Two identifiers that operate at different layers
A MAC address identifies a network interface on a local link. It delivers frames between devices on the same segment, and every router that forwards your traffic replaces it with its own. By the time a packet reaches a website, the MAC address it carries belongs to the last router in the chain, not to you.
An IP address identifies an endpoint across networks, and that is what a VPN changes: your traffic emerges from the provider’s server carrying the server’s address. That is a real change and it is what makes a VPN useful.
The confusion is understandable, because both are called addresses. But they never travel together. A website has never been able to see your MAC address, so a VPN cannot hide something that was not exposed.
Who can actually see your MAC address
Your router sees it and logs it. On a home network that is your own equipment. On a café, hotel or workplace network it belongs to whoever runs the network, and the log ties a device to a session.
Anything else on the same segment can see it, because ARP is not authenticated. On an untrusted network that is a genuine consideration, though usually a smaller one than the unencrypted traffic a VPN does protect.
Captive portals use it. When a hotel network remembers you for 24 hours without asking you to sign in again, your MAC address is what it remembered.
- Your router, and its DHCP lease log
- Every other device on the same Wi-Fi or LAN segment
- Captive portals, which use it to remember an authorised session
What does change it: randomisation
Every current mobile platform randomises the MAC address per network by default, precisely to stop shops and venues tracking devices across visits. iOS calls it Private Wi-Fi Address, Android calls it randomised MAC, and both are on unless someone turned them off.
Windows 11 offers random hardware addresses under Settings → Network & Internet → Wi-Fi. macOS 12 and later supports a Private Wi-Fi Address per joined network, configurable in that network’s settings, as well as randomising when probing. Linux can do it through NetworkManager’s cloned-mac-address setting.
If your goal is not being tracked between visits to the same venue, that is the setting to check — not the VPN. The two solve different problems and neither substitutes for the other.
Avoid
- Buying a VPN to hide a MAC address; it does not and cannot
- Disabling MAC randomisation for convenience on networks you do not control
- Assuming a randomised MAC gives anonymity — accounts and logins identify you regardless