AirTag Tracking and Anti-Stalking Measures: How Apple's Find My Network Handles Abuse

The Find My Network

Apple's Find My network is one of the largest distributed sensing systems ever built. It consists of approximately 2 billion active Apple devices - iPhones, iPads, Macs, Apple Watches - all functioning as passive relay nodes. When any of these devices detects a BLE signal from a Find My-enabled accessory, it silently reports that accessory's encrypted location to Apple's servers. The accessory's owner can then see its location through the Find My app.

The network's coverage is extraordinary. In any populated area, there are likely dozens or hundreds of Apple devices within BLE range at any given moment. This density means a Find My accessory can be located almost anywhere people are present - indoors, outdoors, in vehicles, in luggage - with precision limited mainly by the accuracy of the reporting device's GPS and the density of nearby Apple devices.

The system is designed with privacy in mind for the relay devices. The relay devices do not know what they are reporting; the location data is end-to-end encrypted so that only the accessory's owner can decrypt it. Apple itself cannot read the location data. The relay devices do not store the reports locally. From the perspective of the iPhone owner who unknowingly relays a nearby AirTag's location, the process is invisible and leaves no trace.

How AirTags Work Technically

An AirTag is a small disc containing a Bluetooth Low Energy radio, a U1 Ultra-Wideband chip, an NFC chip, a speaker, and a CR2032 battery. The BLE radio is the primary mechanism for location tracking.

sequenceDiagram
    participant AirTag as AirTag
    participant iPhone as Nearby iPhone (relay)
    participant Apple as Apple Servers
    participant Owner as Owner's iPhone
    
    AirTag->>AirTag: Generate rotating public key
    AirTag->>iPhone: BLE advertisement (encrypted ID)
    Note over AirTag,iPhone: BLE range: ~10-30m
    
    iPhone->>iPhone: Detect BLE advertisement
    iPhone->>iPhone: Record own GPS location
    iPhone->>iPhone: Encrypt location with AirTag's public key
    iPhone->>Apple: Upload encrypted location report
    Note over iPhone,Apple: E2E encrypted - Apple cannot read
    
    Owner->>Apple: Request location (with private key)
    Apple->>Owner: Return encrypted reports
    Owner->>Owner: Decrypt with private key pair
    Owner->>Owner: Display AirTag location on map
    
    Note over AirTag: Key rotates every ~15 minutes
    Note over AirTag: Prevents third-party tracking

AirTag location reporting flow - from BLE advertisement through the relay network to the owner's device.

The AirTag continuously broadcasts BLE advertisements containing a rotating public key derived from a shared secret between the AirTag and its paired owner's Apple ID. This key rotates approximately every 15 minutes. Each rotation produces a new advertising identifier, which means a passive BLE observer cannot track an AirTag over time by its advertisement data alone - the identifier changes too frequently.

When a nearby Apple device detects the AirTag's BLE advertisement, it takes its current GPS coordinates, encrypts them using the public key from the advertisement, and uploads the encrypted location report to Apple's servers. The encryption ensures that only someone with the corresponding private key (the AirTag's owner) can decrypt the location.

The owner's device downloads recent location reports from Apple's servers and decrypts them using the private key stored in their iCloud Keychain. The decrypted reports show where and when the AirTag was detected by relay devices. If multiple reports are available from different relay devices at similar times, the system can triangulate a more precise location.

The U1 chip enables Precision Finding on iPhones equipped with U1 (iPhone 11 and later). When the owner is close to their AirTag, the UWB radio provides centimeter-accurate direction and distance information, guiding the user directly to the AirTag with an on-screen arrow and distance readout.

The NFC chip enables Lost Mode. When enabled by the owner, tapping an NFC-enabled phone (iPhone or Android) to the AirTag displays a message with contact information. This is designed for returning lost items.

The Stalking Problem

The same properties that make AirTags effective for finding lost keys make them effective for stalking. An AirTag is small (31.9mm diameter, 8mm thick), inexpensive ($29), and leverages a network of 2 billion relay devices for location tracking. It can be hidden in a bag, attached to a vehicle, or slipped into a pocket.

Reports of AirTag-facilitated stalking began appearing almost immediately after the product's launch in April 2021. A model in the fashion industry found an AirTag hidden in her coat pocket. A woman discovered one in the wheel well of her car. A man found one in his backpack that he suspected was planted by a business rival. News reports and police filings documented dozens of cases within the first year.

The stalking use case is not unique to AirTags - GPS trackers have existed for decades. But AirTags lowered the barrier dramatically. A GPS tracker requires a SIM card, a data plan, and battery management. An AirTag costs $29, uses a commodity coin cell battery that lasts a year, and leverages a free tracking network with global coverage. The ease of deployment and the precision of tracking represent a qualitative shift in accessibility.

