Detecting Unwanted Location Trackers Accessory Protocol

Requirements

Overview This section details requirements and recommendations for best practices for location-enabled accessory manufacturers to allow unwanted tracking detection by platform makers.

Bluetooth Low Energy The accessory SHALL use Bluetooth Low Energy (LE) as the transport protocol. This enables platforms to detect and connect to accessories.

Advertising The accessory SHALL advertise using Bluetooth LE.

Connection The accessory MUST support at least one non-owner unencrypted connection in a peripheral role. The connection interval of the Bluetooth LE link between the device and accessory MAY depend on the type of user interaction. Non-owner connections to the accessory SHALL be implemented using a platform-compatible method, e.g., BT GATT service.

Location Tracking The location-enabled accessory has location capabilities via Bluetooth crowd-sourcing, GPS/GNSS location, WiFi location, cellular location, or by some other means. Furthermore, the accessory has a way to communicate its location to its owner via a network (e.g., cell network, crowd-sourced location via Bluetooth, etc.). The accessory SHALL maintain an internal state that detects when its location is, or has been, available to the owner via a network. This state is called the location-enabled state. Misuse of location-enabled accessories can occur when the owner’s device is not physically with the accessory. Thereby, the accessory SHOULD maintain a second internal state, denoted the near-owner state, which indicates if the accessory is connected to or nearby one or more of the owner’s devices. Near-owner state can take on two values, either near-owner mode or separated mode. Near-owner mode is denoted as the opposite of separated mode. details the requirements and recommendations for advertising the location-enabled payload based on the location-enabled state and separated state.

Requirements & Recommendations For Advertising Location-Enabled Payload If the accessory maker chooses to continue advertising the location-enabled payload while in near-owner mode, setting the near-owner bit compensates for this.

Location-enabled Bluetooth LE Advertisement Payload

Overview When in location-enabled state, the accessory SHALL advertise a Bluetooth LE format, denoted the location-enabled Bluetooth advertisement payload, that is recognizable to the platforms. The primary purpose of the advertisement in the context of this specification is to allow the detection of unwanted location trackers. All accessories in scope of this document are associated with an owner. The advertisement MUST allow the owner’s platform to reliably recognize the owner's associated accessories, that is a critical signal to distinguish unwanted trackers from expected ones. False alerts associated to owned or expected accessories may otherwise desensitize users, leading them to miss relevant ones.

Location-enabled advertisement payload format The payload format is defined in Location-Enabled Payload Format

Bytes	Description	Requirement
0-5	MAC address	REQUIRED
6-8	Flags TLV; length = 1 byte, type = 1 byte, value = 1 byte	OPTIONAL
9-12	Service Data TLV; length = 1 byte, type = 0x16, value = 0xFCB2	REQUIRED
13	Network ID	REQUIRED
14	Near-owner bit (1 bit, least significant bit) + reserved (7 bits)	REQUIRED
15-36	Proprietary company payload data	OPTIONAL

When Flags TLV are not added, the MAC address type needs to be set to random. This implies that if Bluetooth LE pairing is supported, the accessory SHALL NOT use its public address as its public identity when exchanging pairing keys at phase 3 (see Vol.3, Part H, Section 2.1 of the ) and it SHALL only use a static random address. Additionally, the LE advertisement needs to be connectable to allow for non-owner unencrypted connections to the accessory. Further details are discussed in . Proprietary company payload data is both OPTIONAL and variable length.

Duration of advertising location-enabled advertisement payload The accessory SHALL broadcast the location-enabled advertisement payload if location is available to the owner or was available any time within the past 24 hours. This allows unwanted tracking detection to operate both between and beyond the specific moments an accessory's location is made available to the owner.

Maximum duration after physical separation from owner to transition into separated mode The accessory SHALL transition from near-owner mode to separated mode under the conditions listed in below. Advertising Policy

Preferred	Acceptable
The accessory has been physically separated from the owner device for more than 30 minutes	The accessory has been physically separated from the owner device for more than 30 minutes AND The owner of the accessory has received a more recent location update for that accessory after 30 minutes

Maximum duration after reunification with owner to transition into near-owner mode The accessory SHALL transition from separated to near-owner mode if it has reunited with the owner device for a duration no longer than 30 minutes.

