It's been doing this for nearly a decade since I believe their acquisition of WifiSlam back in 2013. They use it roughly triangulate a device's position when GPS/Cellular is not available.
If you can imagine it happening, it is safest to assume that it is already happening.
If Apple is using iPhones to pair location and MAC addresses of nearby devices, that is indeed "location being tracked by other people's iPhones".
Whether your (and everybody else) iPhone and gps helping tell where my stolen bicycle is, is a good enough benefit to outweigh the privacy trade off is a good question (that Apple never asked me before opting me into their global Bluetooth surveillance platform).
When you pair a tag with a device they agree a shared key which is used to create a temporary identifier that changes every couple of hours. The tag broadcasts this identifier every few seconds, and nearby devices who hear it create a location message based on their position and encrypt it using the identifier as a public key, and then send that to Apple.
Apple can’t read that message. Only the paired device can recreate the current temporary private key and decode for location data, etc. The paired device knows what the current temporary identifier should be and just asks Apple for any associated messages the Find My network may have received
In theory Apple can’t snoop any of this - as long as the shared secret does leave the paired devices. It’s always possible there’s a back-door for targeted unveiling under legal obligation, of-course - but it’s supposed to be private under general use.
My AirTags have their "location being tracked by other people's iPhones".
Sure - if we believe Apple (and I mostly do here) that their protocol and encryption works the way they describe, and that there's no bugs or back doors - then the only person who get to see my AirTag's location is me.
But that still means "And Apple have clearly decided that’s ok" that my AirTags have their "location being tracked by other people's iPhones". They're selling me products on the assumption that your iPhone (and everybody else's, or at least enough other iPhone owners to make it useful) will happily listen out for bluetooth signals from AirTags, power up their GPS to get a current location, encrypt a bunch of data, then use your cellular data plan to send it to Apple for me.
I'm sure 99% of the people on HN, if you'd told them 10-15 years ago that's what their phone would be doing by default in 2021, they'd have laughed at you and called you delusional. Or asked which dystopian scifi writer came up with that insane plot device.
They weren't fined whatsoever for the collection of the data. The fine was for stonewalling the investigation.
> But, the commission said, Google did not engage in illegal wiretapping because the data was flowing, unencrypted, over open radio waves.
At what point does reading unencrypted radio waves on open-use frequencies become an invasion of privacy? It'd be like a restaurant owner requiring people get permission before being able to write down the restaurant's name. If it's possible to passively read it for free, you can't control who views it.
They're putting radios everywhere and anywhere now, but I don't think consumers generally expect and want anyone to be able to hear their devices, let alone scoop up the data and store it in a database with gps coordinates.
You might also ask at what point does reading of unencrypted audio frequency vibrations originating from a private home become an invasion of privacy? Most homes aren't perfectly soundproof, and it's not too hard to make devices that can listen in. Is it ok just because you can? Same for radio imaging, etc.
If the transmitter is inside a house, and the unintended receiver is outside, that seems pretty clearly a violation of privacy.
In any case, yes Apple may be within legality to record devices nearby broadcasting their location, but it feels scummy to me.
Those are definitely not randomized by default, even if operating systems tell them to act as if they are.
And even then, why would that require being on the same network? I can see my wifi router's MAC without being connected to the network, ditto for your phones bluetooth.
Edits because mobile.
The hardware still has a set MAC, and the rest of the hardware whos addresses are being reported may or may not be randomized.
That's the benefit that they expose to the user. What they do with the data as well as that is only known to some people in Apple.
Edit: he/their