Tile’s Security Is So Bad It’s a Feature for Stalkers " Adafruit Industries – Makers, hackers, artists, designers and engineers!
Search
Shopping cart, 0items.
News, Resources, & More …
Popular Categoriesview all
3D printing (17587)<br>Raspberry Pi (10621)<br>art (8791)<br>wearables (5217)<br>arduino (4618)<br>science (4574)<br>CircuitPython (4149)<br>random (3796)<br>adafruit learning system (3649)<br>music (3234)
costuming (3051)<br>cosplay (2830)<br>robotics (2803)<br>history (2733)<br>community (2705)<br>educators (2692)<br>New Products (2605)<br>space (2595)<br>ask-an-engineer (2515)<br>holiday (2491)
New Postsview all
July 25, 2026 at 1:15 pm
Voice Recognition and Speech Synthesis on an RPi…
July 25, 2026 at 10:00 am
Backyard Squirrel Box With Camera
July 24, 2026 at 4:15 pm
John Park’s CircuitPython Parsec:…
Featured Postsview all
July 7, 2026 at 6:30 pm
New nEw NEWS From Adafruit Round-Up: April, May…
June 29, 2026 at 9:54 am
Shipping Alert: Independence Day – Friday, July 3…
June 24, 2026 at 8:15 pm
Chris Young announces his retirement after 14…
Search
BLOG
March 5, 2026 AT 9:23 am
Tile’s Security Is So Bad It’s a Feature for Stalkers
Overview of Tile’s location tracking vulnerabilities: unencrypted BLE broadcasts and plaintext location reporting enable persistent tracking by both the platform server and passive adversaries.
Researchers at Georgia Tech just published the first full security teardown of Tile’s location tracking protocol. Akshaya Kumar, Anna Raymaker, and Michael Specter reverse-engineered the Android app, intercepted the network traffic, and found that many of the security claims Tile had made appear to be wrong.
When the researchers began their work, Tile’s privacy policy claimed "any information transmitted across our network is anonymous" and "you are the only one with the ability to see your Tile location." Those claims have since been removed from the privacy policy – I checked! The current Life360 privacy policy, updated December 2025, removed that language. They replaced it with something way worse … Section IV.E now states that Life360 discloses "precise geolocation data, movement data, and other information" to business partners for "their own advertising and monetization purposes." There’s even a Texas-specific notice that says, straight up, "We may sell your sensitive personal data." They went from making false claims about collecting your location… to just straight up saying they sell it!
The researchers found Tile’s servers continuously collect unencrypted location data for all users and tags, including static MAC addresses in plain text – not anonymized . Apple, Google, and Samsung tags all encrypt location reports end-to-end so the platform itself can’t read them, but Tile doesn’t.
The Tile Mate 2022 broadcasts a static MAC address, one passive observation fingerprints that device permanently. The rotating pseudonymous IDs? They cycle through 8,640 values and repeat every 90 days without regeneration. A patient adversary with an RF receiver can build a complete lookup table for any tag they observe.
Tile’s Anti-Theft Mode makes tags invisible to their own anti-stalking scans. A stalker enables it on a hidden tag, and the victim’s Scan and Secure will never find it. The researchers also showed the protection is superficial: the app still records the data during scanning, but the server filters it from the display, so anyone with a modified app can see everything.
The researchers disclosed this to Life360 in November 2024. The company engaged until February 2025, then went silent. The EFF’s Thorin Klosowski says Tile "has done little to mitigate the concerns we’ve raised around stalkers using their devices to track people."
The full paper is on arXiv (2510.00350v1).
Try it yourself! Scanning for BLE trackers with CircuitPython
Grab a Circuit Playground Bluefruit or Feather nRF52840 Express with CircuitPython and the adafruit_ble library:
import time<br>from adafruit_ble import BLERadio
ble = BLERadio()
while True:<br>print("scanning...")<br>found = set()<br>try:<br>for ad in ble.start_scan(timeout=10):<br>addr = ad.address<br>if addr in found:<br>continue<br>found.add(addr)
print(f" {addr} rssi:{ad.rssi}")
# keep repr for exploration, but it's noisy<br># print(f" {repr(ad)}")
# try to print common, comparable fields (only if present)<br>name = getattr(ad, "complete_name", None) or getattr(ad, "short_name", None)<br>if name:<br>print(f" name: {name}")
mfg = getattr(ad, "manufacturer_data", None)<br>if mfg:<br># manufacturer_data is usually a dict keyed by company id<br>print(f" mfg: {mfg}")
svc = getattr(ad, "service_data", None)<br>if svc:<br>print(f" service_data: {svc}")
uuids = getattr(ad, "service_uuids", None)<br>if uuids:<br>print(f" service_uuids: {uuids}")
finally:<br># explicit cleanup helps avoid edge-case scan state issues<br>ble.stop_scan()
print(f"found {len(found)} devices\n")<br>time.sleep(5)
This catches every BLE device advertising nearby, shows addresses and signal strength, and lets you verify whether devices around you...