https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi...
There's also the cell layer, which constantly negotiates with cell towers for sector and power as normal idling. So they know your location at least to tower (CGI), sector and delay (CGITA) and sometimes trilaterated (UTDOA) from ~1000m down to 10m accuracy. The towers' base station controllers need to keep logs anyway, so the cell company has records of your rough location.
Then there's bluetooth, wifi, audio beacons, optical, magnetic and inertial nav, all emitting or recieving you move through the world. None of this requires GPS, some requires app participation, some doesn't.
All phones are location and surveillance devices. Leave it home if you're serious.
In general those things are not made public so that you don't have pushbacks.
A very short summary: the law is only supposed to be used for very severe crimes and only if the investigation would otherwise be significantly more difficult or impossible. Also the owners of the tracked phones have to be notified of the tracking as it is a violation of the person's rights. In reality (at the date of the talk) it had never been used for terrorism, about 5% of the time for crimes like murder and in over 70% of the time for theft (including a case of stolen empty beer barrels), and nobody was ever notified.
[0] https://media.ccc.de/v/35c3-9972-funkzellenabfrage_die_allta...
Europe does need a security authority, that doesn't depend on slow bureaucracy.
The master private key used by the system is generated locally and never leaves your Apple devices in a state that anyone except your devices can read it.
The master key is used to derive an AirTag specific private key which is provisioned to the AirTag and is in turn combined with an increasing counter which generates a third private key that's never stored anywhere. The ID broadcast is the public key of this third key. It changes every 30 minutes or 1 hour, I forget which.
Other devices see this key, use it to encrypt their own location, and upload that encrypted blob along with the public key to Find My, and in order for Apple to even know which account the encrypted blob they can't decrypt belongs to I have to actually request the location of my AirTag by locally deriving the keypair it used for a certain point in time.
Which is anonymous and the identity changes every 30 minutes or an hour, I forget which.
If you have some business model either coincidentally or intentionally in alignment of consumer privacy, you're going to see marketing said alignment so long as it's a potential selling point (if it's not, it wont be advertised unless you can spin it).
It doesn't mean anything though. It doesn't mean that either or any business has your interests in mind. Apple executives do not care about your privacy, no matter what narrative they weave. Apple probably banked on older ideals of consumer privacy and didn't anticipate businesses that disregarded user privacy and found ways of making money out of that process would be so successful. They were behind the curve and found a way to spin the narrative that the reality is they're just here to protect consumers all along.
Perhaps they took a risk that differentiating on privacy would be more profitable years ago and are pushing it more now there's real consumer talk (a wise risk path IMHO). No matter what, it's all profit driven. At this point there could be a bit of a sunk cost fallacy and it would be pretty awkward for them to shift but that doesn't mean they won't . Consumers have shown by and large they just don't care about privacy or at least are willing to sacrifice it for other things. That's bad for Apple (and bad for consumers frankly, IMHO).
I don't buy these narratives from any business propaganda machine and you shouldn't either. When push comes to shove, if Apple is down and forced to compete and privacy protection isn't profitable or they're not in a position to explore an alternative truly competitive position, they will jump ship in an instant and mimic the rest of industry.
The only thing keeping these models at bay are a distribution of consumers that keep the competing models afloat. If Apple caves we'd rapidly go down the lack of privacy hole of spying functions until we reach legal protections. If Android caves, we'll see Apples continued model for awhile until the insatiable demand for revenue growth starts looking at initial principles like privacy as the last remaining revenue streams then we'll slowly start back with 2000s era advertising back to current and future dystopian levels of privacy invasion. The difference is just a time factor here, so long as large enough segments of the consumer market will cave to these ideals (which has already been proven).
I suppose some business could just add a line item "privacy tax" that you just pay for depending on the valuation of your privacy so to keep your privacy you clearly pay that tax so the business continues to get its expected revenue growth from said privacy invasion without actually invading your privacy. To some degree this is already baked into higher costs for many Apple products but as markets optimize I anticipate we'll eventually get to such a point, just like we have ad-free and ad-infested service options.
Also I think it a bit humorous - "privacy tax" to me is when services like Google offer services at a cost to my privacy.
Googles hasn't since the start. It's ads. Which leads to abuse and spying.
My Librem 5 isn't.