MAC address The Bluetooth LE advertisement payload SHALL contain an address in the 6-byte Bluetooth MAC address field which looks random to all parties while being recognizable by the owner device. The address SHALL rotate periodically (see Rotation policy); otherwise if the same address is used for long periods of time, an adversary may be able to track a legitimate person carrying the accessory through local Bluetooth LE scanning devices. Same rules apply to all of the advertised payload. It is possible to generate the MAC address in a way which meets the privacy requirement while allowing the platform to recognize an owned accessory without ambiguity using the MAC address, as defined in (TODO: Section Implementation Owned has been removed). When taking this approach, the address type SHALL be set as a non-resolvable private address or as a static device address, as defined in Random Device Address in Vol 6, Part B, Section 1.3.2 of the . The owner MUST be able to predict the MAC address value at any given time in order to suppress unwanted tracking alerts caused by a device’s owned accessory. See (TODO: Section Owned Accessory Identification) for additional details. Alternatively, the owner recognizable value may be placed in Proprietary company payload data defined in Proprietary company payload. In this scenario, the MAC address of the accessory advertisement may be set to resolvable private address.

Rotation policy An accessory SHALL rotate its address on any transition from near-owner state to separated state as well as any transition from separated state to near-owner state. When in near-owner state, the accessory SHALL rotate its address every 15 minutes. This is a privacy consideration to deter tracking of the accessory by non-owners when it is in physical proximity to the owner. When in a separated state, the accessory SHALL rotate its address every 24 hours. This duration allows a platform's unwanted tracking algorithms to detect that the same accessory is in proximity for some period of time, when the owner is not in physical proximity.

Service data TLV The Service data TLV with a 2-byte UUID value of 0xFCB2 provides a way for platforms to easily scan for and detect the location-enabled Bluetooth advertisement.

Network ID The 1-byte Network ID SHALL be set based on a registered value for the manufacturer, as defined in (TODO: Section Finding Network Registry has been removed).

Proprietary company payload To maintain the privacy properties of the MAC address, the values of payload which may be different between accessories SHALL rotate at the same time and interval as the MAC address. The approach using a Pseudo-Random Function suggested in (TODO: Section Implementation has been removed). may be used to meet this privacy requirement. If a Resolvable Private MAC address is used, this field SHALL be populated with a value of 6 bytes minimum which allows the platform to recognize an owned accessory without ambiguity to support the identification of owned accessory by the platform as defined in (TODO: Section Owned Accessory Identification has been removed).

Near-owner bit It is important to prevent unwanted tracking alerts from occurring when the owner of the accessory is in physical proximity of the accessory, i.e., it is in near-owner mode. In order to allow suppression of unwanted tracking alerts for an accessory advertising the location-enabled advertisement with the owner nearby, the accessory MUST set the near-owner bit to be 1 when the near-owner state is in near-owner mode, otherwise the bit is set to 0. specifies the values of this bit. The near-owner bit MUST be the least significant bit. Near-Owner Bit

Near-owner Bit Value	Near-owner state
1	Near-owner mode
0	Separated mode

Bluetooth LE advertising interval The detection rate performance has a dependency on the BLE advertising interval used. A maximum advertising interval of 4 seconds SHALL be used; for the best detection rate, the advertising interval SHOULD be less than or equal to 2 seconds.

Accessory Connections The accessory non-owner service UUID SHALL be 15190001-12F4-C226-88ED-2AC5579F2A85. This service SHALL use GATT over LE. The non-owner accessory service SHALL be instantiated as a primary service. The accessory non-owner characteristic UUID SHALL be 8E0C0001-1D68-FB92-BF61-48377421680E.

Byte transmission order The characteristic used within this service SHALL be transmitted with the least significant octet first (that is, little endian).

Maximum transmission unit Data fragmentation and reassembly is not defined in this document; therefore, the accessory SHALL NOT request an MTU (Maximum Transmission Unit) smaller than the maximum length of its write responses for the opcodes defined in Non-owner controls and . In other words, all opcode response data must fit within a single write operation.

Accessory Information The following accessory information MUST be persistent through the lifetime of the accessory: Product data, Manufacturer name, Model name, Accessory category, Accessory capabilities, Network ID, and Battery Type.

