BLE Advertising and Privacy: What Bluetooth Devices Broadcast About You

Always Broadcasting

Bluetooth Low Energy devices communicate their existence through advertising. Unlike classic Bluetooth, which requires pairing before any data exchange, BLE devices broadcast advertisement packets on three dedicated advertising channels (37, 38, and 39) continuously. Any BLE receiver within range can see these advertisements without any authentication or pairing.

This is by design. BLE advertising is the mechanism that allows your phone to discover nearby devices, your fitness tracker to be found by its companion app, your smart home hub to detect new sensors, and retail beacons to trigger location-based notifications. The advertising model is fundamental to how BLE works.

But the accessibility of BLE advertisements creates privacy implications that most device manufacturers and users do not fully appreciate. Every BLE advertisement is a radio broadcast that anyone can receive. The content of that broadcast often includes information about the device, its manufacturer, its purpose, and sometimes about the person using it. A passive observer with a BLE receiver can collect advertisements from every BLE device within range - typically 10 to 50 meters indoors and up to 100 meters outdoors.

The number of BLE devices in a typical environment is staggering. A modern smartphone alone may be running a dozen BLE services simultaneously - Bluetooth audio, Find My, handoff, AirDrop, exposure notifications, health monitoring. Add smartwatches, fitness trackers, wireless earbuds, smart home devices, BLE-enabled laptops, and electronic accessories, and a single person might be surrounded by 20 to 50 BLE transmitters at any time. Each one is broadcasting something.

BLE Advertisement Structure

A BLE advertisement packet has a maximum size of 37 bytes of payload data (increased to 255 bytes with BLE 5.0 extended advertising). The payload consists of a series of AD (Advertising Data) structures, each containing a length byte, a type byte, and the data itself.

graph TD
    subgraph Packet["BLE Advertisement Packet"]
        PREAMBLE[Preamble - 1 byte]
        ACCESS[Access Address - 4 bytes]
        HEADER[PDU Header - 2 bytes]
        ADVADDR[Advertiser Address - 6 bytes]
        PAYLOAD[AD Structures - up to 31 bytes]
        CRC[CRC - 3 bytes]
    end
    
    subgraph ADStructures["AD Structure Breakdown"]
        AD1["Flags (AD Type 0x01)"]
        AD2["Complete Local Name (0x09)"]
        AD3["TX Power Level (0x0A)"]
        AD4["Service UUIDs (0x02-0x07)"]
        AD5["Manufacturer Data (0xFF)"]
        AD6["Service Data (0x16)"]
    end
    
    subgraph Privacy["Privacy-Relevant Fields"]
        P1[Device Name - identifies device/owner]
        P2[Manufacturer Data - device model fingerprint]
        P3[Service UUIDs - reveals device capabilities]
        P4[MAC Address - tracking identifier]
        P5[TX Power - distance estimation]
    end
    
    PAYLOAD --> AD1
    PAYLOAD --> AD2
    PAYLOAD --> AD3
    PAYLOAD --> AD4
    PAYLOAD --> AD5
    PAYLOAD --> AD6
    
    AD2 --> P1
    AD5 --> P2
    AD4 --> P3
    ADVADDR --> P4
    AD3 --> P5

BLE advertisement packet structure and the privacy-relevant information contained in each field.

Common AD types include:

Flags (0x01): Indicates the device's capabilities and discoverability mode. Minimal privacy impact, but reveals whether the device supports BLE only or both classic Bluetooth and BLE.

Complete/Shortened Local Name (0x09/0x08): The human-readable name of the device. This is often set by the user or contains a default name that includes the device model. "John's AirPods Pro" reveals both the owner's name and the device type. "Fitbit Charge 5" identifies the exact product.

Service UUIDs (0x02-0x07): The BLE services the device offers. Standard service UUIDs are defined by the Bluetooth SIG and reveal the device's function. UUID 0x180D is the Heart Rate Service. UUID 0x1809 is the Health Thermometer Service. UUID 0x1808 is the Glucose Service. The presence of these UUIDs in an advertisement reveals that the person is using a medical or health monitoring device.

