I thought the system was designed in such a way that the data is meaningless to anyone but the owner of the tag, so that third-parties can't learn anything from said data.
The iOS device keeps seeing a random AirTag in close proximity. Even as the ID rotates, it's still about 2m away, and continues to be 2m away as you move. It doesn't know who it belongs to, but it's probably the same physical device, because it keeps going to wherever you're going.
That's a different scenario than the evil store owner who wants to track their customers. In that case, it's just a random procession of tags roaming about the store. A tag arriving at the store on repeated days has nothing to indicate that it's the same one.
So if it's being used as a malicious tracker (hidden in someone's car or purse), then the constant proximity is a clue. But if someone is trying to guess which tag belongs to a specific person, they can't unless they maintain constant contact with that tag over a long timeline. At that point, they can just see you :)
Meanwhile, if you're trying to use these things to track visitors to your store, you're only getting 16 bins of people. My "E" tag will be the same as 50 other people who've visited last week with the same "E" suffix.
I'm having a hard time finding the actual whitepaper on this. Hopefully someone links it in this thread.
The protocol is in Ivan Kristic’s Black Hat 2019 talk: https://i.blackhat.com/USA-19/Thursday/us-19-Krstic-Behind-T...
Finally, the static part of the broadcast doesn’t need to be permanently static. It simply needs to rotate at a period that’s longer than the rest of the public key.