Opcodes The 2-byte opcodes for accessory information are defined in . Accessory Information Opcodes

Opcode	Opcode value	Operands	GATT subprocedure	Requirement
Get_Product_Data	0x0003	None	Write; To Accessory	REQUIRED
Get_Product_Data_ Response	0x0803	Product Data	Indications; From Accessory	REQUIRED
Get_Manufacturer_ Name	0x0004	None	Write; To Accessory	REQUIRED
Get_Manufacturer_ Name_Response	0x0804	Manufacturer Name	Indications; From Accessory	REQUIRED
Get_Model_Name	0x0005	None	Write; To Accessory	REQUIRED
Get_Model_Name_ Response	0x0805	Model Name	Indications; From Accessory	REQUIRED
Get_Accessory_ Category	0x0006	None	Write; To Accessory	REQUIRED
Get_Accessory_ Category_Response	0x0806	Accessory Category	Indications; From Accessory	REQUIRED
Get_Protocol_ Implementation_Version	0x0007	None	Write; To Accessory	REQUIRED
Get_Protocol_ Implementation_Version_ Response	0x0807	Protocol Implementation Version	Indications; From Accessory	REQUIRED
Get_Accessory_ Capabilities	0x0008	None	Write; To Accessory	REQUIRED
Get_Accessory_ Capabilities_Response	0x0808	Accessory Capabilities	Indications; From Accessory	REQUIRED
Get_Network_ID	0x0009	None	Write; To Accessory	REQUIRED
Get_Network_ID_ Response	0x0809	Network ID	Indications; From Accessory	REQUIRED
Get_Firmware_Version	0x000A	None	Write; To Accessory	REQUIRED
Get_Firmware_Version_ Response	0x080A	Firmware version	Indications; From Accessory	REQUIRED
Get_Battery_Type	0x000B	None	Write; To Accessory	OPTIONAL
Get_Battery_Type_ Response	0x080B	Battery Type	Indications; From Accessory	OPTIONAL
Get_Battery_Level	0x000C	None	Write; To Accessory	OPTIONAL
Get_Battery_Level_ Response	0x080C	Battery Level	Indications; From Accessory	OPTIONAL
Get_Network_Version	0x000D	None	Write; To Accessory	OPTIONAL
Get_Network_Version_ Response	0x080D	Network Version	Indications; From Accessory	OPTIONAL
RESERVED	0x000E - 0x005F
RESERVED (Response)	0x080E - 0x085F

These opcodes SHALL be available when the accessory is in separated state. These opcodes SHALL NOT be available when the accessory is in the near-owner state. When any opcode is not available, the accessory SHALL return the Invalid_command error as the ResponseStatus in Command_Response. If an optional opcode is not available, the accessory SHALL return the Invalid_command error as the ResponseStatus in Command_Response. If any opcode value is commanded that is not supported by the accessory, it SHALL return the Invalid_command error as the ResponseStatus in the Command_Response. See Command Response for details. In the circumstances that there are multiple non-owner connections, all GATT indication subprocedures defined in SHALL be sent through only to the connection that commanded the affiliated write subprocedure. Opcodes should be structured as defined below. Accessory Opcode Structure

Bytes	Description
0-1	Opcode value
2+	Operand

Product data The Product Data operand represents an 8-byte value that is intended to serve as a unique identifier for the accessory make and model. This value SHALL be determined during the onboarding process. Product Data Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Product Data	Uint8	8	8	See Product data

Manufacturer name The Manufacturer Name operand contains the name of the company whose brand will appear on the accessory, e.g., ”Acme”. Manufacturer Name Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Manufacturer Name	UTF-8	64 (maximum)	64 (maximum)	Manufacturer name

When the Manufacturer Name is less than 64 bytes, it SHALL be formatted either as:

a string value with length less than 64 bytes
a string value that is both zero-terminated and zero-padded up to 64 bytes

Model name The Model Name operand contains the manufacturer specific model of the accessory. Model Name Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Model Name	UTF-8	64 (maximum)	64 (maximum)	Model name

When the Model Name is less than 64 bytes, it SHALL be formatted either as:

a string value with length less than 64 bytes
a string value that is both zero-terminated and zero-padded up to 64 bytes

Accessory category The Accessory Category operand describes the category the accessory most closely resembles. Accessory Category Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Accessory Category	Uint8	8	8	Byte 0: Uint8 value of Accessory Category Value Byte 1-7: Reserved

Protocol implementation version The Protocol Implementation Version operand contains a value indicating an implementation version of these protocols. Protocol Implementation Version Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Protocol Implementation Version	Uint32	1	4	Byte 0 : revision version number Byte 1 : minor version number Byte 2-3 : major version number

The Major.Minor.Revision value associated with this document is 1.0.0. The equivalent 4-byte value is 0x00010000.

