Does a VPN change your Private Wi-Fi Address on iPhone?
A checklist for the three Apple privacy controls: what a private Wi-Fi address changes, what Private Relay covers, and what a VPN actually touches.
Three Apple settings get blamed for the same thing, and each one changes something different. Private Wi-Fi Address changes the hardware identity your iPhone presents to one Wi-Fi network. Limit IP Address Tracking switches iCloud Private Relay for one network. A VPN changes where traffic exits, and it changes neither of the other two.
Work through the list below in order and stop at the first control that matches what you actually observe. Guessing which switch owns a symptom is how people end up disabling three settings to fix one.
Start from the observation, not the switch
Name the observation before touching anything. A new device in the router's lease table, a different public IP in a browser tab, and a site refusing a session are three symptoms with three different owners.
Write down where you saw it: the local network's client list, a public IP echo page, or the app's own error. The table below maps each of those to one control, and that mapping is the whole job.
| What you observed | Control that owns it | Where to read it |
|---|---|---|
| Unknown or changing device in the router list | Private Wi-Fi Address | The network's details screen |
| Different public IP in a browser tab | Limit IP Address Tracking, or the VPN exit | Private Relay state, then the tunnel |
| App traffic that never enters the tunnel | VPN routing scope | The profile and its on-demand rules |
Private Wi-Fi Address is a local identity
Private Wi-Fi Address is a per-network MAC address choice, and on current systems the choice is three-way. Off presents the hardware address. Fixed keeps one random address for that network across reconnections. Rotating changes it on a schedule Apple controls.
Apple's private Wi-Fi address guide documents the Mac control from macOS Sequoia 15 onward, and the same Off, Fixed and Rotating options appear on iPhone with iOS 18. Earlier releases offered only the on and off form, so a menu that looks different is a version difference rather than a damaged device.
Limit IP Address Tracking is Relay control
Limit IP Address Tracking is a per-network toggle for iCloud Private Relay, not a general tracking switch. It appears for Wi-Fi and Ethernet networks, while the cellular equivalent is a carrier feature with its own rules. When it is on and Relay is available, Safari traffic and DNS lookups leave through two separate relays.
It is not an app-wide proxy. Traffic from an app that uses neither the system resolver nor Safari's networking stack is not relayed, and the relay exit is not your VPN exit. If a public IP check returns a relay range, Relay handled that request, not your tunnel.
The VPN is a path, not an identifier
A VPN profile decides which traffic is captured and where it goes. With full-tunnel routing, everything not explicitly excluded leaves through the tunnel; with split tunnelling, the rest stays on the physical link. Neither mode rewrites the MAC address the Wi-Fi network sees, because that address belongs to the link layer below the tunnel.
So the answer to whether a VPN changes your Private Wi-Fi Address is flat: no. It can change your public IP, your resolver and your latency, and it leaves the local identity alone.
Where the three interact
Two interactions cause most of the confusion. Apple documents that some VPN and internet-filter configurations prevent Private Relay from working, which is a compatibility condition rather than a rule about all VPNs. And a tunnel that forces its own DNS server can make a Relay test look broken when Relay was never consulted.
Check the reported state before assuming a global effect. If Relay shows as unavailable while a VPN is connected, disconnect only that profile, recheck, and then decide whether the tunnel or the filter is the cause. That isolates one variable without touching the Wi-Fi identity at all.
Verification checklist
Run this in order. Read the MAC the network sees from the router's lease table rather than from the phone. Read the public IP from an ordinary browser tab with the VPN off, then on. Read Relay's per-network state in the Wi-Fi details screen. Each reading belongs to a different control, and comparing them shows which one you actually changed.
If a managed network rejects the device, settle that requirement through its documented onboarding process instead of disabling the private address by default. If a site fails only while the VPN is up, the tunnel is the variable. The MAC never was.