advertisement
advertisement

How Apple designed AirTags to be privacy-first and stalker-proof

AirTag users, owners of other Apple devices, and even people who don’t own a single Apple product—the company wants its new tracker to respect everybody’s privacy.

How Apple designed AirTags to be privacy-first and stalker-proof
[Images: MicrovOne/iStock; courtesy of Apple]
advertisement
advertisement

Apple’s “Spring Loaded” event on Tuesday offered a bonanza of new hardware announcements, including some unexpected ones. But while Apple went big and loud with the new iMacs and powerful with the new M1 iPad Pros, the company also launched a tiny and discreet new product: the AirTag.

advertisement
advertisement

AirTag is Apple’s long-rumored tracking gadget, designed to be attached to an item to track its location in your house—or across the city. The product has been long in development and will take on the likes of other trackers already on the market, such as Tile. However, as with many things Apple, the company says AirTag has one massive advantage over its competitors: It was built from the ground up around privacy.

“When it came to designing our own product, we thought carefully about how to get this right in a way that no one else in the industry’s ever done before,” says Kaiann Drance, Apple’s VP of worldwide iPhone product marketing. I spoke to her and Ron Huang, the company’s senior director of sensing and connectivity, about Apple’s newest, tiniest gadget. “You’ll see that we designed for the privacy of AirTag owners and nonowners, as well as making these benefits opened up to third-party products as well.”

[Photo: courtesy of Apple]
And from a privacy standpoint, that’s what’s really remarkable about the AirTag: Apple isn’t just thinking about the privacy of AirTag owners themselves, or even solely about users in Apple’s ecosystem. The company designed the AirTag with the privacy of everyone in mind—yes, even Android users and people who have never owned an Apple product.

advertisement

So just what are Apple’s AirTag privacy protections that keep it in the realm of a truly useful tool instead of a gadget for stalkers?

Privacy for AirTag owners

Each AirTag is about the size of a coat button and is designed to let you track whatever item you’ve attached it to, all from the Find My app on the iPhone, iPad, Mac, or iCloud.com. You set up a new AirTag by pairing the diminutive gadget with your iPhone. During the pairing process, the AirTag is associated with your Apple ID, thus making it trackable inside the Find My app.

AirTags don’t rely on an internet connection of their own. Instead, they piggyback off of a network of almost a billion iOS devices and Macs already out in the world. Each AirTag sends out a unique encrypted Bluetooth identifier; other Apple devices can detect it and relay the location of the AirTag directly to an owner’s Apple ID account.

advertisement

[Photo: courtesy of Apple]
This entire process is end-to-end encrypted so that no one but the owner of the AirTag—not the owners of the crowdsourced devices picking up the AirTag’s location or even Apple itself—ever has access to the AirTag’s current or past location. And the Bluetooth identifiers that AirTags emit are not only randomized but “are rotated many times a day and never reused so that as you travel from place to place with the AirTag, you cannot be re-identified,” Huang says.

If you lose your AirTag, somebody can’t just pick up your AirTag, re-pair it with their phone, and continue using it.”

Ron Huang, Apple
Drance and Huang are also keen to note that though almost a billion Apple devices act as a crowdsourced monitoring network that helps keep track of AirTags, the AirTag owner can never see which devices its AirTag’s location is pinging off of or who owns those devices.

AirTags also have a unique security feature called Pairing Lock, which protects against people who may find your lost item and snatch the AirTag from it to use as their own. Huang likens Pairing Lock to the iPhone’s Activation Lock. “It means that if you lose your AirTag, somebody can’t just pick up your AirTag, re-pair it with their phone, and continue using it,” he says. “This has been really impactful for the iPhone and we think it will be for AirTag as well.”

advertisement

Not only can people who gain hold of an AirTag not use it for themselves, but they also can’t find out the identity of who owns it. Every AirTag has a unique serial number printed on it, but the identity of the owner cannot be derived from that number unless that owner activates the AirTag’s Lost Mode. That’s a toggle in the Find My app that marks your AirTag as lost. Once you’ve toggled that option on, someone who finds your lost AirTag can then scan it with any NFC-equipped device (such as an iPhone or Android phone) to display a web URL prompt on that device. Tapping on the prompt will take the finder of your AirTag to an Apple support page featuring the AirTag’s unique serial number and—if the AirTag owner so chooses—the phone number of the AirTag’s owner so the finder can call or text.

