Identifying People From WiFi Signals Alone: A Privacy Playbook for Japanese Companies in the Philippines

Toward an Era of Telling People Apart From WiFi Signals Alone: A Privacy Playbook for Philippine Offices and Stores

This guide explains the WiFi-signal personal-identification technology demonstrated in German research, from the practical standpoint of offices and stores in the Philippines. You'll learn the information-security measures Japanese companies should act on right now.

---

Part 1: Why This Matters

Step 1: The Philippine Business Context (3 min)

A German research team has unveiled a method that can tell apart the people present in a space using ordinary WiFi signals alone. Using neither a camera nor a smartphone, it can identify individuals from nothing but the reflections of the radio waves bouncing around a room. The Philippines is a country where WiFi is extremely familiar. Free WiFi is placed all over the place—in shopping malls, cafes, condominiums, and the offices and BPO sites (call-center and similar outsourcing operations) where many Japanese companies are based.

In other words, if this technology spreads, the very places where WiFi is taken for granted become the most prone to becoming subjects of invisible surveillance. For Japanese companies expanding into the Philippines and for Japanese people working there, this is not a story confined to some distant laboratory. The WiFi in your own office or store could, without your knowing, become a tool that identifies visitors and employees.

The Philippines has a law that protects personal information, and the National Privacy Commission (NPC, a government body equivalent to Japan's Personal Information Protection Commission) oversees how it is applied. Identification via radio waves introduces a new issue this law never anticipated. That is exactly why it is worth understanding correctly now.

Try opening the conversation with an IT colleague in your Manila office: "Hey, there was an announcement out of German research that you can tell who's present using ordinary WiFi alone. We've got visitor WiFi in our office too, right? This sounds like it could touch on customer privacy, so shall we review the state of our network sometime?" Making it a topic of discussion inside the company like this is the first step.

Step 2: Key Points from the Original Article (5 min)

We've summarized the facts from the original article in a table to make them easier to study.

Source: ScienceDaily — "Ordinary WiFi can now identify people with near perfect accuracy" (May 22, 2026)

This table was created for study purposes based on facts from publicly available information. For details, please refer to the original article linked above.

Related: Lessons from FortiBleed: The Fortinet Breach and Security for Your Philippine Operations explains this in detail.

Step 3: Comprehension Check (5 min)

Q1. What was used in this research to tell people apart?

Hint: It's not a camera, and it's not facial recognition. It's that wireless signal we use every day.

Q2. How many people took part in the experiment, and with what level of accuracy could individuals be identified?

Hint: About 200 people participated, and the accuracy was a figure close to perfect.

Q3. If you turn off your smartphone, can you escape this technology?

Hint: The original article says "that alone is not enough." The reason is the communications of other nearby devices.

Q4. What is the name of the signal this technology uses, which is transmitted without encryption?

Hint: It's a three-letter acronym—the "feedback" information that devices send to the router.

Q5. Where is the research team trying to direct its efforts to protect privacy?

Hint: Not individual companies, but the "common rules for WiFi" that are yet to be decided.

---

Related: U.S. Government Invests $2 Billion in Nine Quantum Computing Firms: A Next-Generation Technology Guide for Japanese Companies in the Philippines explains this in detail.

Part 2: Applying This in Practice

Step 4: Implementation Steps in the Philippines (10 min)

Rather than using this technology itself, we've laid out the steps to take in the Philippines on the side of protecting your own radio-wave environment. Costs are approximate and vary by scale and location.

Each step can start small. Beginning with the list-making in Step 1 makes it easier to move the discussion forward internally.

Related: A Guide to Building No-Code AI Agents | How to Automate Philippine Operations with Toolhouse explains this in detail.

Step 5: Common Mistakes and How to Avoid Them (5 min)

Mistake 1: Thinking "this has nothing to do with our office"

The research showed that no special equipment is needed and that identification holds using only ordinary WiFi devices. If you assume that, because it's a new technology, it has nothing to do with your company, your countermeasures fall behind.

Bad example: Thinking "we're a small sales office, the latest research doesn't concern us" and leaving everything unexamined.

Good example: Taking it as "if no special equipment is needed, then this concerns offices of any size," and starting first by making a list of your own WiFi devices.

Mistake 2: Putting off dealing with the NPC

Businesses that handle personal information in the Philippines have an obligation to comply with the guidance of the National Privacy Commission (NPC). Because radio-wave identification is a new issue, proceeding by your own ad hoc judgment can cause problems later.

Bad example: Even when a security incident occurs, reporting it only to head office and trying to handle notification to or consultation with the NPC "the Japanese way."

Good example: Checking with local lawyers or the NPC's published materials, and proceeding with reporting and consultation through steps that comply with Philippine law.

Mistake 3: Ending your explanation to local staff with documents alone

In Philippine workplaces, verbal exchanges and in-person explanation contribute greatly to building trust. Simply handing out rules on paper can make it hard for the intent to reach the front line.

Bad example: Sending the English internal regulations to everyone in a blast email and assuming "everyone must have read it."

Good example: Holding a briefing where you talk through concrete examples, and always setting aside time for questions at the end to resolve doubts on the spot.

Step 6: Related Technical Terms (5 min)

BFI (Beamforming Feedback Information) is the information a device sends to the router to report the state of the radio signal. In this research, the problem was that this signal is transmitted without encryption and can be read by anyone nearby. In places like cafes and BPO sites in the Philippines, where many devices connect to a single WiFi network, this signal is flying around in large volumes, so the priority of countermeasures is high.