Accessory capabilities The Accessory Capabilities operand enumerates the various capabilities supported on the accessory as defined in . Accessory Capabilities Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Accessory Capabilities	Uint32	1	4	Bit 0 : Supports play sound (REQUIRED) Bit 1 : Supports motion detector UT Bit 2 : Supports identifier lookup by NFC Bit 3 : Supports identifier lookup by BLE Bit 4-8 : Reserved for private use Bit 9-31 : Reserved

For example, an accessory supporting play sound, motion detector UT, and identifier look-up over BT will have the value set as 0b1011 in binary and 11 as Uint32.

Network ID The Network ID operand contains the Network ID for the accessory. This is the same information that's in the BT advertisement header in . Network ID Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Network ID	Uint8	1	1	Network ID

Firmware version The Firmware Version describes the current firmware version running on the accessory. The firmware revision string SHALL use the x[.y[.z]] format where :

<x> is the major version number, required.
<y> is the minor version number, required if it is non zero or if <z> is present.
<z> is the revision version number, required if non zero.

The firmware revision MUST follow these rules:

<x> is incremented when there is significant change; for example, 1.0.0, 2.0.0, 3.0.0, and so on.
<y> is incremented when minor changes are introduced, such as 1.1.0, 2.1.0, 3.1.0, and so on.
<z> is incremented when bug fixes are introduced, such as 1.0.1, 2.0.1, 3.0.1, and so on.
Subsequent firmware updates can have a lower <y> version only if <x> is incremented.
Subsequent firmware updates can have a lower <z> version only if <x> or <y> is incremented.

Major version MUST not be greater than (2^16 - 1). Minor and revision version MUST not be greater than (2^8 - 1). The value MUST change after every firmware update. Firmware Version Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Firmware version	Uint32	1	4	Byte 0 : revision version number Byte 1 : minor version number Byte 2:3 : major version number

As an example, a Major.Minor.Revision value of 1.0.0 has an equivalent 4-byte value of 0x00010000.

Battery type The Battery type operand describes the battery type used in the accessory. Battery Type Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Battery Type	Uint8	1	1	0x00 : Powered 0x01 : Non-rechargeable battery 0x02 : Rechargeable battery 0x03-0xFF : Reserved

Battery level The Battery level operand indicates the current battery level. Battery Level Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Battery Level	Uint8	1	1	0x00 : Full 0x01 : Medium 0x02 : Low 0x03 : Critically low 0x04-0xFF : Reserved

Network version The Network Version describes the network specification the accessory complies with for the network specified by Network ID. The network revision string SHALL use the x[.y[.z]] format where :

<x> is the major version number, required.
<y> is the minor version number, required if it is non zero or if <z> is present.
<z> is the revision version number, required if non zero.

The network revision MUST follow these rules:

<x> is incremented when there is significant change; for example, 1.0.0, 2.0.0, 3.0.0, and so on.
<y> is incremented when minor changes are introduced, such as 1.1.0, 2.1.0, 3.1.0, and so on.
<z> is incremented when bug fixes are introduced, such as 1.0.1, 2.0.1, 3.0.1, and so on.
Subsequent network updates can have a lower <y> version only if <x> is incremented.
Subsequent network updates can have a lower <z> version only if <x> or <y> is incremented.

Major version MUST not be greater than (2^16 - 1). Minor and revision version MUST not be greater than (2^8 - 1). The value MUST change after every network update. Network Version Operand

Operand name	Data type	Count	Total Size (Bytes)	Description
Network version	Uint32	1	4	Byte 0 : revision version number Byte 1 : minor version number Byte 2:3 : major version number

As an example, a Major.Minor.Revision value of 1.0.0 has an equivalent 4-byte value of 0x00010000.