Anti-stalking protections

Apple designed the AirTag with one useful purpose in mind: helping people find lost objects. But the company also understands that bad actors may try to use any technology for nefarious purposes. An AirTag designed to track a backpack could also be used to track an unwitting  person. AirTags are small, after all, and one could easily be slipped into someone’s purse or coat pocket without them realizing it.

That’s why Apple has built a number of powerful anti-stalking protections into the AirTag platform. If you’re an iPhone owner running iOS 14.5 or later and someone slips an AirTag into your possession in secret in order to track your movements, your iPhone will warn you this has happened by sending you an “AirTag Found Moving With You” notification. This notification will appear only when an AirTag is following you that is not paired with your Apple ID or another iPhone that is in your vicinity. That distinction is critical so that your iPhone won’t be notified of AirTags that, for instance, belong to other people on the same bus you’re riding. The notification will appear courtesy of the Find My app when the user arrives home–as defined by the address in their contacts “Me” card or if using significant locations. Tapping the notification will take you to the Find My app, where you can tell the AirTag that has been slipped into your possession to emit a sound so you can locate it.

advertisement

But what about people who don’t own an iPhone? How would Android owners—or those without a smartphone at all—know if an AirTag was slipped into their possession by a stalker?

Apple thought of that too. After an AirTag has been away from its paired device for a certain amount of time, the AirTag will automatically emit a sound notifying those around it of its presence. Right now, the AirTag needs to be out of range of its paired device for three days for the sound to emit, but Apple could lengthen or shorten this time via a software update in the future.

If you do find a strange AirTag in your possession, you can use any NFC-capable phone to scan it.

And if you do find a strange AirTag in your possession, you can use any NFC-capable phone to scan it. Tapping the notification that appears in the NFC reader will take you to an Apple website with instructions on how to disable the AirTag and its tracking capabilities immediately—by simply removing its battery. On that same page, you’ll see the unique serial number of the AirTag, which is also printed on the AirTag itself. Though you wouldn’t be able to find out the owner of the AirTag from this serial number, Apple could determine the owner since the AirTag’s unique serial number is associated with an Apple ID during its initial Pair Lock setup.

advertisement

“If you are concerned that there’s a risk of your being tracked you could contact law enforcement,” Drance notes. “What the [AirTag’s] serial number is used for is when you first set up your AirTag it is paired with an Apple ID along with some additional information such as your name, your email address, your date of birth, and things like that, which [Apple] could provide to law enforcement if asked for, with the proper warrants and process.”

Apple doesn’t see this as a scenario that is likely to happen frequently. If bad actors are aware that they cannot track victims and remain anonymous, it should deter stalking by AirTag in the first place.

Are AirTags Purr-fect? Perhaps

AirTags have powerful privacy protections built in as well as robust anti-stalking tech. And at $29 a pop or a four-pack for $99, it’s reasonable to assume Apple’s smallest gadget is going to fly off the shelves.

advertisement

But what many people are still dying to know is, “Can I attach an AirTag to my pet?”

When I asked Drance about parents using AirTags to track their small children (such as during an outing at an amusement park) or pets (we know you’re up to something shady, Fluffy) she was quick to stress that the company designed the AirTag to track items, not people or pets. If parents would like to safely track their young children, she suggests an Apple Watch with Family Setup might be a better choice.

As for strapping an AirTag to a pet, Drance says, “If people do that, they just have to make sure that their moving pet gets into range of a device in the Find My network” so its location can be tracked.

advertisement

Ten bucks says AirTag pet collar holsters are the next hot accessory for the device by the weekend. Just keep in mind that if you’re one of those people who has a few dozen cats, you can’t track them all. Apple limits the number of AirTags that can be associated with a single Apple ID to 16, which means cats numbers 17-36 are out of luck.

Apple’s AirTags go on sale at 5 a.m. PDT Friday, April 23.

About the author

Michael Grothaus is a novelist, journalist, and former screenwriter. His debut novel EPIPHANY JONES is out now from Orenda Books. You can read more about him at MichaelGrothaus.com

More