The new AirTag from Apple is a compact tracking device that has an extremely long life and precise locating ability in the right circumstances. Unlike a GPS tracker, which requires cell service and may drain a battery quickly, an AirTag relies on the distributed Find My network of iPhones, iPads, and Macs that hundreds of millions of people around the world carry with them, and uses Bluetooth LE to signal that hardware.
While there are a thousand positive and legitimate ways to use an AirTag, it can be abused when someone tracks you without your knowledge, which potentially exposes you to a dangerous situation. For example, the York regional police department in Canada recently announced that AirTags are being placed in hidden areas of target cars parked in public, and then tracked to the driver’s residence, where the cars are stolen while parked in the driveway.
Incidents like this are rare (York police said there have been five AirTag-involved thefts out of 2,000 in the region). Apple has put some safeguards in place so that an iPhone, iPad, and AirTag provide varying alerts and information if one is moving with you and the owner who paired the AirTag with their iPhone or iPad isn’t nearby.
Geoffrey Fowler at the Washington Post and Victoria Song at Gizmodo point out that those measures don’t seem like enough. While it’s assumed Apple will modify and improve how AirTag can provide tracking of our stuff with less risk to our safety, you can take some additional precautions and steps right now to reduce the odds of unwanted location tracking.
You probably know already if you’re a candidate for involuntary tracking: someone in your life (or formerly so) or a family member may show up at unexpected times in unexpected places when they have no reason to know you’re there. They may comment in person, via email, or otherwise about your activities or whereabouts. Or you’re in the middle of or long past a nasty break-up of a relationship or marriage, or have broken off contact with a parent or family members.
Whatever the case, if you’re in need of help, consult the National Domestic Violence Hotline or more specialized resources for victims of domestic abusive, stalking, and other violence listed by the National Coalition Against Domestic Violence. Local law enforcement, the FBI, or national police in other countries also offer resources.
How to set your devices from letting an AirTag track you
Everyone whose devices participate in relaying secured, privacy-protecting location information about their devices and AirTags effectively were opted into the Find My network. That makes everyone around you a potential participant in tracking an AirTag you don’t know about.
However, you can at least opt yourself out, though this removes your ability to track your own lost or stolen iPhone, iPad, Apple Watch, Mac, or an AirTag through this extended network.
- In iOS 13 or iPadOS 14 or later go to Settings > account name > Find My > Find My iPhone/iPad, and disable Find My network.
- In macOS 10.15 Catalina or later, go to the Apple ID preference pane, select the iCloud link at left, click the Options button to the right of the Find My Mac item, and uncheck Offline Finding or Find My network (the text varies by macOS version).
Earlier versions of iOS and macOS don’t include support for the Find My network.
If you’re traveling regularly through urban and suburban areas or on public transportation, other people’s devices will still pick up and relay location information about any AirTag that’s with you. That includes something as innocuous as pulling over to a rest area on a highway, and someone 50 feet away has an iPhone, or even driving on a highway near other people who have iPhones or iPads connected to a cellular network.
Bluetooth LE’s range is surprisingly long. I found that an AirTag I temporarily placed in my car, parked two flights of stairs down from our ground floor and about 50 feet from the house still provided regular updates about its location via devices I owned—not to mention those of neighbors walking or driving by.
Use a Bluetooth scanner to find AirTag
Because AirTag regularly emits Bluetooth signals that Apple devices can pick up, you can use a simple Bluetooth tracker for iOS or iPadOS to scan the area around you and see if an AirTag is nearby. While these tracking apps can’t identify AirTag as such—AirTag changes its Bluetooth ID regularly to avoid being trackable themselves—the apps give you the lay of the landscape. That includes the names of Bluetooth devices that do label themselves in their broadcasts.
BLE Scanner is a limited but free app that provides a list of Bluetooth devices your iPhone or iPad can detect, and offers a mapping feature that roughly sorts them by signal strength into distance away. This is particularly useful if you’re checking out whether a car has a hidden AirTag; less so inside when there may be dozens of your own and neighbors’ devices close enough to register. Regular Bluetooth devices typically identify themselves generically (like my “HP OfficeJet Pro 9010 series” printer) or specifically, as with the sharing name of your Macs, iPhones, iPads, Apple TVs, FitBit trackers, and so on.
Bluetooth BLE Device Finder (free to download, but $4.99 to unlock needed features) has the advantage of letting you drill down into Bluetooth technical details, which may give additional clues about which devices are legitimate and not.
If you can eliminate all known Bluetooth devices, including by powering down equipment that you’re unsure of, and what’s left has no associated name, it can be worth looking further by hand.