Manufacturer-Specific Data (0xFF): Two bytes of company identifier followed by arbitrary data. This is the most commonly used AD type and the most variable. The company ID identifies the manufacturer, and the data payload can contain anything the manufacturer chooses - device model identifiers, firmware versions, operational states, or proprietary protocol data.

TX Power Level (0x0A): The transmit power of the advertisement, used by receivers to estimate distance. Not directly privacy-sensitive but enables location tracking when combined with signal strength measurements.

What Advertisements Contain

The specific content of BLE advertisements varies dramatically across device categories.

Smartphones broadcast multiple types of advertisements simultaneously. An iPhone broadcasts Find My advertisements (for locating the phone if lost), Nearby/Handoff advertisements (for Apple device continuity features), and potentially AirDrop advertisements. Research by Celosia and Cunche (2020) found that Apple's Continuity protocol advertisements leak information about the device state - whether the phone is locked or unlocked, whether the user is on a phone call, and what type of activity is occurring (active WiFi connection, hotspot mode, etc.).

Wearables (smartwatches, fitness trackers) typically broadcast their model name and available services. A Garmin watch might advertise the Heart Rate Service UUID, revealing that the wearer is monitoring their heart rate. Some devices broadcast the device name continuously, even when not actively in use by a companion app.

Audio devices (earbuds, headphones) broadcast their name and connection state. Apple AirPods broadcast advertisements that include the device model, battery levels for each earbud and the case, and the connection state. Google Fast Pair devices advertise their model ID, which maps to a specific product.

Medical devices are a particular concern. Continuous glucose monitors, insulin pumps, pulse oximeters, and blood pressure monitors often broadcast BLE advertisements that include health service UUIDs. The presence of a Glucose Service UUID (0x1808) in the BLE environment reveals that someone nearby is diabetic and using a continuous glucose monitor. This is sensitive medical information being broadcast to everyone within radio range.

Smart home devices (locks, light bulbs, sensors) broadcast advertisements to be discoverable by hub devices and apps. The advertisements reveal what smart home ecosystem is in use (HomeKit, Matter, Zigbee-over-BLE) and what types of devices are installed.

Manufacturer-Specific Data as Fingerprints

The manufacturer-specific data field (AD type 0xFF) is the most information-rich and most variable part of a BLE advertisement. The first two bytes are the company identifier, assigned by the Bluetooth SIG. Apple is 0x004C. Microsoft is 0x0006. Google is 0x00E0. Samsung is 0x0075.

The remaining bytes are defined by the manufacturer and contain proprietary protocol data. Apple's Continuity protocol, for example, uses the manufacturer data field to carry different message types: proximity pairing (0x07), Handoff (0x0C), Wi-Fi settings (0x0D), Hotspot (0x0E), AirDrop (0x05), and others. Each message type contains different information about the device and user state.

The structure of manufacturer data creates a detailed fingerprint even without knowing the exact content. The length of the data, the message type bytes, and the patterns within the data can identify the device model, firmware version, and operational mode. Two devices of the same model running the same firmware will produce identical manufacturer data structures (though some fields may vary with device state).

This fingerprinting capability means that a passive observer can determine the exact make and model of nearby BLE devices without any interaction. They can distinguish an iPhone 15 Pro from an iPhone 15 Pro Max, a Galaxy Watch 6 from a Galaxy Watch 5, or a Tile Pro from a Tile Mate - all from the advertisement data alone.

Combined with MAC address tracking (even randomized MACs, given the fingerprint adds specificity), manufacturer data creates a rich identifier that is harder to anonymize than a MAC address alone.

Health Device Data Leaks

Health and medical BLE devices represent the most concerning privacy exposure because they reveal sensitive personal health information through their advertisements.

