Back in May, I wrote a post called “Where There’s WiFi, There’s Surveillance” (https://onlinesafety.substack.com/p/where-theres-wifi-theres-surveillance-wifi-sensing-uniquely-identifies-people) about research out of the Karlsruhe Institute of Technology (KIT) in Germany. The researchers showed that an ordinary WiFi router can uniquely identify specific people walking through a space with 99.5% accuracy.
I made the point that WiFi sensing had moved from a research demo to a standard product feature, and that every router had the potential to become a surveillance sensor.
On August 18, Comcast launched WiFi Motion across millions of Xfinity routers as part of a new bundle called Xfinity Shield. TechCrunch has an article on it: “Comcast adds motion sensing to millions of its newer routers, with a privacy catch” (https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/).
WiFi Motion turns your Xfinity router into a motion detector. It doesn’t need a camera or any new hardware. Instead, this works by your body disrupting the radio signals traveling between your router and the other devices connected to your WiFi. Comcast’s software watches for those disruptions and sends you a push notification through the Xfinity App when it sees movement. The idea is that instead of a traditional motion sensor, you can use your router to detect movement in your house.
It is opt-in and off by default. This isn’t automatically turned on (yet); you have to enable it in the Xfinity App.
It requires a newer router. Comcast lists the Technicolor TXB7 and newer, including the XB8, XB9, XB10, MXB1, and XER10. (Comcast calls these “gateways” because the box is a combined modem and router.)
It pairs your router with up to three stationary connected devices. Think a smart speaker, a printer, a thermostat, or a game console. Motion is detected in the space between those devices and the router.
It is free. WiFi Motion is part of WiFi Shield, included with Xfinity Internet, so it’s freely available.
Motion events are stored in Comcast’s cloud for seven days.
According to Comcast’s support page, WiFi Motion uses no cameras, does not capture images or video, does not record audio, and does not identify individuals.
Detecting that “something moved” and determining who that person is are not two different technologies. They are two different ways of reading the same data. This was the point of my earlier post, which noted that research has shown that human-induced disruptions to WiFi signals create unique signatures that can identify individuals.
WiFi signals are radio waves. When they travel between your router and your devices, they bounce off walls, furniture, and people. Your body blocks, scatters, and absorbs those waves differently than empty space does. Every router is constantly measuring how its signals arrive so it can aim them better, and those measurements quietly record the shape of whatever is standing in the room.
Comcast’s software takes those measurements and reduces them down to one bit of information. Moving, or not moving.
The KIT researchers used the same signals to show that it was possible to create a WiFi Disruption Fingerprint good enough to identify a specific person in a group of 197 with 99.5% accuracy. The lead researcher described it as working like a normal camera, except that it uses radio waves instead of light.
So the risk with this technology is that Comcast could uniquely fingerprint your “WiFi movement signature” if they want to, because they have the data. And because the router is tied to an address, tying an actual identity to that unique movement signature is pretty trivial. Using open-source information, it’s very easy to figure out who lives at an address, and Comcast also has customer information about who is paying for the WiFi.
Any router on any system transmitting WiFi is capturing data that can be used to create a unique WiFi disruption fingerprint for each of us.
The specific data the KIT team used is called BFI (Beamforming Feedback Information). It has been part of WiFi since WiFi 5 rolled out around 2013. Two things about it matter enormously.
First, it is transmitted unencrypted. Second, anyone within range can capture it with an ordinary off-the-shelf WiFi adapter, without connecting to your network, without your password, and without your permission (source: https://www.tomshardware.com/tech-industry/researchers-identify-people-through-ordinary-wi-fi-routers-with-99-percent-accuracy).
BFI is in the air whether or not WiFi Motion is enabled. Your router has been broadcasting it since the day you plugged it in. Turning off WiFi Motion stops Comcast from building a seven-day log of your family’s movements.
Turning WiFi Motion off is worth doing, and you should do it, because it removes a record a company holds about your household that it can be compelled to hand over. But it is not a fix for WiFi sensing, because there is no consumer solution for it today. That has to be solved in the WiFi standard itself, which is exactly what the researchers are calling for.
So the first major privacy implication is that Comcast has signaled to the world that it collects this data. This means this data can be turned over, stolen, or misused. This means that if someone wants to create your unique WiFi disruption fingerprint, they might be able to get this data from Comcast (depending on what Comcast is actually storing). And once they have your unique fingerprint, they could track you anywhere in the world, as long as they have access to the routers.
