Find My privacy: how Apple encrypts tag locations

The problem Find My privacy has to solve

Two requirements that look mutually exclusive.

A tag must be findable by strangers' devices, or the network does not work. But it must not be followable by strangers, or every tag becomes a stalking device and every owner becomes trackable by anyone with an aerial.

Apple's answer is a piece of public-key cryptography that keeps the finding while removing the identity.

Rotating keys, roughly every fifteen minutes

When offline finding is enabled, the device generates an elliptic curve key pair, a private key it keeps, and a public key it broadcasts. Apple uses the P-224 curve specifically because the public key fits inside a single Bluetooth advertising payload.

The crucial part is that the broadcast public key does not stay still. Approximately every fifteen minutes it is replaced by a newly derived one, so that no persistent identifier exists to follow. Apple's platform security documentation is explicit that the derivation is designed so the successive public keys cannot be linked back to the same device.

The practical consequence: someone sitting in a café logging Bluetooth advertisements sees an unrelated new identity from your tag four times an hour. There is nothing to correlate, and nothing to build a trail from.

What a passing phone does

A stranger's iPhone that hears your tag performs a small, one-sided favour.

1. It notes its own location, from its own GPS.
2. It encrypts that location to the public key your tag just broadcast.
3. It uploads the encrypted result to Apple.

The finder's device learns nothing. It cannot tell whose tag it saw, cannot read what it just encrypted, and never sees your identity. Apple's own description of the traffic is that it carries no authentication information in either the contents or the headers, so Apple does not know who the finder is or whose device has been found.

What Apple can and cannot see

Apple stores encrypted location reports it cannot decrypt. The private key needed to open them was generated on your device and never sent to Apple; it syncs only between your own devices, through iCloud Keychain, end to end encrypted.

Apple cannot build your tag's location history. It holds ciphertext indexed by rotating identifiers it cannot link together.

Your device does the decryption. When you open Find My, your iPhone works out which identifiers its tags would have broadcast, fetches the matching reports and decrypts them locally. The map is assembled on your phone, not on a server.

And the manufacturer?

Not in the chain at all. A certified Find My accessory has no servers, no account and no telemetry. We cannot see where your tag is, and neither can the company that made the hardware. That is not a policy promise; it is a structural fact about where the keys live.

Anti-stalking: the other half of the design

Encryption stops third parties reading your tag's location. A separate system stops your tag being used against somebody else.

An iPhone that notices an unknown Find My tag travelling with it over time raises an alert, and the same detection now reaches non-Apple phones too. The person alerted can make the tag play a sound to locate it and get instructions for disabling it. Apple's guidance is on its page for what to do if you get an alert that a location-tracking device is with you.

There is a deliberate exception worth knowing: if somebody has shared an item with you, you will not be alerted when it travels with you. That is correct for a family suitcase and a genuine reason to be thoughtful about who you share items with.

Where the residual risk actually is

Being honest about the limits is part of the answer.

• Lost Mode is opt-in exposure. You choose to publish a contact route, and it stays published until you switch it off.
• Sharing suppresses alerts for the people you share with.
• Anyone with access to your unlocked phone sees your items. A tag's privacy inherits your device's privacy.
• The system is not anonymous to your own account. It is designed to be private from everybody else, not from you.

Apple's own technical writing on this is in Find My security and End-to-end encryption in Find My, and both are readable.

How Orbit Tag helps

All of the above applies to an Orbit Tag unchanged, because it is a certified Find My accessory rather than a tracker with an app of its own. It pairs as an Other Item inside Find My, on Apple hardware from iOS 14.5 onward, broadcasts the same rotating identifiers, is relayed by the same anonymous finders, and is decrypted only by devices you own. There is no account with us to create, no login, no subscription, and no server of ours that could ever leak anything, because none exists. Apple's unwanted-tracking warnings work, as certification requires.

The hardware around that is unremarkable in a good way: 36.3 by 36.3 by 9 mm, roughly 10 g, IP67 sealed, an 80 to 100 dB alarm you can trigger over Bluetooth up to 60 m away, a ring hole moulded through the case with two rings in the pack, and a CR2032 you replace yourself that runs for about two years. Items can be lent to relatives from iOS 17 upward. There is no Ultra Wideband, therefore no Precision Finding, and no Android compatibility.

How we handle your order details, as distinct from your tracker's location, which we never see, is set out on the privacy page.

Two trackers per box, under £15 a box, delivery free within the UK: see the tracker.

Related: what MFi certification guarantees.