Apple AirTags' anti-stalking features come with a dangerous loophole

(Image credit: Apple tree)

Apple'south AirTags are finally on sale, and these $29 trackers promise to ensure that you never lose your keys ever again. However, as some reviewers accept discovered, in that location are a couple of big loopholes in the AirTag's privacy features.

During its announcement, Apple spoke of a few features to discourage its AirTags from being used to track people surreptitiously. These AirTags privacy protections sound impressive, such as the fact that an AirTag will sound an alert if it'southward been separated from its paired iPhone for a certain corporeality of fourth dimension, or that iPhone users volition get on-screen notifications if a rogue AirTag is accompanying them.

Simply it appears that these protections may not become far plenty.

Apple tree AirTag review: The best cardinal finder for the iPhone
How Apple AirTags work — and how they thwart stalkers
Plus: Forget AirPods Pro — this has amend battery life and three drivers per bud

For one, that lost-AirTag sound doesn't go off until three days have passed, and merely iPhones that accept updated to iOS fourteen.v will get the on-screen notifications, which come up after a couple of hours.

Like to many of the best keyfinders, Apple's AirTags use Bluetooth to assistance your telephone locate its fob. However, the AirTags also utilise ultra wideband to more precisely lead yous to their location.

On an iPhone with a U1 fleck (currently, the iPhone eleven and iPhone 12), you'll get a directional arrow that points you directly to an AirTag'southward location.

On Apple tree's AirTags page, the visitor notes: "Only you can run across where your AirTag is. Your location data and history are never stored on the AirTag itself.

"Devices that relay the location of your AirTag also stay anonymous, and that location data is encrypted every step of the way. And then not even Apple knows the location of your AirTag or the identity of the device that helps find information technology.

"If someone else's AirTag finds its way into your stuff, your iPhone volition notice it's traveling with you and send yous an alert. After a while, if you still haven't found information technology, the AirTag will start playing a sound to permit y'all know information technology'south in that location."

Sounds nice, just...

Yet, every bit Caitlin McGarry noted in her AirTags review on Gizmodo, your iPhone needs to be running iOS fourteen.v in order to receive on-screen alerts.

If y'all're using an iPhone with an older version of iOS, or an Android device, or have no smartphone at all, you'll take to look for the stalking AirTag to play that sound. (Android phones can interact with AirTags only when locating AirTags that have been marked as lost by their owners.)

Fifty-fifty if your phone has the latest version of iOS, you lot won't receive an alert correct away. You'll also receive an alert when you lot've arrived home. Over at Mashable, Brenda Stoylar discovered that the iOS 14.5 alert pops upwardly after an unpaired AirTag has been following you for two hours abroad from home.

It gets worse: Android users, and anyone with an iPhone that hasn't yet been updated to iOS xiv.5, won't hear that this-AirTag-isn't-yours audio for as long as 3 days.

Troubling findings

Last Thursday, before iOS 14.5 was released, Mashable'south Stolyar gave an AirTag to each of her roommates, both of whom had iPhones. She was able to runway their movements effectually New York Urban center for the next two days.

During this unabridged time, neither of her roommates received any alerts that Stolyar was tracking their movements, other than when she texted them to make certain the location tracking was accurate. (It was.)

Meanwhile, Stolyar tried to replicate the experiment using Tile trackers, and constitute that she couldn't rails anyone who strayed more than than 400 feet (Bluetooth range) from her phone.

"Apple is fast approaching one billion active iPhone devices, making it the largest finder network in the world," Stolyar wrote. "That's non something to brag about when yous're releasing Bluetooth trackers that can too exist used to track people."

Apple is putting Android users in physical jeopardy

Let's face it: A little less than half the smartphones in the The states are iPhones. Worldwide, it'south about i in viii phones. That means there are billions of people who tin be tracked using AirTags for up to three days without them knowing information technology.

"Given how many Android users are out in the world," wrote Gizmodo'south McGarry, "information technology seems most guaranteed that an iPhone possessor could exploit this to utilise against their Android-using partner."

A suspicious spouse using an iPhone or iPad could slip an AirTag into their partner's purse, clothing or machine and be able to see what they're up to for up to 72 hours.

That alert will audio merely if the stalked person is abroad from abode. If the stalkee comes domicile every nighttime, resetting the abroad-from-home countdown, then the stalker might be able to rails their daily movements indefinitely.

McGarry was able to track her husband'due south car (with his consent) moving effectually Los Angeles for an entire mean solar day, and he never got any alerts, even later on he updated his iPhone to iOS 14.five.

"Some publications accept even gone then far as to merits AirTags are 'stalker-proof,'" Stolyar wrote. "But, I can assure you, they are not."

Can this be fixed? Apple tree responds

The silver lining is that these privacy warnings are non hard-coded into the AirTags. They can exist inverse past Apple with a simple over-the-air software update.

McGarry expressed her concerns to Apple, which told her that it "may adapt the logic and timing of these features, which are tunable over the air, to continue improving our deterrents."

In the meantime, if y'all're purchasing AirTags, make certain all your iPhones are updated to iOS 14.v. And if you're an Android user, smile grimly at the fact that as with iMessages, Apple is once over again making you feel like a second-form citizen.

Michael A. Prospero is the deputy editor at Tom's Guide overseeing the home, smart domicile, drones, and fitness/wearables categories, as well as all buying guides and other evergreen content. When he's not testing out the latest running sentinel, skiing or training for a marathon, he's probably using the latest sous vide motorcar or some other cooking gadget.