So you're detected just by Wifi. Ok.
Your phone is transmitting every network you saved.
As OSINT you can pretty much fingerprint everybody with just that.
And even since phones are using randomized MACs, there are methods to leak true MAC.
The WiFi spec has something called "active scanning" [0] for clients (as opposed to passive scanning, where the client listens for the periodic AP beacons). There's something called a "directed probe request" [1] that a client can send during active scanning which will contain the AP's SSID it's directed towards. Whether or not your particular device sends these direct probe requests is probably configurable and different per client. According to this [2] post, Android devices will sometimes send SSIDs in a scan, but not all of them and not always. Might be possible to find the logic here in the Android source code, I assume it's there somewhere.
