Researchers at Georgia Tech reverse‑engineered Tile’s Android app and found that the platform continuously broadcasts unencrypted BLE advertisements containing plaintext location data and static MAC addresses. Their analysis showed that Tile’s earlier privacy claims—stating that data was anonymous and only the user could see their Tile location—have been removed from the policy.

The current Life360 privacy policy (updated December 2025) now discloses that precise geolocation, movement data, and other information are shared with business partners for advertising and monetization, even noting in a Texas‑specific notice that sensitive personal data may be sold. Tile tags rotate through only 8,640 pseudonymous IDs, which repeat every 90 days without regeneration, allowing a patient adversary to build a lookup table from a single observation.

When Anti‑Theft Mode is enabled on a hidden tag, Tile’s own Scan and Secure feature will never detect it, although the app still records the data server‑side; a modified client can reveal everything. The researchers disclosed the findings to Life360 in November 2024, received engagement until February 2025, then silence. EFF’s Thorin Klosowski said Tile has done little to mitigate stalker‑related concerns.

Users can test for static identifiers using Circuit Python on a Adafruit Bluefruit board: scan BLE advertisements, log addresses, and check whether they rotate. The Adafruit BLE library and Bluefruit LE Sniffer with Wireshark let anyone verify if a tag broadcasts unencrypted, static MACs—a first step toward defending against unwanted tracking.