I Tag, You Tag, Everybody Tags!

Location tags enable tracking of personal belongings. This is achieved locally, e.g., via Bluetooth with a paired phone, and remotely, by piggybacking on the location reported by location-reporting devices which come into proximity of a tag. There has been anecdotal evidence that location tags are also misused to stalk people. This paper studies the performance of the two most popular location tags (Apple's AirTag and Samsung's SmartTag) through controlled experiments -- with a known large distribution of location-reporting devices -- as well as in-the-wild experiments -- with no control on the number and kind of reporting devices encountered, thus emulating real-life use-cases. We find that both tags achieve similar performance, e.g., they are located 60% of the times in about 10 minutes within a 100 meter radius. It follows that real time stalking via location tags is impractical, even when both tags are concurrently deployed which achieves comparable accuracy in half the time. Nevertheless, half of a victim's movements can be backtracked accurately (10 meter error) with just a one-hour delay.