Non-Owner Finding Once a user has been notified of an unknown accessory traveling with them, it is REQUIRED they have the means to physically locate the accessory. This is called non-owner finding of the accessory.

Hardware This is a description of the REQUIRED and RECOMMENDED hardware to be incorporated into the accessory to enable non-owner finding.

Motion detector The accessory SHOULD include a motion detector that can detect accessory motion reliably (for example, an accelerometer). If the accessory includes an accelerometer, it MUST be configured to detect an orientation change of ±10° along any two axes of the accessory.

Implementation The details in this section apply to those accessories that include a motion detector. Values of the variables referenced are specified in .
After T_{SEPARATED_UT_TIMEOUT} in separated state, the accessory MUST enable the motion detector to detect any motion within T_{SEPARATED_UT_SAMPLING_RATE1}. If motion is not detected within the T_{SEPARATED_UT_SAMPLING_RATE1} period, the accessory MUST stay in this state until it exits separated state. If motion is detected within the T_{SEPARATED_UT_SAMPLING_RATE1} the accessory MUST play a sound. After first motion is detected, the movement detection period is decreased to T_{SEPARATED_UT_SAMPLING_RATE2}. The accessory MUST continue to play a sound for every detected motion. The accessory SHALL disable the motion detector for T_{SEPARATED_UT_BACKOFF} under either of the following conditions:

Motion has been detected for 20 seconds at T_{SEPARATED_UT_SAMPLING_RATE2} periods.
Ten sounds are played.

If the accessory is still in separated state at the end of T_{SEPARATED_UT_BACKOFF}, the UT behavior MUST restart. A Bluetooth LE connection from an associated device MUST reset the separated behavior. Motion Detector Time Values

Name	Value	Description
T_{SEPARATED_UT_SAMPLING_RATE1}	10 seconds	Sampling rate when motion detector is enabled in separated state.
T_{SEPARATED_UT_SAMPLING_RATE2}	0.5 seconds	Motion detector sampling rate when movement is detected in separated state.
T_{SEPARATED_UT_BACKOFF}	6 hours	Period to disable motion detector if accessory is in separated state.
T_{SEPARATED_UT_TIMEOUT}	random value between 8-24 hours chosen from a uniform distribution	Time span in separated state before enabling motion detector.

Sound maker The accessory MUST include a sound maker (for example, a speaker) to play sound when in separated state, either periodically or when motion is detected. It MUST also play sound when a non-owner tries to locate the accessory by initiating a play sound command from a non-owner device when the accessory is in range and connectable through Bluetooth LE. The sound maker MUST emit a sound with minimum 60 Phon peak loudness as defined by ISO 532-1:2017. The loudness MUST be measured in free acoustic space substantially free of obstacles that would affect the pressure measurement. The loudness MUST be measured by a calibrated (to the Pascal) free field microphone 25 cm from the accessory suspended in free space.

Non-owner controls Non-owner controls SHALL use the same service and characteristic UUIDs as defined in Accessory Connections. These controls allow a non-owner to locate the accessory by playing a sound as well as fetch an encrypted payload used to retrieve the identifier of the device. These 2-byte opcodes are defined in . Non-Owner Controls Opcodes

Opcode	Opcode value	Operands	GATT subprocedure	Requirement
Sound_Start	0x0300	None	Write; To accessory	REQUIRED
Sound_Stop	0x0301	None	Write; To accessory	REQUIRED
Command_Response	0x0302	Command Response	Indications; From accessory	REQUIRED
Sound_Completed	0x0303	None	Indications; From accessory	REQUIRED
Get_Identifier	0x0404	None	Write; To accessory	OPTIONAL
Get_Identifier_Response	0x0405	Identifier Payload	Indications; From accessory	OPTIONAL
RESERVED for private use	0x0304
RESERVED	0x0305 - 0x0319
RESERVED for private use	0x031A
RESERVED	0x031B - 0x031F
RESERVED for private use	0x0320 - 0x033F
RESERVED	0x0340 - 0x035F
RESERVED (Response)	0x0406 - 0x041F
RESERVED for private use (Response)	0x0420 - 0x043F
RESERVED (Response)	0x0440 - 0x045F

Sound_Start and Sound_Stop SHALL only be available to the platform when the accessory is in the separated state. In all other states, the accessory SHALL return the Invalid_command error as the ResponseStatus in Command_Response. If Identifer Retrieval over Bluetooth LE is supported, Get_Identifier SHALL only be available when in identifier read state; otherwise, it MUST send Command_Response with the Invalid_command as the ResponseStatus. The identifier read state is discussed further in Identifier Payload. In the circumstances that there are multiple non-owner connections, all GATT indication subprocedures defined in SHALL be sent through only to the connection that commanded the affiliated write subprocedure. Sound_Completed MAY be sent over all non-owner connections.

