6. Privacy Considerations

EAP Identity is generally visible to observers of EAP traffic. The NAIs in this specification come from a public registry, so exposing those names has no direct privacy impact. However, RADIUS Access-Request packets can include MAC addresses, device location, and other identifying information.

RFC 9965 does not change RADIUS or EAP privacy boundaries. It can improve privacy by allowing devices to anonymously obtain limited network access and then securely obtain credentials.