AT 102: the tracker was under the foam

I rented a camera lens. A specialized macro optic, the kind you use three days a year and have no business buying. The package arrived by courier, on schedule, and the gear was protected properly: a rigid yellow case with foam padding cut to shape. Serious work.

About half an hour after delivery, my phone warned me that an unknown AirTag was moving with me. The map showed a trail of red dots: leaving the post office, the drive home, my arrival. First detected at 12:03, last seen at 12:41.

I emptied the case. Under the foam, an AirTag. On the lid, a strip of gaffer tape with three characters written in marker: AT 102.

What an inventory number tells you

An AirTag left behind by a previous renter happens. I believed that for a few seconds. An AirTag carrying a hand-written inventory number on the case that holds it, no. AT 102 is the hundred and second of a fleet. That is a procedure, not an accident.

I am not going to name the rental company, and I am not going to pretend I do not understand. Handing several thousand euros of optics to strangers, by mail, against a deposit that never covers the real value, is a risky business. Theft happens. Non-return happens. Insurance is what it is. Wanting to keep an eye on your own asset is entirely legitimate, and I mean that without irony: in their position, I would be looking for a solution too.

The problem is not the desire to protect the equipment. The problem is that nobody told me.

What is actually being tracked

A tracker sitting in a case in a warehouse is asset tracking. A tracker in a case that sleeps at my house for five days is something else.

The lens does not move on its own. For the entire rental period, what the device records and transmits is my position. My home, down to the street address. My hours. The places I work. The fact that I went somewhere for the weekend. The case has no life of its own: it is exactly where I am.

That is the shift that makes this uncomfortable. You think you are tracking a lens. You are tracking a customer.

The safety net came from Apple, not from the law

This is the part that bothers me most.

I did not work it out. I did not search the case out of suspicion, and I would never have pulled the foam padding without a reason. I knew because Apple’s anti-stalking feature, built in the first place to counter domestic abuse, sent me a notification. A proprietary mechanism, developed by an American company under pressure from a string of news stories, told me what a French contract should have told me first. The irony is not lost on me: I have written at length about an ecosystem that decides on my behalf, and it is that same ecosystem that protected me here.

Android has the alert too, but it runs on a far thinner detection network than Apple’s, so it arrives later. And had I turned tracking notifications off, or left the case in the next room out of Bluetooth range, I would have seen nothing at all.

So here we are. Transparency about the processing of personal data no longer rests with the party doing the processing. It rests on a security feature of an operating system. That is a strange thing to depend on, and a fragile one. Apple adjusts its detection threshold tomorrow and the whole issue vanishes.

What the law says

I am not a lawyer. But the framework is not obscure, and it starts with the GDPR.

Location data tied to an identifiable person is personal data. Tracking it for five days, at home and on the road, is processing. That processing can rest on the company’s legitimate interest, and theft prevention is a textbook example. But legitimate interest is not a blank check. It requires a balancing test against the customer’s rights, a limited retention period, and above all prior notice. The duty to inform is not a courtesy. It is what makes the whole arrangement valid in the first place. An undisclosed tracker in a shipping case is precisely the case where the legal basis is arguable but the transparency is missing.

Criminal law comes second, and I raise it as a hypothesis rather than a pillar. Article 226-1 of the French penal code, as amended in July 2020, punishes capturing or transmitting a person’s location without consent. The text refers to a person, not an object, and requires a deliberate intrusion on private life. A rental company following its own lens has not necessarily set out to follow its customer, and that is where the charge gets difficult to establish. One detail is worth knowing, though: the presumption of consent the code grants for sound and image, when the acts are carried out in plain sight of the person concerned, does not extend to geolocation. For this kind of tracking, silence is not agreement.

So the case does not turn on the principle of tracking. It turns on the silence around it.

What was needed, and cost nothing

That is the frustrating part. Compliance came down to three gestures.

One line in the rental terms stating that the cases contain a location device for theft prevention. A sticker on the case itself, visible the moment you open it, saying the same thing. And a short retention policy, with the location history deleted when the equipment comes back.

None of that weakens the protection. A thief is not deterred from stealing by the absence of a label, and knowing the tracker exists will not help him disable it, since his own phone will flag it anyway. An informed customer, on the other hand, has nothing to complain about. The company would gain the one thing it lost with me: trust.

The real subject

I am not about to turn a thirty-euro AirTag into a national scandal. The equipment was flawless, the service was excellent, and I will probably rent from them again.

But there is something revealing in how ordinary the gesture has become. The tracker is now so cheap, so easy to deploy, so obvious, that nobody stops to ask whether it should be disclosed. You slip a beacon into a package the way you would stick on a price tag. The gap between how trivial the device is and how much it records no longer registers with anyone.

That is exactly how ambient surveillance settles in: not by decision, by convenience. A thirty-euro object, a good reason, and nobody to ask the question.

I asked the question.