CSI (Channel State Information) is information that measures how radio waves change as they hit walls, furniture, and people. It's easiest to think of it as a record of how the waves bounced off objects. Earlier identification technologies often relied on this CSI, and it serves as foundational knowledge for Philippine IT staff learning about radio-wave-based mechanisms.

IEEE 802.11bf (the next-generation standard for WiFi sensing) is a yet-to-be-finalized common rule that aims to define the use of WiFi to sense the surrounding environment. Think of it as a rule that devices worldwide will come to follow. The research team is calling for protections to be built into this standard, and compliance with it will become a factor when choosing devices in the Philippines going forward.

Beamforming (directional control of radio waves) is a technology that concentrates radio waves and sends them in a desired direction. It's easiest to think of it like focusing a flashlight's beam to a single point—delivering radio waves strongly to a targeted recipient. It is used to stabilize communications in large offices and factories in the Philippines, and while convenient, you need to be aware that the information generated in the process can be used for identification.

A machine-learning model (a mechanism that learns rules from data) is a system trained on many examples so it can guess "who is this." In this case, it was trained on the many possible appearances created from radio-wave reflections, so it could tell apart individuals in a matter of seconds. When Philippine companies bring such mechanisms into their operations, they must always weigh the convenience together with how to protect personal information.

Step 7: Thinking About How to Apply This to Your Company (10 min)

Take stock of your office's WiFi environment

Do you have a grasp of how many WiFi devices your company has and where they are placed?

A prompt for thinking: Picture whether your visitor and business networks are separated, and whether any old devices remain. Drawing it out as a diagram makes it easier to notice what you've overlooked.

Next action: By next week, compile a list of your company's WiFi devices into a single table.

How to protect the privacy of visitors and customers

In stores and offices that offer free WiFi, is there no concern that visitors' movements can be read from the radio waves?

A prompt for thinking: Consider what explanation or settings your company can provide so that customers feel "I can spend my time here with peace of mind."

Next action: Consider whether you can add a single, easy-to-understand sentence about handling personal information to the terms of use for your visitor WiFi.

Preparing for the next-generation WiFi standard

How should you align your device choices with the common WiFi rules that are yet to be decided?

A prompt for thinking: Looking ahead to when you'll replace devices a few years from now, discuss whether it's worth gathering information starting now.

Next action: Consult with your IT staff and write a memo on the timing and rough budget for your next device refresh.

---

Part 4: FAQ

Q1. Is this technology already actually in use?

At present it is a research-stage result and is not immediately in use around town. However, because no special equipment is needed, you need to watch how quickly it could spread. In a country like the Philippines where WiFi is so familiar, we recommend checking your own situation early.

Q2. If I turn off my smartphone, am I not identified?

That alone is not enough. According to the original article, the mechanism holds even using only the communications of other nearby devices. In places like cafes and offices in the Philippines where many devices connect, turning off your own device does not mean you're safe.

Q3. Is there a law in the Philippines that relates to this issue?

There is a law protecting personal information, and the National Privacy Commission (NPC) oversees how it is applied. Because radio-wave identification is a new issue, there are still areas without clear answers. When in doubt, checking with local lawyers or the NPC's published materials gives peace of mind.

Q4. Can I apply my Japanese head office's rules directly in the Philippines?

It's better to avoid applying them directly. Reporting destinations and procedures differ from Japan, and the Philippines has its own body, the NPC. It's important to set up procedures in line with local law and to explain them to local staff in person.

Q5. Are countermeasures necessary even for small and mid-sized operations?

Yes, regardless of scale it's worth checking. Because the research showed that identification holds without special equipment, even a small sales office could be a subject. Start without strain by listing your company's WiFi devices first.

---

Tips for Making the Most of This (3 Tips)

Write out your WiFi devices and network configuration once — If you don't have a grasp of what is where, you can't set the priority of your countermeasures. Simply compiling into a single table whether your visitor and business networks are separated and whether any old devices remain will show you what to do next.

Add the perspective of "radio-wave identification" to your internal personal-information rules — Many internal rules are still written on the assumption of cameras and paper documents. Just adding one sentence on the new perspective that individuals can also be identified from radio waves makes it easier to prepare for NPC compliance in the Philippines.

Check the trend of the next-generation WiFi standard at least once a year — The common rules yet to be decided will affect your device choices. To avoid misjudging at the once-in-a-few-years moment when you replace devices, it's reassuring to build a habit of gathering information together with your IT staff.

---

Bonus: How PH AI Works Can Help

PH AI Works supports the practical work of AI adoption and information security in the Philippines. We can work with you—tailored to local realities—to map out how a new technology like radio-wave identification relates to your operations and your customers' privacy.

As a next step, you can consult us for free on topics such as the following.

• You want to inspect your WiFi environment and handling of personal information, and proceed with a review aligned to the Philippine NPC's guidance
• You want to put together easy-to-understand internal rules for local staff—including radio-wave identification—and a plan for how to run briefings
• You want to know how to prepare for the next-generation WiFi standard and what to consider when refreshing devices

Please feel free to get in touch first.

---

References and Sources

• ScienceDaily — "Ordinary WiFi can now identify people with near perfect accuracy" (May 22, 2026)
• National Privacy Commission — Official Site