Clients that connect to known networks automatically will advertise “hidden” SSIDs in all of their probe requests. This results in your device broadcasting those SSIDs everywhere you go, to anyone who’s listening.
This behavior is dependent on the client’s operating system. For instance, you can configure Windows 7 and later to not connect to hidden networks automatically (only “visible” ones). That prevents such broadcasts from happening, but then you have to connect to hidden networks manually every time.
On the other hand, iOS (and presumably macOS) always connects to known networks, hidden or not, and therefore broadcasts hidden SSIDs. The fact that iOS 10 warns about this would indicate that Apple has no plans to add the kind of toggle switch that Microsoft added in Windows 7, or to force the user to connect manually.
Microsoft explains this behavior on TechNet:
A non-broadcast network is not undetectable. Non-broadcast networks are advertised in the probe requests sent out by wireless clients and in the responses to the probe requests sent by wireless APs. Unlike broadcast networks, wireless clients running Windows XP with Service Pack 2 or Windows Server® 2003 with Service Pack 1 that are configured to connect to non-broadcast networks are constantly disclosing the SSID of those networks, even when those networks are not in range.
Therefore, using non-broadcast networks compromises the privacy of the wireless network configuration of a Windows XP or Windows Server 2003-based wireless client because it is periodically disclosing its set of preferred non-broadcast wireless networks.
Now as to why this is a privacy issue:
- You are potentially revealing SSIDs to a lot of people. Those SSIDs may include first and/or last names, which I’ve seen people use in network names.
- Should I point out the irony of broadcasting an SSID in the direct vicinity of the access point trying to hide it?
- Someone with a database of SSIDs could figure out where you’ve been or where you spend your time—possibly even where you live and work, based on your SSID broadcast beacons. Knowing where you live and work could lead to figuring out who you are, or at least identify you among a group of wireless clients (since your broadcasts might be unique to you).
Sound far-fetched? Criminals/advertisers have done worse things. Thankfully, no one I know has used a hidden SSID in well over a decade, and I haven’t seen that practice recommended in about as long.