What we found
Life360: FLife360 told 50 million families it "does not sell personal information." The FTC found Life360 sold the precise GPS coordinates of 32 million people -- incl...
The FTC charged Life360 with selling precise location data of approximately 32 million users -- including children -- to data brokers without adequate consent (January 2024). The FTC consent order banned Life360 from selling, licensing, or sharing precise location data. The FTC found Life360 failed to ensure data brokers deleted or de-identified data as claimed. Life360's own internal audits revealed brokers were not complying with contractual restrictions. The company continued selling data even after learning brokers were misusing it. Life360 sold data to approximately a dozen brokers including Cuebiq, X-Mode Social, Arity (an Allstate subsidiary), and SafeGraph.
AirTag: FLauren Hughes and dozens of other women went to court to tell Apple what it already knew: a $29 device small enough to slip into a purse had become the stalk...
Class action Hughes v. Apple (Case 3:22-cv-07668) survived Apple's motion to dismiss, representing dozens of stalking victims. The suit alleges AirTags revolutionized stalking due to $29 price, tiny size, and precision accuracy.
Galaxy SmartTag 2: DSamsung says your SmartTag location is private and protected by rotating IDs that change every 15 minutes.
Security research (arxiv:2210.14702) found that SmartTag firmware v1.02.06 accepts Just Works BLE pairing, allowing attackers to extract the Identity Resolving Key (IRK). The IRK is persistent across reboot and account switching, enabling attackers to resolve all rotating Resolvable Private Addresses (RPAs) and track the physical tag indefinitely. The 15-minute ID rotation is rendered meaningless when the IRK is compromised. Additionally, the advertising counter accepts data older than 7 days, undermining replay attack prevention.
Tile Tracker: DBought by Life360, the family tracking app that sold precise location data to data brokers.
Georgia Tech security research (arxiv 2510.00350) found Tile broadcasts unencrypted, static MAC addresses via BLE — unlike Apple AirTag which uses rotating encrypted identifiers. Any passive Bluetooth observer can permanently fingerprint and track a Tile device from a single recorded message. Tile's servers continuously collect unencrypted location information on ALL users, giving the company (and any breach attacker) mass surveillance capability. EFF called this 'a danger for users everywhere.'