Law enforcement agencies reported an increase in stalking cases involving AirTags. Some jurisdictions saw AirTag-related incidents triple in the year following launch. The problem was particularly acute for domestic violence situations, where an abuser could track a victim's movements to shelters, workplaces, and safe houses.

Anti-Stalking Alert System

Apple anticipated the stalking risk (at least partially) and built anti-tracking features into the Find My ecosystem. These features have been updated multiple times since launch.

iPhone detection: An iPhone running iOS 14.5 or later automatically detects when an unknown AirTag is traveling with the user. If the AirTag has been separated from its owner and is moving with someone else for a period of time, the iPhone displays an alert: "AirTag Found Moving With You." Tapping the alert shows a map of where the AirTag has been detected and offers options to play a sound on the AirTag, get instructions for disabling it, or learn more about the situation.

The detection timing has changed over time. At launch, the alert could take up to three days to appear. Apple reduced this to a variable window that can be as short as a few hours, depending on the pattern of movement. If the AirTag is detected at your home address (based on your Significant Locations setting), the alert appears more quickly.

Sound alerts: An AirTag separated from its owner plays a sound after a configurable period (originally three days, later reduced). The sound is intended to alert the person being tracked. However, the AirTag's speaker is small (about 60 dB), which can be difficult to hear in a noisy environment, inside a bag, or when attached to the underside of a vehicle.

Precision Finding for unknown AirTags: iOS 16.2 added the ability to use Precision Finding (UWB-based direction and distance) to locate an unknown AirTag that has been detected traveling with you. This helps users find a hidden AirTag that they can hear sounding but cannot visually locate.

Serial number and Apple ID linking: Every AirTag has a unique serial number that is linked to the Apple ID of the person who registered it. If a stalking victim finds an AirTag, law enforcement can request the registered owner's information from Apple through a legal process. This provides an investigative trail that traditional GPS trackers often lack.

Tracker Detect for Android

Android users were initially left without any detection capability. Since AirTag detection relied on iOS features, the roughly 3 billion Android devices worldwide could not detect unwanted AirTags at all. This was a significant gap, as stalking victims with Android phones had no automated warning.

Apple released Tracker Detect for Android in December 2021. The app allows Android users to manually scan for AirTags that have been separated from their owner. If an AirTag is found, the app can play a sound on it and provide instructions for disabling it.

Tracker Detect has significant limitations compared to iOS detection. It does not run automatically in the background - the user must open the app and manually initiate a scan. It does not provide persistent monitoring or alerts. A stalking victim who does not know to install and regularly use the app receives no protection.

In 2023, Google added native unwanted tracker detection to Android, providing automatic background scanning similar to iOS. This integration detects not just AirTags but other Find My network accessories and trackers from other ecosystems that comply with the cross-platform detection standard.

The Cross-Platform Tracking Detection Standard

In May 2023, Apple and Google jointly announced a draft specification for detecting unwanted location trackers, developed with input from tracker manufacturers (Samsung, Tile, Chipolo, eufy) and advocacy groups (National Network to End Domestic Violence). The specification was finalized and adopted into iOS 17.5 and Android 6.0+ in 2024.

The standard defines a common protocol that all Bluetooth trackers should implement to enable cross-platform detection. Key requirements include:

Unwanted tracking detection: All compliant trackers must be detectable by both iOS and Android devices when they are separated from their owner and traveling with someone else.

Sound capability: All trackers must include a speaker capable of producing an audible alert when triggered by the detection system.

Serialized identifier: Trackers must transmit a non-rotating identifier that can be read by a detecting device, providing a stable reference for tracking the tracker itself.

Owner information accessibility: There must be a mechanism (NFC tap or similar) for a detecting device to retrieve information about the tracker that can be provided to law enforcement.

The standard represents a significant step forward, but it relies on voluntary compliance. Trackers designed specifically for covert surveillance are unlikely to comply. The standard also does not cover DIY tracking devices built from generic BLE hardware.

Gaps in Current Protections

Despite improvements, significant gaps remain in anti-stalking protections.

Detection delays: Even with faster alert timing, there is an inherent delay between when an unwanted tracker starts traveling with a victim and when the victim is notified. A stalker can track someone for hours before any alert fires. In a domestic violence situation, hours of tracking can be enough to locate a victim at a shelter or safe house.

Sound is easily defeated: Multiple reports document stalkers disabling AirTag speakers by drilling a small hole through the speaker membrane or physically removing the speaker. A modified AirTag with a disabled speaker provides no audible alert. The AirTag still functions for location tracking - the speaker is not required for the BLE radio to operate.