The second implication is how Comcast might use this information. If they know if there’s motion in the house, they can start making decisions about usage patterns and do things like throttle your Internet when they don’t detect movement because it’s less likely anyone needs it. With knowledge of how many people are in a house or how much movement there is, Comcast could make many business decisions about billing rates, Internet access, and advertising monetization. It’s only a matter of time before it becomes valuable to understand the types of movement that tie specific activities to houses.
At the bottom of Comcast’s WiFi Motion page (https://www.xfinity.com/hub/smart-home/wifi-motion) is a disclaimer stating that, subject to applicable law, Comcast may share information generated by your WiFi Motion with third parties “without further notice to you” in connection with a law enforcement investigation or proceeding, any dispute where Comcast is a party, or a court order or subpoena.
Since the feature is off by default, you shouldn’t need to do anything, and I recommend not using it. But “off by default” is not the same as “off,” and there are a couple of situations where you should check.
Someone else in your household set it up. If someone other than you is managing the Comcast account, check with them.
You enabled it during an App update prompt. Setup flows that appear during an update are the easiest thing in the world to click through without reading.
Here’s how to check. Open the Xfinity App and sign in. Go to the Home tab and look for WiFi Motion or WiFi Shield. If WiFi Motion has been set up, you will see a status and an activity feed. Open the settings (gear icon) to toggle it off. Comcast’s own walkthrough is at https://www.xfinity.com/support/articles/wifi-motion.
While you are in there, look at the activity feed before you turn it off. Seven days of movement history tells you whether this has been running and roughly what it captured.
The complete fix is to stop using the Xfinity router. If you buy your own modem and router, Comcast cannot offer WiFi Motion on your network because they don’t control the hardware. This also saves you the monthly equipment rental fee, which, for most customers, pays for the equipment within a year or two. In general, I recommend using your own router rather than your ISP’s for a variety of privacy and security reasons.
This same capability is coming to the WiFi networks you walk through in stores, airports, schools, and libraries because it’s cheaper, more powerful (it goes through walls), and available everywhere without having to buy special motion-sensor equipment. Your employer will start using this for security and to understand if people are working. Stores will use it to understand traffic density, where people stop and look, and to start identifying repeat customers. These are just a couple of examples of how this technology can be used.
With sensing plus the identification techniques the KIT team demonstrated, the same network could tell you that it was the same person who stood in aisle four last Tuesday, and the Tuesday before that, and that they walked out without buying anything all three times.
Think about that in a workplace. Your employer’s network could show who is at their desk, who is in the break room, who went to HR, and how long they were in there. A business with a headcount problem, a shrinkage problem, or a union drive has very different incentives, and nothing about the technology stops them.
Assume any space with WiFi is potentially a sensed space.
Lock down your own router (buy your own router). This is the part fully in your control. Change the default admin password, turn on automatic firmware updates, use WPA3 or WPA2, disable WPS, disable remote management, and set up a separate guest network for your smart devices. I laid all of this out step by step in the May post (https://onlinesafety.substack.com/p/where-theres-wifi-theres-surveillance-wifi-sensing-uniquely-identifies-people).
Change your DNS to a private provider. Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). Full instructions here: https://onlinesafety.substack.com/p/your-dns-settings-are-exposing-your-privacy-how-to-protect-yourself.
Ask. If your employer, gym, or building rolls out “presence detection” or “occupancy analytics,” ask what data is collected, how long it’s retained, and with whom it’s shared. Most of the time nobody has asked before, and asking is how policy gets made.
Don’t use WiFi sensing in your house. The best protection is to avoid tying your WiFi disruption fingerprint to your actual identity. Your home is the easiest place for anyone to link a WiFi disruption fingerprint to a name, because the router is tied to your address and Comcast knows who pays the bill. So don’t enable Comcast’s sensing, use your own router, and don’t use systems or routers that store this information.
Stay Safe!
Tate
I’ve founded Jacana, a scam protection company. We have built an App available on Windows, Mac, iPhone, and Android that detects scams and alerts you when it sees them. It works across apps and platforms, so you have full protection for you and your family. Check us out at https://hellojacana.com and follow us at:
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.