On an Android phone with no cellular service and only WiFi enabled, several types of information can be broadcasted and potentially intercepted by third parties.

1. **MAC Address**: The phone’s WiFi adapter broadcasts its MAC address when searching for and connecting to WiFi networks. This unique identifier can be used to track the device’s movements across different networks.

2. **Probe Requests**: When the phone is not connected to a network, it may send out probe requests to discover available WiFi networks. These requests can include the names (SSIDs) of previously connected networks, revealing the device’s past locations and networks it has connected to.

3. **Connected Network Information**: Once connected to a WiFi network, the phone exchanges data with the router, including IP addresses, the MAC address, and potentially the device name. This information is necessary for establishing and maintaining the connection but can be intercepted by someone with access to the same network.

4. **Network Traffic**: Data transmitted over the WiFi network, such as browsing activity, app data, and other communications, can be intercepted by someone on the same network if not encrypted. HTTPS, VPNs, and other encryption methods can mitigate this risk.

By monitoring these broadcasts, an attacker could gather significant information about the device and its user, including tracking their movements and potentially accessing unencrypted communications.