Easily spoofed and easily discovered. For goodness sake, I had a laptop which I had set to randomly pick it’s mac address every time it rebooted. My university liked to track students based on mac address. Combine that with a VPN and that problem went away.