What the Bluetooth spec means for a Bluetooth tag

How it worksPublished 26 June 20265 min read

A bare circuit board the size of a coin on an anti-static mat beside tweezers and a silver button battery

The phrase "Bluetooth tag" sets up an expectation that is wrong in an interesting way. People assume a tag is a Bluetooth accessory in the same sense that a speaker or a headset is one: something you pair with, connect to and stream data over. A finding tag does almost none of that. Understanding what it does instead — which is defined precisely in the Bluetooth Core Specification — explains the battery life, the privacy model and the limits all at once.

A tag broadcasts. It does not connect.

Bluetooth Low Energy supports more than point-to-point links. The Bluetooth SIG's own Low Energy primer describes broadcast-based modes that let one device transmit data to an unlimited number of receivers at the same time, with no connection established to any of them.

That is the mode a finding tag lives in permanently. It sends short packets, called advertisements, into the air a few times a second. Nothing acknowledges them. No session is set up, no pairing takes place, no keys are exchanged with the listener, and the tag learns nothing whatsoever about who heard it. The tag is a lighthouse, not a telephone.

Two consequences fall straight out of this. First, an unlimited number of phones can hear the same tag simultaneously without any of them interfering with each other or with you — which is precisely what makes a crowd-sourced finding network possible in the first place. Second, a device that never connects cannot be connected to by a stranger, which removes an entire category of attack before it starts.

The channels and the packets

The specification is specific about where this happens. Bluetooth LE operates in the 2.4 GHz unlicensed band, from 2400 MHz to 2483.5 MHz, divided into 40 channels each 2 MHz wide. Three of those — channels 37, 38 and 39 — are the primary advertising channels, and the rest are general-purpose.

Legacy advertising packets carry a payload of up to 31 bytes. That is not much: a short identifier, a status flag, a little room for manufacturer-specific data, and that is the lot. Extended advertising, added in a later revision of the specification, allows far larger payloads through fragmentation, but a finding tag has no use for the space. Thirty-one bytes is more than enough to say "I exist, and here is a rotating number that means nothing to you."

The rotation matters. Because the identifier changes on a schedule, the same tag looks like a series of unrelated devices to anybody logging traffic, which is what stops a shop, a stalker or a passer-by building a movement history out of the broadcasts.

Why a Bluetooth tag sips power

The primer states the design intent plainly: one of the original goals for Bluetooth LE was to be highly efficient in its use of energy. The mechanism it uses to get there is asymmetry. Roles are assigned so that the power-constrained device — the tag — carries less of the protocol overhead than the resource-rich device, the phone.

In practice the tag's radio is off for almost all of every second. It wakes, transmits a packet lasting a fraction of a millisecond, and sleeps again. It does not listen continuously, does not maintain a connection and does not retransmit until acknowledged. This is why a battery holding a few hundred milliamp-hours can run a device for years, and why the same battery would run a pair of wireless earbuds for an afternoon.

What Core 6.0 changed, and why it matters here

The Bluetooth SIG adopted Core Specification 6.0 on 3 September 2024. Its headline feature list includes Channel Sounding, Decision-Based Advertising Filtering, Monitoring Advertisers, an ISOAL enhancement, an extended link-layer feature set and a frame space update.

The one relevant to tags is Channel Sounding, which gives two Bluetooth devices a standardised way to measure the distance between them, using phase-based ranging and round-trip timing rather than inferring distance from signal strength. That is the standards world's answer to the problem currently solved by Ultra Wideband: not just "the tag is somewhere near" but "the tag is this far away, in that direction".

It is worth being clear that this is a capability of the specification, not something present in every product that mentions Bluetooth 6.0 on a box. Silicon has to implement it, both ends need it, and the phone in your pocket has to support it too. For coin-cell finding tags on sale today, signal strength and a loud buzzer remain how the last few metres get closed.

How BlueTag uses all of this

BlueTag is exactly the broadcast-only device described above. It runs a Bluetooth Low Energy radio advertising a rotating, anonymous identifier, and it never connects to a stranger's phone. Any Apple device that hears the advertisement reports an encrypted position to Apple, and only your Apple Account holds the key to read it — not us, not the manufacturer, not Apple.

The Bluetooth link is quoted at up to 60 m / 200 ft in the open, and inside that radius your iPhone can set the 80–100 dB buzzer off directly. Past it, Apple's Find My network does the carrying. The efficiency described above is why one CR2032 cell runs the tag for up to two years, and why the case can be 36.3 mm square, 9 mm deep and about 10 g rather than the size of a matchbox.

What it does not have: Ultra Wideband, Channel Sounding, GPS, a SIM or a subscription. And it is an Apple Find My accessory, so it wants an iPhone or an iPad from iOS 14.5 upwards, and will not pair with an Android phone, a Windows laptop or anything else. Two tags per box, IP67 sealed, free postage anywhere in the UK, under £15.

If the mechanism above is the one you want, see the full specification and order a pair. Bluetooth Tracker is an independent UK shop; the Bluetooth word mark is a registered trademark of Bluetooth SIG, Inc., and Apple and Find My are trademarks of Apple Inc.

Sources

Related notes

← All workbench notes