Non-Apple trackers: While the cross-platform standard addresses brand-name trackers, it does not cover custom or modified tracking devices. A small ESP32-based BLE beacon sending crafted Find My-compatible advertisements can leverage Apple's network without being a registered AirTag, potentially bypassing some detection mechanisms. Research by Fabian Braunlein at Positive Security demonstrated this in 2021 with the "OpenHaystack" project.

Vehicle tracking limitations: AirTags hidden on vehicles are particularly hard to detect. The victim may not be carrying an iPhone at all times the vehicle is being tracked. The AirTag alert may not fire if the victim's daily pattern (driving to work, driving home) does not trigger the "traveling with you" heuristic, which is designed for personal items, not vehicles.

Short-term tracking: The anti-stalking system is designed to detect sustained tracking over hours to days. Short-term tracking (following someone for an hour) may not trigger any alert. A stalker who retrieves and re-registers an AirTag periodically could potentially reset the detection window.

False positives: Users traveling with family members or colleagues who have AirTags may receive frequent false alerts. Alert fatigue - dismissing repeated notifications as false positives - can cause genuine alerts to be ignored.

Law Enforcement and AirTags

AirTags have created new dynamics for law enforcement in both positive and negative ways.

On the positive side, AirTags have helped solve property crimes. Car theft victims who had AirTags in their vehicles have been able to guide police directly to stolen cars. Package theft, bicycle theft, and luggage theft have all been resolved through AirTag tracking. Some police departments have distributed AirTags to residents in high-theft areas as a crime-reduction tool.

On the negative side, the stalking problem has created new investigative burdens. Police departments have reported increasing numbers of reports involving unwanted AirTags. Many agencies initially lacked protocols for handling these cases. The legal framework for AirTag-facilitated stalking is still developing - some jurisdictions have specifically updated stalking and harassment statutes to address the use of electronic trackers.

Apple cooperates with law enforcement requests for AirTag registration information through standard legal process (subpoenas and warrants). The turnaround time and the completeness of information provided have been points of discussion between law enforcement and Apple. The information available includes the Apple ID that registered the AirTag, which links to a name, email address, and potentially a phone number.

Competing Tracker Networks

Apple's Find My network is the largest tracker network, but it is not the only one.

Samsung SmartTag and SmartTag2 use Samsung's Galaxy Find Network, which consists of Samsung Galaxy devices. The network is smaller than Apple's but still substantial, with several hundred million Galaxy phones worldwide. Samsung's anti-stalking protections include similar separation alerts for Samsung phone users.

Tile trackers use a community-based network of Tile app users. The network is much smaller than Apple's or Samsung's, limiting the tracking coverage and precision. Tile was acquired by Life360 in 2021.

Google Find My Device network launched in 2024, leveraging billions of Android devices as relay nodes. This creates a tracker network comparable in size to Apple's, with Android devices serving the same relay function that iPhones serve for AirTags.

Chipolo offers trackers compatible with both Apple's Find My network (Chipolo ONE Spot) and Google's Find My Device network. This allows users to choose their tracking ecosystem based on which platform they use.

The proliferation of tracker networks means that the unwanted tracking problem is not limited to AirTags. Any comprehensive detection solution must account for trackers from multiple ecosystems - which is the motivation behind the Apple-Google cross-platform detection standard.

Detecting Unwanted Trackers

Beyond the built-in detection features of iOS and Android, several tools and techniques can help identify unwanted trackers.

Manual BLE scanning using a tool like the BLEShark Nano reveals all BLE devices in the vicinity, including trackers that may not trigger built-in detection. By scanning the BLE environment around your person, vehicle, or belongings, you can identify any BLE-transmitting device - not just AirTags, but any tracker or beacon.

The advantage of a dedicated BLE scanner over phone-based detection apps is coverage. Phone apps are limited to what the phone's operating system allows them to see, which may filter out certain BLE advertisement types or limit background scanning. A dedicated scanner like the BLEShark Nano captures all BLE traffic in the 2.4 GHz band, providing complete visibility.

RF detection sweeps can find trackers that have been modified to defeat BLE-based detection. A broadband RF detector sweeps across frequencies to identify any active transmitter. This catches not just BLE trackers but also cellular GPS trackers, WiFi-based trackers, and other radio devices.

Physical inspection remains important, especially for vehicles. Common hiding spots include wheel wells, under bumpers, inside the trunk lining, under seats, and behind dashboard panels. Magnetic mounts make it easy to attach a tracker to any metal surface under a vehicle.

For anyone concerned about unwanted tracking, a combination of approaches provides the best protection: keep your phone's built-in detection enabled, periodically scan your environment with a dedicated BLE tool, physically inspect your vehicle and belongings, and be aware of the limitations of each detection method.