Guide
IPv6 privacy extensions
Why your IPv6 address rotates every few hours: the old MAC-derived addresses, RFC 4941 temporary addresses, what part of the address changes, and how to switch the behaviour.
On this page
The old way: a permanent ID
Early IPv6 built the last 64 bits of an address from the device's MAC address (EUI‑64). The result: one stable, globally routable identifier per device that never changed across reboots or networks — a perfect long-term tracking token, which is exactly why the IETF moved on.
How temporary addresses work
Privacy extensions (RFC 4941) fixed it: the operating system generates a temporary address with a random 64-bit tail, uses it for normal traffic, and rotates it regularly — commonly every hour or two, depending on the OS and its settings. A stable address may still exist as a fallback, but most outbound connections use the rotating one. Windows, macOS, iOS, Android and modern Linux all do this by default.
What changes and what does not
| Part of your IPv6 | Stability |
|---|---|
| First 64 bits (network prefix) | Stable — it is your ISP's allocation for your home |
| Last 64 bits (interface identifier) | Rotates every few hours with privacy extensions |
The consequence: a site cannot follow you by address across visits, but the stable prefix still tells it your approximate area and ISP — the same regional visibility a v4 address carries. Full comparison in IPv4 vs IPv6.
Watch it happen yourself
Open the checker and note the IPv6 row. Come back in a few hours: the first half is identical, the second half different. If the second half has never changed across days, privacy extensions are off — see below.
Control the behaviour
- Windows: Settings → Network → advanced IPv6 settings → privacy level (prefer off-link, or disable privacy addresses to revert to the old behaviour).
- Linux:
sysctl net.ipv6.conf.all.use_tempaddr—1enables temporary addresses,2enables and prefers them. - macOS / iOS / Android: enabled by default; macOS exposes it under Network → Advanced → TCP/IP.
VPN users: address rotation does nothing for a leak. If your tunnel only carries IPv4, your real (rotating) IPv6 still walks outside it — the classic IPv6 leak. Make sure the VPN handles IPv6 too.
Frequently asked questions
Does rotating addresses break anything?
Rarely. Stateless things like web browsing are unaffected. A few long-lived or stateful services may briefly reconnect when the address turns over.
Can trackers follow me across rotations?
Not by address alone — that is the point. They can still use the stable network prefix (rough area), cookies, fingerprints and logged-in accounts, which is why an IP change alone never means you are untrackable.
Why is the first half of my IPv6 the same for months?
That part is the allocation your ISP gave your home network, not a device identity. Only the tail represents your specific device — and privacy extensions rotate it.
Keep reading
- What is an IP address?
- Public vs private IP addresses
- IPv4 vs IPv6
- How to hide your IP address
- How to check your IP address on a phone
- What is CGNAT?
- How to change your IP address
- Why does my IP address keep changing?
- How to find a website's IP address
- What is a datacenter IP?
- What is an ASN?
- How IP geolocation works
- What is a local IP address?
- Why am I getting blocked or stuck on CAPTCHAs?
- What is IP reputation?
- How websites detect VPNs and proxies
- What is a DNS leak?
- What is a WebRTC leak?
- Proxy vs VPN
- How to check if your VPN actually works
- Static vs dynamic public IP
- How to find out who owns an IP address
- IPv6 in 2026
- Check my public IP address
Check any other IP address
Investigating a suspicious login, a spam email header or a server log entry? Run any IPv4 or IPv6 address through the same geolocation and proxy checks.