Is your phone being tracked? Stalkerware, AirTags and location sharing

Safety first. If you think a partner, an ex, or anyone who controls you may be tracking you, make a plan before you change anything. The FTC warns that removing spyware “could tip off your abuser,” who may then escalate. Contact the National Domestic Violence Hotline from a device that person has never touched: 1-800-799-7233 or thehotline.org. The Hotline’s site warns that internet use can be monitored, and it has a quick exit button. In an emergency, call 911.

A phone can be tracked in three main ways. Someone may see your location through sharing or an account they can open. A small Bluetooth tag may be hidden in your bag or car. Or spyware may run on the phone itself. You can check all three in about 20 minutes, and the first two need no special software.

Before you check anything

If you are not in a risky situation, for example you only got an alert about an unknown tag, skip to the steps. If you are, start here:

1. Use a safe device. The FTC says not to contact an advocate or the police from a phone that may have spyware. Borrow a friend’s or relative’s phone, or buy a pay-as-you-go phone.
2. Expect that changes can be noticed. The Safety Net Project, part of the National Network to End Domestic Violence, says changes “will often alert the other person.” It adds that they “might become more abusive” and that changes might erase evidence.
3. Write things down first, if it feels safe. Note what the person has said or done that suggests they know where you are. Take screenshots of anything related to tracking.
4. Talk to an advocate. Advocates help you build a safety plan and decide when to turn tracking off.

Step 1: Check location sharing

Location sharing lets chosen people see where you are in real time. Apps and accounts can do this. The Safety Net Project notes that phones tied to an Apple or Google account have features to find lost phones, and anyone with access to the account can see the phone’s location. It also asks you to think about who shares your phone plan or knows your login.

On an iPhone, use Safety Check. It needs iOS 16 or later.

1. Go to Settings, Privacy & Security, then Safety Check.
2. Choose Manage Sharing & Access to review people and apps one at a time. Emergency Reset stops all sharing at once and also lets you review devices and change your Apple Account password.
3. Use the Quick Exit button in the corner to leave fast.

Apple says Safety Check cannot review non-Apple accounts, passwords, or social media sharing. It also tells you to consider the effect on your safety before you make changes.

Next, see which apps use your location. Go to Settings, Privacy & Security, then Location Services. Tap an app to review or change its access. Apple says some apps and websites may still find your location in other ways, even with Location Services off.

On an Android phone, two places matter.

1. In a browser, open your Google Account and go to People & sharing, then Location Sharing, then Manage Location Sharing. Google says shared viewers can see your name, profile picture, real-time location and battery status. Tap a person and choose Stop to end sharing.
2. On the phone, go to Settings, Location, then App location permissions. Google groups apps as allowed all the time, allowed only while in use, ask every time, or not allowed. Tap an app to change it.

Step 2: Check for hidden Bluetooth trackers

An AirTag is a small Bluetooth tag made to find lost keys and bags. Other brands make similar tags. Apple says these tags “should not be used to track people,” and that tracking people without consent “is a crime in many countries and regions around the world.”

On an iPhone, alerts work when a tag that is away from its owner moves with you over time. Apple says you need:

• iOS 14.5 or later for AirTags and Find My network items, and iOS 17.5 or later for other compatible tags.
• Bluetooth, Location Services and Significant Locations turned on.
• Tracking Notifications allowed in your settings.
• Airplane Mode off, because Apple says you will not get alerts in it.

To review past alerts, open Find My, tap Items, then tap Unknown Items Detected with You. If you get an alert, tap it, tap Continue, then tap Play Sound and listen. Apple says that holding the top of your iPhone near an AirTag can show its serial number and the last four digits of the owner’s phone number.

On an Android phone, alerts need Android 6 or later. Google says they work with Apple AirTags and tags on the Find Hub network. On Android 12 and up, you can scan on demand: go to Settings, Safety & emergency, Unknown tracker alerts, then Scan now. The scan takes about 10 seconds. Google deletes alerts after 48 hours. Apple also points to the Tracker Detect app on Google Play, which looks for AirTags and other trackers that work with Find My.