The Bluetooth SIG defines standard GATT (Generic Attribute Profile) services for various health functions. When a device advertises support for these services, it reveals the wearer's medical conditions or health monitoring activities to anyone within BLE range.

Examples of health-revealing service UUIDs:

• 0x1808 - Glucose: User is monitoring blood glucose (diabetic)
• 0x180D - Heart Rate: User is monitoring heart rate
• 0x1810 - Blood Pressure: User is monitoring blood pressure
• 0x1809 - Health Thermometer: User is monitoring body temperature
• 0x181C - Body Composition: User is tracking body composition
• 0x1822 - Pulse Oximeter: User is monitoring blood oxygen
• 0x1826 - Fitness Machine: User is using exercise equipment

Some devices go further, including actual health data values in their advertisement packets. Certain glucose monitors have been found to broadcast current glucose readings in their advertising data, making real-time blood sugar levels visible to any BLE scanner in range. This was not a deliberate design choice but rather a side effect of implementations that prioritized fast data access over privacy.

The health data leakage problem is compounded by the fact that medical devices often have longer advertising intervals and higher TX power than consumer devices, making them detectable at greater distances. A medical-grade BLE pulse oximeter might be detectable at 30 meters or more, broadcasting its service UUID the entire time.

Under regulations like HIPAA (in the US) and GDPR (in the EU), health information is given the highest level of protection. The fact that BLE devices broadcast health service information freely over the air represents a regulatory gap that has not been adequately addressed.

Beacon Protocols: iBeacon, Eddystone, and AltBeacon

BLE beacons are fixed devices that broadcast specific identifiers for proximity detection and location services. Three main beacon protocols exist, each with different data formats and use cases.

iBeacon (Apple) broadcasts a UUID (16 bytes), a Major value (2 bytes), and a Minor value (2 bytes). The UUID typically identifies the beacon network operator (a retail chain, a museum, an airport). Major and Minor identify the specific location within the network. iBeacons are used extensively in retail for proximity marketing, indoor navigation, and foot traffic analytics.

Eddystone (Google, now largely deprecated) supported multiple frame types: Eddystone-UID (similar to iBeacon), Eddystone-URL (broadcasting a URL), and Eddystone-TLM (telemetry data like battery voltage and temperature). The URL frame type was notable for enabling Physical Web experiences where walking near a beacon would trigger a web notification.

AltBeacon (open standard by Radius Networks) uses a similar structure to iBeacon but is vendor-neutral and includes a reference RSSI field for better distance estimation.

Beacons themselves are privacy-neutral in the sense that they broadcast the same data to everyone. But the applications built on beacons can create privacy issues. A retailer using iBeacons to track customer movements through a store knows which aisles you visited, how long you spent in each department, and which products you stood in front of. If the retailer's app is installed on your phone, this physical tracking can be linked to your account and combined with your purchase history.

Tracking via BLE Advertisements

BLE advertisements enable device tracking through several mechanisms.

MAC address tracking is the most direct method. If a device uses a static MAC address (which many IoT devices still do), it can be tracked across time and location using the MAC alone. Even with randomized MACs, the randomization may be imperfect - some devices use the same random MAC for extended periods or reset to the same address after a reboot.

Advertisement content fingerprinting creates a device signature from the combination of AD structures, manufacturer data, service UUIDs, and other fields. This signature is stable across MAC address changes because it reflects the device's hardware and firmware, not its software-assigned address.

Temporal correlation links advertisements from the same device across MAC changes. If a MAC address disappears and a new one appears at the same location with the same signal strength and the same advertisement content pattern, they are almost certainly the same device.

Multi-device correlation groups devices that belong to the same person. If a smartphone, a smartwatch, and a pair of earbuds always appear and disappear together, they likely belong to the same individual. Tracking any one of them tracks the person. This is particularly relevant because a person's set of BLE devices creates a unique ensemble that is highly identifying.

Research by Becker et al. (2019) demonstrated that passive BLE tracking could identify and follow individuals in a shopping mall with 80% accuracy using only advertisement data, even with MAC randomization enabled on all devices. The key was the combination of device ensemble tracking and advertisement content fingerprinting.

