Security News

Apple AirTags are being used to track people without their consent

Emma McGowan 8 Feb 2022

Products should be clear about what is being shared, who has access to that information, and how to turn it on or off — and all of that information should be easy to access and easy to change

Apple AirTags were introduced to the public mid-way through 2021 and, by the end of the year, there were public reports about them being used to track people without their consent. Women were finding them in their purses; in the wheel wells of their cars; in their coat pockets. By January 2022, there were police records from multiple states and countries of reports of AirTags being misused.

Toby Shulruff, Technology Safety Project Manager at the National Network to End Domestic Violence (NNEDV), became aware of the possibility of location trackers being used in stalking in 2017. But back then, she tells Avast, the technology just wasn’t as effective.

“It became clear that ‘protective husbands,’ as they call themselves on YouTube, saw location trackers as not useful,” Shulruff says. “Because they weren’t in the Apple ecosystem and were built by smaller companies, they were much more difficult to use.”


Further reading:
Safe Connections Act aims to end digital stalking
How to make a connected life safe again


Originally intended to help people keep track of their personal possessions, the $29, 1.25” tags use the Bluetooth sensors on Apple’s vast network of devices to ping against and track an item’s location. That network makes it possible to track an item — or a person — almost in real-time. So while the products created by smaller companies still create a risk for people in intimate partner violence situations — even one ping could alert an abusive partner than a survivor has moved to a new city, Shulruff says — their stalking potential is nothing compared to that of AirTags. 

Apple did identify the potential misuse of AirTags fairly quickly and built in a warning system. People with iPhones get a popup from the “Find My” app alerting them if an “unknown accessory” is detected near them and that the owner of the device can see their location. The AirTags are also programmed to make a beeping noise once they’ve been out of range of their owner for a certain amount of time. 

But while the Find My app alerts Apple users of potential stalking, Android users are not automatically afforded that protection. In fact, it took Apple six months after AirTags were introduced to release an AirTag detector app for Android, which has been downloaded by roughly 400,000 people. The new app provides much-needed protection for people outside of the Apple ecosystem — but only if they know about it and proactively install it. That means that millions of people are still at risk of being tracked without their knowledge or consent.

Shulruff does not believe the reports of AirTags being used for stalking means we need to do away with AirTags and other location trackers, even if that were possible. Trackers are useful, she points out, not only for everyday use cases like keeping track of your items but also for survivors who are concerned about possible kidnapping. In the latter case, a location tracker could be a vital part of a safety plan. 

She also points out that while AirTags are the latest way that abusers track their victims, they’re unfortunately just one tool in that arsenal. Through her work at the NNEDV, Shulruff has found that the many ways our digital lives are entangled these days makes it very difficult for a person experiencing intimate partner violence to stay safe.

“Many survivors don’t know exactly how they’re being stalked,” Shulruff says. “Is it through social media, their phone number, a tracker? It makes it difficult for people to navigate and creates a situation in which abusive people or stalkers can create a sense of omnipotence or omniscience.”

With that in mind, Shulruff would like to see all companies — Apple included — take into consideration that peoples’ life circumstances might change and that a relationship that was once safe and trusting could become unsafe. Products should therefore be explicitly clear with the end user about what is being shared, who has access to that information, and how to turn it on or off. And all of that information should be easy to access and easy to change if need be. 

For people who think they are being tracked without their consent via AirTags or through another method, Shulruff recommends running a search on a search engine to find out the best thing to do, as “things change quickly and might change week-to-week.” She also recommends checking out the NNEDV Technology Safety and Privacy toolkit for more tips and to reach out to the U.S. National Domestic Violence Hotline (1-800-799-7233) or police, depending on your comfort level.