In May 2024, Apple and Google began delivering alerts based on a shared industry specification, so alerts work across iOS and Android. Apple named Chipolo, eufy, Jio, Motorola and Pebblebee as makers that committed to compatible future tags.

If you find a tag, think before you act. Apple says the item may belong to someone you know, such as borrowed AirPods. If you feel unsafe, go to a safe public place and contact law enforcement, as both Apple and Google advise. Apple suggests taking a screenshot of the item and owner details before you disable it. Google adds that turning a tag off stops new location updates, but the owner may still see the last known location. Google also says some tags reset when turned off, which can stop police from getting the owner’s information. You can leave a tag on if turning it off feels unsafe.

Also check your car and belongings. The Safety Net Project says tracking devices can be small and easy to hide. A trusted mechanic or the police can help you search a car.

Step 3: Check for stalkerware

Stalkerware, also called spyware, is an app that someone installs on your phone without your knowledge. The FTC lists these possible signs: a battery that drains faster, more data use, overheating, and a phone that turns off and on. The FTC also lists signs in the other person’s behavior. They may know where you are, know what you texted, or know what sites you visit.

The Safety Net Project says the most common sign is that other person’s behavior. It adds that a trained professional may have to check the device to know for sure. The Coalition Against Stalkerware says some stalkerware causes no signs at all.

You can look, but do not remove anything yet.

• iPhone: Go to Settings, General, then VPN & Device Management. Apple says that if you see no profiles, none are installed. Then tap your name in Settings, scroll down, and tap your device. The Coalition says some iPhone stalkerware reads iCloud backups. If iCloud Backup is on and you did not turn it on, someone else may have.
• Android: Open the Play Store, tap your profile icon, then Play Protect. Check that scanning is on. The Coalition says stalkerware is often hidden or installed from outside the official app store, so look for apps you do not recognize.

If you find stalkerware, make a safety plan first. The Coalition says removing it may be seen by the abuser and “could increase the abuse and harassment,” and that deleting it also deletes evidence. Then choose how to clear the phone:

1. Best: a new phone with accounts the other person cannot reach. The FTC says this may be the safest option. The Coalition calls it the best way to get rid of stalkerware.
2. Next best: a factory reset. On an iPhone, go to Settings, General, Transfer or Reset iPhone, then Erase All Content and Settings. Apple says not to restore from a backup, because that may reinstall the malicious software. On Android, Google says a reset erases all data, so back up what you need first.
3. After either: download apps again from the app store. Change passwords from a safe device and turn on two-factor authentication, as the FTC advises.

Step 4: Check your accounts

Anyone who can sign in to your Apple or Google account may see your phone’s location without any app on your phone. On an iPhone, open Settings and tap your name. Scroll to the device list and remove any device you do not know. For Google, open your Google Account, then Security & sign-in, then Manage all devices. Sign out of any device you do not recognize. For more checks, see Am I hacked? and How to tell if your phone is hacked.

What can go wrong

• An alert may be about a friend’s item, not a stalker.
• Tracker alerts need Bluetooth and location on. Android alerts disappear after 48 hours.
• Safety Check cannot see non-Apple accounts or social media sharing.
• Turning off a tracker or sharing may alert the person who set it up.
• A clean check is not a guarantee. Some stalkerware shows no signs.

What to do now

1. If you feel unsafe, call the National Domestic Violence Hotline at 1-800-799-7233 from a safe device before you change anything.
2. Review location sharing: Safety Check on an iPhone, or Location Sharing in your Google Account.
3. Run a tracker check: look at Unknown Items Detected with You on an iPhone, or tap Scan now on an Android phone.
4. Remove unknown devices from your Apple or Google account, then change your passwords from a safe device. A passkey or two-factor authentication adds protection; see Passkeys vs passwords.
5. If you suspect stalkerware, write down what you notice and get help before you reset or replace the phone.