Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?

closed as off-topic by Sjoerd, Steffen Ullrich, Matthew, Josef, Anders Feb 6 '18 at 12:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Sjoerd, Anders
If this question can be reworded to fit the rules in the help center, please edit the question.

  • "collect user's data through obtaining mac address" can you explain what exactly that means? Can you re-phrase that? – schroeder Feb 6 '18 at 9:42
  • 2
    I'm voting to close this question as off-topic because it is only about legal aspects. Please try law.stackexchange.com instead. – Steffen Ullrich Feb 6 '18 at 9:46
  • Illegal, probably not. Immoral, absolutely. – user258572 Feb 6 '18 at 13:08

Specific laws

The one US statute that clearly states that IP and MAC addresses are personal information is the Children's Online Privacy Protection Act (COPPA). In 2013, the FTC revised the COPPA Rule, which defines "personal information" as "individually identifiable information about an individual collected online," as specifically including IP addresses, MAC addresses, and other unique device identifiers. The Health Insurance Portability and Accessibility Act (HIPAA) includes device identifiers (such as MAC addresses) and IP addresses as "identifiers" that must be removed in order to de-identify protected health information. State security breach notification laws define personal information, but those laws do not include IP address, MAC address, or other device identifier as PII.

The FTC's view

In April, Jessica Rich, the Director of the FTC's Bureau of Consumer Protection, wrote on the FTC's business blog about cross-device tracking. In her remarks, she restated the FTC's long-held position that data is personally identifiable, "and thus warranting privacy protections, when it can be reasonably linked to a particular person, computer, or device. In many cases, persistent identifiers such as device identifiers, MAC addresses, static IP addresses, or cookies meet this test." She then specifically cited the FTC's 2013 amendments to the COPPA Rule as an example of this in practice. Director Rich's comments signal that the FTC views IP and MAC addresses, and other unique device identifiers, in a similar manner as the Office of the Privacy Commissioner of Canada -- if it can be associated with an identifiable individual, it should be considered personal information.


  • GDPR says something similar. So, not illegal to collect. Potentially should have special protections if processed in certain ways. – schroeder Feb 6 '18 at 9:44
  • Thanks for the reply. Any chance you know some companies actually doing this? – Patrick Zhou Feb 6 '18 at 9:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.