>A powerful adversary could set up sniffers all over the city and track the population, I guess, but I imagine the value of this method goes down the more phone

>A powerful adversary could set up sniffers all over the city and track the population, I guess, but I imagine the value of this method goes down the more phones that are being distinguished (variability among millions of phones probably means a lot of overlap, especially considering it doesn't seem that variation in signal is consistent). You may be able to achieve the same goal without exploiting this security weakness. A few years back I built a "people counter" app - it was mostly a learning exercise to see what I could do with the Android Bluetooth API, but I was also curious to see how useful a signal Bluetooth might be in finding the least crowded car on a packed commuter train. After a week of testing it on the ride home I had data to suggest that it was. I also found that based on MAC addresses and device names I was among the same group of strangers most nights of the week. And this was despite MAC address randomization which IIRC was already implemented in iDevices.