Your WiFi Router Knows It's You — And No Law Says It Can't

Researchers pointed a WiFi router at a room full of people — no cameras, no phones, nothing in anyone's hands. And the router identified each person with almost perfect accuracy. Just the radio waves bouncing off their bodies. That's it.

If you've ever sat in a coffee shop, connected to

If you've ever sat in a coffee shop, connected to the WiFi, or just walked past a router — this is about you. A team at the Karlsruhe Institute of Technology in Germany showed that ordinary wireless signals can tell one human body from another. You don't need to be carrying a device. Your phone can be switched off. The signal reads the shape and movement of you. And here's the question that runs underneath all of it — if a router can recognize you without your permission, is there any law that says it can't?

Let's start with how this even works. Your devices constantly send little packets of data back to the router — something called beamforming feedback information. In plain terms, it's your device telling the router where it is so the signal points the right way. The catch? That data often travels unencrypted. Anyone within range can potentially read it. For the rest of us, that means the invisible signal filling your home or your office might be describing you to anyone listening.

Now, this used to live in research papers. Not anymore. In September of twenty twenty-five, a new WiFi standard was published — the eight-oh-two-dot-eleven-b-f standard. It formally gives WiFi the ability to sense presence, motion, gestures, and objects. So the thing that detects you isn't a clever hack anymore. It's being built into the infrastructure itself.

The timing matters, because identity checks are

And the timing matters, because identity checks are spreading everywhere. Twenty-five U.S. states now require you to upload your driver's license or scan your face just to visit certain websites. The U.K. recently announced fifty facial recognition vans to enforce age checks on the street. And the E.U. is launching a digital identity wallet next year. We're being asked to prove who we are more often than ever. Meanwhile, a totally different system can identify us without asking at all.

Here's the part that should make you sit up. Advertising companies could identify individual shoppers walking through a mall — no facial recognition needed. States like Illinois and Texas have strong laws protecting your biometric data — your face, your fingerprints. But a WiFi signature? Legally, that doesn't count as biometric data. So tracking you by your wireless reflection sidesteps the very laws built to protect you. The store already has the router. It just didn't know what it could do.

And that's the real story here. The threat isn't the technology — it's the gap. Identity systems are now running faster than the laws meant to govern them, and no rule on the books specifically protects your WiFi radio signature.