Apple introduced AirTags in 2021 to help users find lost items. Their small size, affordability, and precise tracking functionality predestined them for technology-facilitated stalking, i.e., consentless tracking of others. As a countermeasure, Apple introduced anti-stalking features to impede misuse of AirTags: unwanted tracking notifications and two locating features. However, the reliability and effectiveness of these measures remain unclear. We present two studies to evaluate unwanted tracking notifications and the tracker locating features. First, we quantify the reliability of unwanted tracking notifications on iOS and Android with N_A=50 fully informed participants. Second, we present a deception study to understand N_B=19 participants' reactions to an unexpected tracking notification. Additionally, we asked participants to locate a hidden AirTag to study the locating features. We found that unwanted tracking notifications are significantly more reliable and timely on iOS than on Android. Effective and safe responses to the tracking notification depended on prior knowledge about the technology or awareness of technology-facilitated abuse.Many participants disregarded the unobtrusive warning entirely. The Find My app's confusing UI made locating the tracker harder than necessary. We recommend (i) enhancing the urgency and clarity of tracking notifications and (ii) offering a guided UX for identifying and disabling trackers.
Usenix Security Symposium (USENIX-Security)
2025-08-13
2025-06-06