Surprise: Google's Find My May Be More Private Than Apple's

Google's version of AirTags packs some clever privacy safeguards, but coming from Google, can you trust them?

If you want to find your stuff, then Apple's Find My is an indisputable win. Even if your lost device is switched off and not connected to the internet, you can find it on a map. It's built into computers and accessories like AirPods, and you can add it to anything by attaching or hiding an AirTag inside. And now Google Find My Device is live.

"While Google has made commitments to user privacy and has mechanisms in place to anonymize and protect data, the potential for internal use of location data, even if anonymized, cannot be entirely dismissed. Trusting Google—or any tech company—comes down to their transparency, track record, and the specific privacy controls they offer users," Nic Adams, CEO of cybersecurity and data privacy company Orcus, told Lifewire via email.

Find My Android

Google's Find My Device Network has just gone live, although, unlike Apple, Google itself doesn't sell any tracking tiles. Instead, you buy third-party tracking tiles that use the network or just use Google's network to find your Google phone—the Pixel 8 and 8 Pro, for example, can both still be tracked even when their batteries are dead.

Google Find My Device works the same way as Apple's Find My, with—as we shall see—some extra privacy protections. Your phone (or other tracking device) emits a periodic Bluetooth blip that is picked up by any of the billion-plus Android devices around the world. The receiving Android phone packages up the location and the ID of your Bluetooth blip, encrypts it, and forwards it to Google's servers.

Then, when you use Google Find My Device, you access that encrypted packet from Google's servers, decrypt it, and see the location.

Because your phone only has to emit a Bluetooth signal, and doesn't itself have to connect to the internet, it can be tracked even when it is disconnected. And some phone models—the aforementioned Pixels 8, and current iPhones—keep a small bit of battery in reserve to power the Bluetooth after the rest of the phone is switched off.

It's ingenious, but not perfect. As we have seen with Apple's Find My network, it can be used for stalking. Several mitigations have been introduced to make it harder for somebody to track you. Unknown tracking tiles emit a beep if they travel with you for more than a short interval, and you will get warnings on your phone to tell you if a tracker is near—although if you have a spouse or a friend who has AirPods, and you travel around together, their pods will keep triggering your alerts.

Safety First

The first safeguard is the tracking alert, and Google and Apple have worked together to make this part of their systems interoperable. Your Android phone will detect Apple's AirTags, and vice-versa.

But Google has gone one (or several) better, promises Dave Kleidermacher, Google's VP of engineering, Android security and privacy, in a blog post. For example, when you are at home, your phone will not participate in the Find My Device network. That is, it will ignore any Bluetooth blips it finds. You'll still be able to track your own devices via other means (like last known location or Nest finding), but if a stalker has hidden a tag in your bag or car, it will not be reported by your phone. That might not help in a city where a zillion other Android phones will pick it up, but in more remote regions it essentially creates a blank spot around your home.

Also, the network throttles the number of times you can request a location for a lost tag. The idea is that a lost item is usually stationary, so real-time location updates are only useful to stalkers, etc.

And most importantly, you can stop your Android phone from participating in the Find My Device network altogether.

"During development, it was important for us to ensure the new Find My Device was secure by default and private by design," Kleidermacher wrote.

And yet despite these safeguards, some of us may be reluctant to use Google's tracking tech, seeing as how tracking its users is pretty much Google's entire advertising business model. Can it actually do that, given the safeguards? Perhaps not, but security comes down to trust, and trust is built entirely on how a person or entity has behaved in the past.

"You should not explicitly trust any technology you use, no matter who develops it. The only surefire way to ensure your data won’t be misused is to ensure it never reaches them in the first place," Iva Nedeleva, principal Android engineer at Private Internet Access, told Lifewire via email. "If you're already using Google products, you have already consented to granting your data to Google."