Do iPhones use active scanning to find Wi-Fi networks when Ask to Join Networks is off? I'm looking into security holes in my daily life, and I ran across an article that says that most devices broadcast their MAC address continuously. I'm wondering if that applies to iPhones (and other iDevices) as well. I would expect them to use active scanning when Ask to Join Networks is on, or if you are actually in the Wi-Fi Settings (though I don't know that that is the case), but what about normally? Is my iPhone broadcasting its identity everywhere it goes as long as the Wi-Fi is on?
Since iOS8 the MAC is randomised while scanning for wi-fi networks. I believe that has since been adopted by most devices.

The REAL MAC is only used after connection to a network.