Play sound The Sound_Start opcode is used to play sound on the sound maker of the accessory. The sound maker MUST play sound for a minimum duration of 5 seconds and a maximum duration of 30 seconds. The RECOMMENDED duration is 12 seconds.

The accessory SHALL confirm the start of the play sound procedure by sending a Command_Response with the corresponding CommandOpCode and a ResponseStatus value of Success.
Once the play sound action is completed, the accessory sends the Sound_Completed message.
The Sound_Stop opcode is used to stop an ongoing sound request.
If the sound event is completed or was not initiated by the connected non-owner device, the accessory responds with the Invalid_state ResponseStatus code.
If the accessory does not support the play sound procedure, it responds with Invalid_command ResponseStatus code.
If a Sound_Start procedure is initiated when another play sound action is in progress, it rejects with Invalid_state error code.
The accessory SHALL confirm the completion of the stop sound procedure by sending the Sound_Completed message.

Command Response There are 2 components of the command response operands: CommandOpCode and ResponseStatus. The CommandOpCode operand indicates the procedure that the accessory is responding to and ResponseStatus operand indicates the status of the response. The accessory SHALL respond to any invalid opcode with Command_Response and Invalid_command as the ResponseStatus. Command Response Operands

Operand name	Data type	Count	Total Size (Bytes)	Description
CommandOpCode	Uint16	1	2	The control procedure matching this response
ResponseStatus	Uint16	1	2	0x0000 : Success 0x0001 : Invalid_state 0x0002 : Invalid_configuration 0x0003 : Invalid_length 0x0004 : Invalid_param 0x0005-0xFFFE : Reserved 0xFFFF : Invalid_command

Identifier Payload The Get_Identifier opcode is used to retrieve identifier lookup payload over Bluetooth LE. To enable this opcode, the accessory MUST be in the identifier read state. To enter the identifier read state, a user action on the accessory MUST be performed (for example, press and hold a button for 10 seconds). The identifier read state MUST be enabled for 5 minutes once the user action on the accessory is successfully performed. When the accessory is in this mode, it MUST respond with Get_Identifier_Response opcode and Identifier Payload operand. Identifier Payload Over Bluetooth

Operand name	Data type	Count	Total Size (Bytes)	Description
Identifier Payload	Uint8	defined by accessory	defined by accessory	The encrypted identifier as an array of bytes.

It is REQUIRED that the encrypted identifier (which in some cases is the product serial number) be non-identifiable. If the accessory is not in identifier read state, it MUST send Command_Response with the Invalid_command as the ResponseStatus. Further considerations for how these operands should be implemented are discussed in Design of encrypted identifier look-up.

Alternate finding hardware The accessory SHOULD provide alternate means to help find it, e.g. by vibrating or flashing lights, via a platform-compatible method. Future versions of this document will consider support for haptics and lights.

Recommended Finding Options lists two RECOMMENDED options on the set of technology in an accessory to make it findable. Given that a sound maker is REQUIRED, the accessory maker SHALL at very least implement Option A. Accessory Finding Hardware Options

	Option A	Option B
	Good	Better
Sound maker	X	X
Haptics		X
Lights		X

Future hardware Future technologies for finding MAY be considered in revisions of this document.

Disablement The accessory SHALL have a way to be disabled such that its future locations cannot be seen by its owner. Disablement SHALL be done via some physical action (e.g., button press, gesture, removal of battery, etc.).

Disablement instructions The accessory manufacturer SHALL provide both a text description of how to disable the accessory as well as a visual depiction (e.g. image, diagram, animation, etc.) that MUST be available when the platform is online and OPTIONALLY when offline. Disablement procedure or instructions CAN change with accessory firmware updates. These are provided as part of the onboarding process.

