Your Wi-Fi Router Is on Apple's Map: How Wi-Fi Location Works, and How to Opt Out with _nomap

Your Wi-Fi router is on Apple's map. And Google's. Probably both.

You didn't add it. You don't need to own an Apple device or a Google phone. If anyone near you does, and they have location services on, your router's hardware identifier and your home's location were likely sent to a crowd-sourced database. That database is used for location services, the technology that helps phones and tablets determine where they are when GPS is unavailable or slow. It's also used by anyone who queries the database and supplies nearby Wi-Fi identifiers.

Over the course of a year, two University of Maryland researchers querying Apple's Wi-Fi positioning system learned the precise locations of over 2 billion Wi-Fi access points. They reported precision "on the order of meters," often enough to "identify individual homes or businesses." They tracked routers moving between cities and countries, potentially revealing their owners' relocations. For people fleeing intimate partner violence or stalkers, the researchers wrote, "their router simply being online can disclose their new location" (Erik Rye and Dave Levin, "Surveilling the Masses with Wi-Fi-Based Positioning Systems," IEEE Symposium on Security and Privacy, 2024).

Apple and Google both offer an opt-out. To use it, you add "_nomap" to the end of your Wi-Fi network name. Here's how it works, what the researchers found, and how to opt your router out.

#How Wi-Fi location works

When you open a map app on your phone, or when an app asks for your location, your phone needs to figure out where you are. GPS works well outdoors, but indoors or in dense urban areas, it's slow or unavailable. So phones use another method called Wi-Fi positioning.

Your phone scans for nearby Wi-Fi networks. It doesn't connect to them. It just sees them, the same way you see a list of available networks when you open your Wi-Fi settings. Each Wi-Fi router broadcasts a unique identifier called a BSSID (Basic Service Set Identifier), which is the router's hardware address. It looks like this: 3C:7A:9F:21:B4:08.

Your phone sends the list of nearby BSSIDs to a location service, Apple's or Google's, depending on your phone. The service looks up those BSSIDs in a database and returns a location based on where those routers were previously seen. Your phone now knows where you are, usually within a few meters.

The database is crowd-sourced. Every time a phone with location services on detects a Wi-Fi network, it can send that network's BSSID and the phone's GPS location to the database. Over time, millions of devices contribute location data for millions of routers. The database grows, and Wi-Fi positioning gets more accurate.

You don't opt in. If you have a Wi-Fi router, and someone near you has a phone with location services on, your router is likely already in the database.

#What the University of Maryland researchers found

In 2024, Erik Rye and Dave Levin from the University of Maryland published a study on Wi-Fi-based positioning systems. They queried Apple's Wi-Fi positioning API over a year, from November 2022 to November 2023, and learned the precise locations of over 2 billion BSSIDs.

Apple's API, they reported, returns up to 400 nearby BSSIDs per request. The precision is "on the order of meters." In many cases, the researchers wrote, the location data is precise enough to "identify individual homes or businesses."

The researchers also found that "people who own no Apple products ... can have their AP in Apple's WPS merely by having Apple devices come within Wi-Fi transmission range." You don't need to own an Apple device. You just need to be near someone who does. As University of Maryland researcher Erik Rye told Krebs on Security in May 2024, "You may not have Apple products, but if you have an access point and someone near you owns an Apple device, your BSSID will be in [Apple's] database" (Krebs on Security, "Why Your Wi-Fi Router Doubles as an Apple AirTag," May 21, 2024).

The study included case studies on Ukraine, Gaza, and the 2023 Maui fires, showing how router location data could reveal sensitive movements. The researchers specifically highlighted the risk for people fleeing domestic violence or stalkers, writing that "their router simply being online can disclose their new location."

Routers that move are especially trackable. The researchers observed routers moving between cities and countries, revealing their owners' relocations. Travel routers (the researchers mentioned GL.iNet models) move frequently. Mobile hotspots from phones use randomized BSSIDs per connection, making them less trackable. Starlink, the researchers reported, began randomizing BSSIDs in 2023.

After the study was published, Krebs on Security reported that Apple updated its support page in March 2024 to document the _nomap opt-out and said it had respected _nomap "for some time" before that (Krebs on Security, May 21, 2024). The researchers did not claim the surveillance method still works unchanged in 2026 or that Apple still returns 400 BSSIDs per request today. What we know is what the researchers reported in 2024 based on 2022-2023 data, and that Apple said it was making changes.

#How to opt out with _nomap

Apple and Google both recognize a simple opt-out: add "_nomap" to the end of your Wi-Fi network name (SSID).

Apple's support page, "Location Services and Privacy," states: "The owner of a Wi-Fi access point can opt it out of Apple's Location Services by changing the access point's SSID (name) to end with '_nomap.' For example, 'Access_Point' would be changed to 'Access_Point_nomap.' This prevents devices from sending the access point's location to Apple" (Apple Support, "Location Services and Privacy," 2026). The same page notes, "This opt-out doesn't work for hidden networks."

Google's Maps Help page, "Manage your Wi-Fi access point and Google's Location services," says: "To opt out, change the SSID (name) of your Wi-Fi access point ... so that it ends with '_nomap.'" Google gives the example of changing "12345" to "12345_nomap." For ISP-provided routers, Google advises contacting your ISP. Google also notes that "each location provider operates independently" and that Google "encourage[s] other providers to respect the '_nomap' convention" (Google Maps Help, "Manage your Wi-Fi access point and Google's Location services," 2026).

