In a http request/response, mac address would be meta data. ARP is not a thing there. That would be an example of data snaffling.

Do you have any info on this? AFAIK, MAC is only distributed in datalink layer around local connections.

I tried some quick packet sniffing browsing Google and did not see my MAC transmitted—as I’d expect (bc like you said, ARP not thing at this layer) also research on “MAC included in http metadata” turns up no results…

If you have any more info on this I’d love to learn more—as I’m puzzled to know why this would happen?

I think the poster isn’t talking about the remote server seeing client MACs (because, as you say) but, rather, about the way mobile OSes use nearby wifi access point SSIDs to provide GPS-less geolocation. Samy Kamkar raised my awareness of this way back in 2010 or so, and this article about his DefCon talk provides a good quick explanation: https://www.bbc.com/news/technology-10850875.

Correct.

They can get it from your android phone or from chrome if you’re running it

They don't. But Chrome, Google Play Services and other popular apps likely share this data frequently.

They can get it if you log into your Android TV!

I believe they also track and log other Wifi networks that you arnt even connected to.

I'm sure they gather all sort of other metrics from any sensors and signals they can access.

Not from HTTP requests. Android has access to the network stack and location. Google grabs all visible APs around and correlate to your location.

It is way before HTTP even happens. This data is collected while you are driving around, walking down the street, etc.

How can you block this?

Disable “coarse location” option in settings. Might not work though.

If you want coarse location to work but don't want Google to know it, try microG with a non-Google location provider (I use Apple and Mozilla and it's pretty good).

www.GrapheneOS.org

Usa an iPhone?

Doesn't Apple do something similar however? When you turn WiFi off on your iPhone a prompt appears saying that it's better to turn it on for "better location tracking" or something like that.

Keeping Wifi on allows “find my” to work more accurately, which many people value. Third party apps such as YouTube have an additional permission to be able to look at the local network.

Newer wifi chips allow passive scanning while the bulk of the silicon is powered down. I.e. it could/should also work in flight mode

On Android, find Location Services in your system settings and look for Google Location Accuracy. The description for it on my Galaxy S21 reads:

> Google's location service improves location accuracy > by using Wi-Fi, mobile networks, and sensors to help > estimate your location. Google may collect location > data periodically and use this data in an anonymous > way to improve location accuracy and location-based > services. > > Turning this off will result in your device only using GPS > for location. This may impact the accuracy of location > used by apps such as Maps and Find My Device.

Based on that description, that should turn off the data collection, although it can also make GPS fixes take longer, and there may well be other apps collecting this data as well.

They don't get it from your HTTP req.

They get it from your GPS on your android sending the mac address with your location to google servers.

And then later your TV sending the same mac address to google and asking "what's my location?".

Google associates your TV's request with your phones data using the mac address. And then the browser communicates with your OS using the location service API, a virtual GPS on your TV that only uses MAC address and google's server, to get the result.

It’s not the MAC address, it’s the BSSID of the wireless network you are connected to, and those around you.

Software typically obtains BSSIDs from your mobile OS’s wi-fi frameworks.

The BSSID looks like a MAC address, and in many but not all cases, a given AP’s wireless network BSSID is within a byte or two of its actual wi-if radio MAC.

Google and Apple maintain their own massive geolocation databases of BSSIDs, signal strength, and latitude/longitude.