapter(s). Changing your MAC address after having handed them your original one (or providing them with a fake one), makes it more difficult for the IT administrators to link an MAC/IP address to you.
However, if the network requires identification through Active Directory (each student having a unique username to authenticate to the network) or some other form of authentication (e.g. certificate based), they'd still be able to check the logs files to try to match an IP to you.
If the school uses a proxy, they could also sniff web traffic in search for Personally Identifiable Information, such as your email address or Facebook username, ... But I suppose this would be a huge breach of privacy regulations in most countries.
It could also be the case that your school wants to implement MAC address based access control on the network, allowing only whitelisted (allowed) MAC addresses to connect to the network.
However, as others have pointed out (and as I have touched upon slightly), MAC addresses can be edited. This allows anyone to change their own MAC address to that of a legitimate student, granting them access to the network.
MAC address based access controls will stop some people from being able to access the network using the password they received from a friend at your school (as they don't have the knowledge/skills to bypass this weak line of defense), but it won't stop those who are determined to access the network.
If the school is serious about wanting to track student's network usage and/or want to limit access to students only, there are much better alternatives available.
One example of this is RADIUS authenticated WiFi.
Extract from: FreeRadius.org
IEEE 802.1X and RADIUS Authentication
The IEEE standards for Wi-Fi (IEEE 802.11) foresee an "Enterprise"
mode which is fundamentally different from PSK networks because the
Wi-Fi encryption keys are provisioned per user and per session. Every
user needs to authenticate with their personal credentials; at that
moment a key is generated and is communicated to the user's device
and the NAS they connect to.
Before users send their authentication credentials, the the user must
authenticate the network, proving that it is indeed genuine; only then
is the client's credential released. The IEEE standard IEEE 802.1X
(using RADIUS and the Extensible Authentication Protocol, EAP) is used
for authentication and key management.
Enterprise Wi-Fi authentication also enables advanced features such as
putting users dynamically into a specific VLAN (e.g. separate guest
and staff logins into different IP networks even though being on the
same SSID), and dynamic ACLs
Enterprise Wi-Fi requires:
- A RADIUS server which can do EAP authentication.
- Wi-Fi equipment which is correctly configured to use RADIUS authentication.
- User devices configured to do Enterprise Wi-Fi correctly.