You could be slipped an AirTag
Because AirTag doesn’t register proximity except to the owner, the only way it can be used to gather information about you is if it travels with you. An AirTag in your home, office, or classroom won’t reveal anything to someone trying to keep tabs. That reduces the “surface area” of unwanted surveillance because the AirTag has to be in your clothes, wallet or purse, something else you’re carrying, or in a vehicle you’re in and using exclusively or at least regularly.
If you haven’t seen an AirTag, consult Apple’s site. They’re somewhat larger than an American quarter or a dollar/pound/single unit coin in many countries, and about three to four times thicker with a rounded white top. There’s no serial number printed on it or found within it, but I describe later using NFC how to obtain that number.
- Check pockets: In clothing, purses, luggage, messenger bags, and other items, unzip and feel for an AirTag that’s been placed or sewn in.
- Examine a car: A car may have a number of locations that are unreachable or hard to check. Because an AirTag has as long as a year’s worth of power, someone might wrap it in cotton (to stifle the beep it may make; see below), and slit a fabric seam, slip it in, and sew it back up. Parking your car away from homes and businesses and using a Bluetooth scanner can help you pinpoint if one is in your car.
Even if someone doesn’t have access to your home, work, school, or vehicle, and you don’t receive mail at the address at which you live—you might use a P.O. box or another person’s address—someone could ship you an item with an AirTag in it, and when you take that home, they could have your location. If you’re in that specific situation, you may need to examine all packages received elsewhere before bringing them home.
Notifications and alerts to know about
Apple has two kinds of alerts it offers to help let someone know that there’s an AirTag near them that isn’t associated with their iCloud account. These alerts happen after some period of time or while you’re moving and the AirTag is moving with you.
First, if you have an iPhone or iPad running iOS/iPadOS 14.5 or later, it tracks whether when you’re moving from place to place a Bluetooth ID associated with an AirTag is, too. If so, you’ll get a notification that tells you there’s an AirTag moving with you, and, when tapped, provides additional information. This includes how long it’s seen this AirTag, and the locations that your device has transmitted associated with the AirTag.
Apple notes that the innocent case is that you borrowed an item from someone with an AirTag attached or inside it. You can tap to disable “safety” alerts for a day or, if you’re in a Family Sharing group with the owner, indefinitely. You can also tap to make it play a sound, an action that occurs via Bluetooth.
However, the Bluetooth ID produced by an AirTag, and by all Apple devices that participate in Find My crowdsourcing, changes on a regular basis to avoid becoming a reverse tracking item: if it were persistent, then someone could track your devices based on the “anonymous” Bluetooth ID. That means that your iPhone or iPad has to notice an AirTag moving with it over a relatively short period of time.
Second, after what Apple calls an “extended period of time” away from its paired iPhone or iPad, which the company has disclosed elsewhere is three days, an AirTag makes a beep whenever it’s moved. If you hear an unexpected beep from something you’re carrying or within your vehicle, then it’s time to engage in the hunt for an AirTag.
The audio alert winds up being less useful than one might hope. If a stalker or other person engaged in surveillance can come within range of the AirTag at least every three days, and they know you don’t have an iPhone or iPad that’s running 14.5 or later, they can reset that counter. The beep that’s made isn’t ongoing or particularly loud, and it can be muffled without blocking the Bluetooth signal substantially.
If you find an AirTag, you can safely determine more information about it without disclosing to the person who planted it that you’ve done so. The AirTag includes NFC, useful both for pairing the device initially and for letting any smartphone or tablet with an NFC reader pull up a URL from the device. That includes Android phones and other hardware, as it uses an industry standard for NFC encoding. On following the URL, you’re taken to a page that contains the AirTag’s serial number. That page can also show a phone number set by the owner if they marked it lost. The owner isn’t notified in any fashion about the page being loaded, and Apple preserves the owner’s privacy by providing no direct linkage at all.
However, in the case of unwanted tracking, the serial number may help if you pursue civil action, want to obtain a restraining order, or contact law enforcement. Because AirTag tracking requires device pairing, an iCloud account, and an iPhone or iPad that’s logged into the account, anyone actively tracking you is also producing a trail of information stored on their phone, across the cellular network, and in other places.
Apple uses end-to-end encryption to protect the location information sent from an arbitrary device to an iPhone, iPad, or Mac, which has to use the Find My app to view it. But the information isn’t secured in the same way on the device. Police and national investigators would be able to create a close association of logins and access, as well as prove that an AirTag was paired with a specific iPhone or iPad. This may deter abusers and others somewhat, if they’re aware of how easily they can be tracked back.
Once you’ve found the AirTag and obtained the information you want from it, you don’t need a hammer or rock to disable it. Unlike most of Apple’s hardware, the AirTag has a removable battery. Simple use pressure to rotate its metal underside counter-clockwise (from upper right to upper left) to remove that plate, and then remove the battery.