BLE MAC Address Randomization

BLE defines four types of addresses, two of which are relevant to privacy:

Public addresses are globally unique, permanent addresses assigned by the IEEE. They are the BLE equivalent of a hardware MAC address. A device using a public address can be tracked indefinitely.

Random addresses come in two varieties. Static random addresses are generated at device startup and remain constant until the device is restarted or powered off. Resolvable private addresses (RPAs) change periodically and can only be resolved (linked to the device's identity) by devices that share an Identity Resolving Key (IRK) established during pairing.

RPAs are the BLE privacy mechanism. When properly implemented, an RPA changes every 15 minutes (configurable), and only paired devices can determine that two different RPAs belong to the same device. A passive observer sees only a stream of unrelated random addresses.

In practice, RPA implementation quality varies. Some devices change their RPA predictably. Some reset to the same sequence after power cycling. Some include enough stable information in their advertisement data to be tracked regardless of address changes. And many IoT devices still use static or public addresses because the developers never implemented privacy features.

The BLE 5.0 specification added improvements including advertising set randomization (different random addresses for different advertising sets on the same device) and improved RPA resolution performance. BLE 5.4 introduced Periodic Advertising with Responses (PAwR), which can reduce the need for connectable advertisements and potentially reduce tracking exposure.

Privacy-Preserving Design Principles

Device manufacturers can significantly reduce BLE privacy exposure by following several design principles.

Minimize advertisement content. Only include data in advertisements that is absolutely necessary for device discovery and connection. Device names, detailed manufacturer data, and service UUIDs should be moved to scan response data (which is only sent when a scanner actively requests it) rather than broadcast in every advertisement.

Use resolvable private addresses. Every BLE device that does not need a permanent public identity should use RPAs with regular rotation. The 15-minute default rotation period is a reasonable compromise between privacy and usability.

Avoid broadcasting health data. Health and medical service UUIDs should not be included in advertisements. Instead, devices should use generic advertisements and reveal their health services only after a secure pairing process.

Randomize advertisement timing. Fixed advertisement intervals create timing patterns that aid tracking. Adding random jitter to advertisement timing makes temporal correlation harder.

Minimize TX power. Use the minimum transmit power necessary for the intended range. Lower TX power reduces the detection range and limits who can observe the advertisements.

Rotate manufacturer data patterns. While hardware capabilities cannot change, the encoding of manufacturer data can be varied across address rotations to reduce fingerprinting.

Assessing Your BLE Exposure

Understanding your personal BLE exposure starts with scanning the environment around you and identifying what your devices are broadcasting.

The BLEShark Nano is designed for exactly this purpose. By scanning all three BLE advertising channels, it captures every advertisement packet from every BLE device in range. The captured data shows you exactly what each device is broadcasting - its address, name, manufacturer data, service UUIDs, and signal strength. This gives you a clear picture of your wireless footprint.

A typical BLE environment assessment involves:

1. Baseline scan: Scan the environment with all your personal devices turned off to identify background BLE traffic from other sources.
2. Device-by-device activation: Turn on each of your devices one at a time and observe what new advertisements appear. This shows what each device contributes to your BLE footprint.
3. Content analysis: Examine the advertisement content for privacy-sensitive information - device names with personal identifiers, health service UUIDs, manufacturer data that reveals device models.
4. Temporal analysis: Monitor how often MAC addresses change and whether advertisement content remains stable across changes. This reveals how trackable each device is despite randomization.
5. Ensemble analysis: Consider the combination of all your BLE devices together. Even if each device is individually hard to track, the unique combination of devices you carry creates a distinctive signature.

The results often surprise people. Most individuals carry more BLE-transmitting devices than they realize, and many of those devices broadcast more information than expected. Awareness is the first step toward making informed decisions about which devices to carry, which features to enable, and what level of BLE exposure is acceptable for your threat model.