Identification The accessory MUST include a way to uniquely identify it - either via a serial number or other privacy-preserving solution. Guidelines for serial numbers only apply if the accessory supports identification via a serial number.

Serial number identification If a serial number is available, it SHALL be printed and be easily accessible on the accessory. The serial number MUST be unique for each product ID.

Identifier retrieval capability The identifier payload SHALL be readable either through NFC tap (see Identifier over NFC) or Bluetooth LE (see Identifier Retrieval over Bluetooth LE ).

Identifier retrieval over Bluetooth LE For privacy reasons, accessories that support identifier retrieval for identifiers not included in the advertising packet over Bluetooth LE MUST have a physical mechanism, for example, a button, that SHALL be required to enable the Get_Identifier opcode, as discussed in Identifier Payload. The accessory manufacturer SHALL provide both a text description of how to enable identifier retrieval over Bluetooth LE, as well as a visual depiction (e.g. image, diagram, animation, etc.) that MUST be available when the platform is online and OPTIONALLY when offline. The description and visual depiction CAN change with accessory firmware updates. These are provided as part of the onboarding process.

Identifier retrieval from a server For security reasons, the identifier payload returned from an accessory in the paired state SHALL be encrypted.

Identifier over NFC For those accessories that support identifier retrieval over NFC, an associated accessory SHALL advertise the whole URL with arguments as the payload over NFC. The payload SHALL look like the URL shown below. "https://{URL}?pid=%04x&b=%02x&fv=%08x&e=%s" Identifier Lookup URL-arguments

URL argument	URL Argument Type	Notes	Reference
b	hex string	Battery Level (Optional)	Battery Level
bt	hex string	BT Mac address (Optional)	MAC address
fv	hex string	Firmware version (Optional)	Firmware version
e	hex string	Encrypted Identifier (Required)	Identifier Payload
pid	hex string	Product Data (Required)	Product Data

The URL SHALL be hosted by the network provider. The URL SHALL decrypt the identifier payload and return the identifier of the accessory in a form that can be rendered in the platform's HTML view. One approach to exchange the URL with the accessory, is when the accessory owner associates the accessory to a network provider. When a user performs NFC Tap and the accessory is in associated state, the encrypted identifier encoded in hex string SHALL be an argument ("e") passed to the identifier retrieval URL. When a user performs NFC Tap and the accessory is not in associated state, the behavior is undefined and is beyond the scope of this spec.

Owner registry Verifiable identity information of the owner of an accessory at time of association SHALL be recorded and associated with the identifier of the accessory, e.g., phone number, email address.

Obfuscated owner information A limited amount of obfuscated owner information from the owner registry SHALL be made available to the platform along with a retrieved identifier. This information SHALL be part of the response of the identifier retrieval from a server which can be rendered in a platform's HTML view. This MUST include at least one of the following:

the last four digits of the owner's telephone number. e.g., (***) ***-5555
an email address with the first letter of the username and entity visible, as well as the entire extension. e.g., b********@i*****.com

Persistence The owner registry SHOULD be stored for a minimum of 25 days after an owner has unassociated an accessory. After the elapsed period, the data SHOULD be deleted.

Availability for law enforcement Available ownership registry information SHOULD be produced in response to a valid law enforcement request seeking information related to the misuse of location-tracking accessories provided that the request is submitted pursuant to defined procedures for obtaining such information. Network providers SHOULD define their own procedures for submission of valid legal requests from law enforcement.

Accessory Category Name	Value
Location Tracker	1
Other	128
Luggage	129
Backpack	130
Jacket	131
Coat	132
Shoes	133
Bike	134
Scooter	135
Stroller	136
Wheelchair	137
Boat	138
Helmet	139
Skateboard	140
Skis	141
Snowboard	142
Surfboard	143
Camera	144
Laptop	145
Watch	146
Flash drive	147
Drone	148
Headphones	149
Earphones	150
Inhaler	151
Sunglasses	152
Handbag	153
Wallet	154
Umbrella	155
Water bottle	156
Tools or tool box	157
Keys	158
Smart case	159
Remote	160
Hat	161
Motorbike	162
Consumer electronic device	163
Apparel	164
Transportation device	165
Sports equipment	166
Personal item	167
Reserved for future use	2-127, 168+