The problem is that the use case for tracking stolen items and the use case for tracking a person without their consent are identical, except for which side of the transaction the bad actor is on.

I cannot think of a resolution to this, but think the 3 day compromise is a fair start.

There are many, many more thieves than stalkers, but stalkers can do arguably much more harm per incident.