Android Find My Device Network Privacy

Question

My Android device today popped up a screen indicating that it had joined the new Find My Device Network that allows two-way scanning of device locations over Bluetooth.

Despite Google's claims of encryption, this sounds really weird to me. I don't see how any of this is possible without broadcasting some sort of unique identifier.

Does this feature use the Bluetooth radio when the Bluetooth setting is off?

Even more weird, and possibly a UI bug, I had some trouble finding this screen in the settings. I eventually tracked it down to Settings > Google > Find My Device. It looks similar to the Settings > Security and Privacy > Lost Device Protection screen, except that specific screen displays a Samsung account ID and mentions the Galaxy brand.

Find My Device	Lost Device Protection

Answer 1

If you turn off Bluetooth, it should be off.

(At least I'm not aware of some "stand-by" functionally, nor did I found any suspicion of the opposite.)

Samsung does provide it's own network to use for example with GalaxyTags, similar to AirTags from Apple. This will most likely be assimilated by the "Find my Device" network in the future.

Answer 2

If you use Google's functionalities, you more or less trust Google to implement what it declares. In this case, it claims:

• Your location history is stored encrypted locally
• Your most recent location is stored encrypted in Google's cloud, via the network, but Google doesn't have the decryption key to look at the data. But the encryption key may be derived from your PIN, and if you use a weak PIN, then it might be easy to crack your location. (It doesn't claim here to be using a Titan security chip's protection like the encrypted backup).
• If you turn your Bluetooth on, then you can help people find their Bluetooth devices (including the AirTags and even phones)
• If you turn your Bluetooth on, you may be able to find your phone even when it has no network connection. On some (Pixel) phones, you may be able to locate the phone even when it's off. When you actively use Find my Device app, Google definitely would be using all kinds of identifiers to find your devices.

According to this article, your Bluetooth being toggled off may not prevent Bluetooth communications altogether in order to provide this kind of network.

There is no doubt there are now more ways to track your locations. Whether or not Google put in their best to protect these data is another story.