Apple's documentation says the crowd-sourced location data is encrypted and doesn't personally identify you. The opt-out prevents your router from being added to new location reports, but it may not immediately remove your BSSID from existing databases.

#How to add _nomap to your Wi-Fi network name

Here's how to rename your Wi-Fi network to add the _nomap suffix. The exact steps depend on your router, but the process is similar for most home routers.

#For most home routers

1. Open your router's admin page or app. Common addresses are 192.168.1.1, 192.168.0.1, or 192.168.1.254. Some routers (like those from Eero, Google Nest, or TP-Link) have mobile apps. Your ISP may also provide an app for your router.
2. Log in with your router's admin username and password. If you haven't changed it, the default credentials are often printed on a label on the router, or in the manual.
3. Find the Wi-Fi settings, wireless settings, or SSID settings.
4. Locate the SSID (network name) field. If your router has separate 2.4 GHz and 5 GHz networks with different names, you'll need to rename both.
5. Add "_nomap" to the end of the network name. For example, change "Home_WiFi" to "Home_WiFi_nomap".
6. Save the changes. Your router may restart.
7. Reconnect all your devices to the renamed network. You'll need to forget the old network name and join the new one.

#For ISP-provided routers

If your router is provided by your internet service provider (Comcast, Verizon, AT&T, etc.) and you cannot access the admin page or the page does not allow you to change the SSID, contact your ISP's customer support and ask them to add "_nomap" to your network name.

#Important notes

• Renaming your network means every device must reconnect. Phones, laptops, smart TVs, smart home devices, printers, and anything else connected to your Wi-Fi will lose connection when you rename the network. You'll need to go to each device, forget the old network, and connect to the new one.
• Hidden networks cannot use _nomap. If your network is hidden (SSID broadcast is disabled), the opt-out will not work. You must make your network visible for _nomap to be effective.
• Rename all bands. If your router has separate SSIDs for 2.4 GHz and 5 GHz, add "_nomap" to both.
• Travel routers and mobile hotspots. If you use a travel router, add _nomap to its SSID, or choose a model that randomizes its BSSID. Phone hotspots typically use randomized BSSIDs by default, making them harder to track.

#Why this matters

Wi-Fi positioning systems are useful. They help your phone figure out where you are when GPS is slow or unavailable. But they also mean your Wi-Fi router can be used to locate your home or business, track when and where a router moves, and potentially reveal someone's new address.

The University of Maryland researchers documented how the system can be used for surveillance. They tracked routers moving across countries. They highlighted the risk for people fleeing domestic violence, stalkers, or other threats, for whom "their router simply being online can disclose their new location."

The _nomap opt-out is simple, but most people don't know it exists. Apple added documentation for it in March 2024. Google has documented it since at least 2016. But unless you're looking for it, you won't find it. Most people don't know their router is in a crowd-sourced location database, let alone that they can opt out.

Adding _nomap takes five minutes. It won't remove your router from existing database entries immediately, but it will stop new location reports from being sent. If you're concerned about your router's location being tracked or shared, or if you move your router frequently, adding _nomap is a straightforward step.

#Other ways to protect your location privacy

Adding _nomap to your Wi-Fi network name is one step. Here are a few others:

#Turn off location services when you don't need them

On iPhone, go to Settings, Privacy & Security, Location Services, and either turn Location Services off entirely or review which apps have access and set them to "While Using the App" or "Never." On Android, go to Settings, Location, and turn off location, or tap App permissions and review which apps can access your location.

When location services are off, your phone won't contribute to crowd-sourced Wi-Fi location databases.

#Use a VPN

A VPN encrypts your internet traffic and hides your IP address, making it harder for websites, apps, and internet providers to see what you're doing online or where you are. A VPN doesn't stop Wi-Fi positioning systems from detecting your router's BSSID, but it does add a layer of privacy for your internet activity.

#Review your router's other privacy settings

Some routers broadcast additional information, like UPnP (Universal Plug and Play) services that can be detected from the internet. Check your router's security settings, disable features you don't use, and make sure your router's firmware is up to date.

#Conclusion

Your Wi-Fi router is likely already on Apple's and Google's maps. Over 2 billion BSSIDs were in Apple's database as of 2024, according to University of Maryland researchers. Your router can reveal your location to within meters, often precise enough to identify your home or business. Routers that move can reveal relocations, including for people fleeing domestic violence or stalkers.

Apple and Google both honor the _nomap opt-out. Add "_nomap" to the end of your Wi-Fi network name (for example, "Home_WiFi_nomap") to prevent devices from sending your router's location to crowd-sourced databases. Rename all bands (2.4 GHz and 5 GHz) if they have separate names. Hidden networks cannot use this opt-out.

It takes five minutes, and every device will need to reconnect, but it's a simple, documented way to opt your router out.

UndoLeak erases your data from data brokers and keeps it off.

If you want to see where else your personal information is listed, run a free scan.

#Sources

1. Erik Rye and Dave Levin, University of Maryland, "Surveilling the Masses with Wi-Fi-Based Positioning Systems", IEEE Symposium on Security and Privacy (2024)
2. Krebs on Security, "Why Your Wi-Fi Router Doubles as an Apple AirTag" (May 21, 2024)
3. Apple Support, "Location Services and Privacy" (2026)
4. Google Maps Help, "Manage your Wi-Fi access point and Google's Location services" (2026)