Efforts to find unknown AirTags and other trackers received a big boost with an industry standard released in 2024 by Apple and Google. Called Detecting Unwanted Location Trackers (DULT), the two companies have implemented it in their ecosystems.
A few other companies expressed initial support for this specification, but only Chipolo and Pebblebee have incorporated the required features into aspects of their apps and hardware that aren’t part of the Apple Find My and Google Find Hub requirements. The rest of the industry has fallen down entirely—but lacks effective crowdsourced tracking due to a small installed base.
One of the only significant elements of the standard that wasn’t part of Apple’s existing framework is a requirement that each ecosystem’s operator requires an email address and phone number from a tracker’s registered user, which wasn’t necessarily the case across all current crowdsourced trackers.
When someone discovers or is alerted to a tracker near them, an app can access those details. Both the email address and the phone number are masked. The spec explains the reasoning:
The specification explains the reasoning. In many cases the person being tracked already knows the tracker’s owner. An obfuscated email address or phone number gives a victim “some level of information on the owner”. It also protects owners merely separated from their property.
Makers must maintain a database of serial numbers and associated phone numbers and email addresses under this proposal, and provide the registered details to law enforcement on request—no subpoena or other judicial process required. However, there’s also no process noted for how the email and phone number are validated. We know that Apple associates your Apple Account information with an AirTag and Find My items, and those require validation.
This raises some privacy concerns. On the one hand, we should preserve our digital and real-world privacy as much as possible, and Apple has been a stalwart defender of our rights against companies and governments in that regard.
However, on the other hand, when there’s clear evidence of potential criminality and the likelihood of harm or violence—like someone finding a tracking device they don’t own placed in their stuff—making information available to police with proper credentials to pursue the tracking person seems desirable. The issue in practice will be how well companies mediate providing government access to the tracker registration database.
How the Google stalking alerts differ
When Google announced their Find Hub Bluetooth tracking devices in 2024, they explained that crowdsourced relaying of location would be much more restricted than with Apple’s network:
- A tracker’s location is relayed only when it’s in what Google calls a high-traffic area, like an airport, café, “busy footpaths,” or public transit. This prevents location tracking in places like homes or on a solo bike ride or drive.
- If you let Google know your home address via your Google Account (a wasp’s nest of privacy issues, to be sure), any Android device you have won’t relay location information for trackers when you’re in or near your home.
- A tracker’s owner can’t continuously request the device’s location. Google hasn’t provided details, but says they “rate limit” and “throttle” requests, as most lost items remain in stationary locations.
These are excellent additions to the privacy and safety arsenal that I hope Apple ultimately adopts as well.
What the reports actually showed
An odd report came from the York Regional Police in Ontario, Canada, in December 2021: car thieves were using AirTags to track down and steal cars. The police said they found AirTags used to “mark” expensive vehicles in public locations (and offered a photo of one instance) so that thieves could locate them later in easier-to-steal locations, like a public street or driveway.
Following this report, news media and other police departments issued a flurry of accounts of both car thieves and stalkers using AirTags. Some reports are sketchy; some lead with a strong headline, but then note that it was probably a false positive. In one case, a 17-year-old discovered her mother was tracking her. How prevalent is this, really?
Apple responded to these reports and others on Feb. 10, 2022, with a statement called “An update on AirTag and unwanted tracking.” Along with a host of improvements, nearly all rolled out in 2022, Apple also noted, “Based on our knowledge and on discussions with law enforcement, incidents of AirTag misuse are rare; however, each instance is one too many.” (Apple also updated their unwanted tracking support document.)
For a period, the phenomenon seemed to disappear, in 2023 and 2024. However, I’ve seen a new resurgence of reporting. The scope of the issue is impossible to gauge.
Police suggest the reverse use
Many police and sheriff’s departments suggest turning AirTags around: to help recover cars and be aware of thefts, law-enforcement groups suggest sticking an AirTag in your car. In fact, after a huge surge in thefts of certain Kia and Hyundai models due to a security flaw, the New York City mayor gave out 500 AirTags donated by a nonprofit to residents in heavily affected areas. Police warn, however, not to try to recover your own car; this has led to deaths and injury.
Regardless of how often AirTags are misused, Apple suggests contacting law enforcement if you feel endangered. All Find My items provide a little help here, as you can connect to a webpage associated with the item and see the last four digits of the phone number associated with the device. You may recognize the number, or the police may use it to track down the person who is tracking you.
An AirTag makes it easy: you tap or hold the AirTag near anything with an NFC reader, and it prompts with a webpage link. For other devices, a finder has to go through a multi-step process (see how to identify an AirTag you have found).
Where to get help
There are many organizations beyond law enforcement eager to help people trapped in situations of domestic abuse or child subject to violence and an unsafe environment. For adults in the United States, that includes the National Domestic Violence Hotline; for children or those concerned about their welfare in the United States and Canada, the Childhelp National Child Abuse Hotline.
For those being stalked, one starting point is Safehope. It’s more likely you will need the help of police or federal authorities. Local police departments have their own paths to navigate, but for online or cyber stalking, it may be better to start with the FBI.
If the person you are worried about may be watching your device, use one they cannot see. Removing a tracker or turning off sharing can be noticed, and advocates warn that it can make a situation worse rather than better, so it is worth talking to someone before you act.
