How Smart Glasses Scanner works

1. Scan: what an iPhone can hear

Most wireless accessories, smart glasses included, announce themselves with short Bluetooth Low Energy (BLE) broadcasts called advertisements. Any nearby phone can receive them without pairing or connecting. This is the same mechanism that lets your phone list headphones to pair with.

On iOS the app never sees the raw radio packet. Apple's Core Bluetooth framework delivers a small set of decoded fields per discovery: local name, manufacturer data, service data, service UUIDs, overflow service UUIDs, transmit power level, whether the device is connectable, and solicited service UUIDs. That is the entire list (Apple, Advertisement Data Retrieval Keys). There is no hardware address, and the identifier iOS assigns to a peripheral is app-specific and may change.

The app only listens. It does not connect to anything, does not pair, and does not transmit. Scanning runs on the phone; observations are not uploaded.

2. Match: comparing against researched signatures

Each advertisement is normalised (the two-byte company identifier is read from the manufacturer data, 16-bit service UUIDs are canonicalised, names are trimmed) and compared with a catalogue of signatures. A signature is a small, data-driven description of what a device family is expected to broadcast: a company identifier, one or more service UUIDs, a name pattern, or a byte pattern inside the manufacturer payload.

Every signature carries its provenance: where the information came from, under what licence, whether we have independently confirmed it on hardware, and on which iOS versions. Right now the catalogue contains identifiers registered with the Bluetooth SIG by manufacturers such as Meta Platforms Technologies, Snap and Even Realities, plus one community lead recorded so we can test it. None has been confirmed by us; the signature methodology page explains the rules, and testing results shows what is pending.

3. Score: evidence that has to agree

A match produces a list of evidence items, each with a weight and a plain-language explanation. The confidence score combines them with a noisy-OR rule, so independent evidence compounds, and a structural cap keeps any single kind of evidence below the medium level. In practice:

• Company identifier alone: low. It may be a headset, a controller or something else from the same manufacturer.
• Company identifier plus a matching service UUID: medium, if hardware testing shows the combination is specific to glasses.
• Company identifier, service UUID and a name or payload pattern: high, again only once tested.

The weights are explicitly uncalibrated until we have measurements. The detection methodology page shows the formula, the default weights and worked examples.

4. Understand: what you see in a detection

A detection shows the device family the signature belongs to, the evidence that matched (with sources), the confidence level, a coarse signal category (very strong, strong, moderate, weak), and when the device was first and last seen in this session. It never shows a distance, because signal strength is not distance, and it never comments on what the device is doing.

Repeated sightings of the same peripheral are grouped into a session. Sessions end after two minutes of silence. If a device rotates its address, it appears as a new session; we do not try to link sessions across rotations, because that would amount to tracking.

What runs in the background

Apple allows Bluetooth scanning in the background only under specific conditions: the app must scan for explicit service UUIDs, repeated discoveries are coalesced into one, the scan interval becomes slower, and the app can be terminated to free memory. Whether the glasses we study broadcast a service UUID that can be used as such a filter is unknown until tested. The app will describe any background feature as best-effort, slower and able to miss devices. Read what iOS lets a Bluetooth scanner do.

Privacy by construction

No account, no location, no upload of Bluetooth observations, and detection history that stays on the phone with a one-tap delete. The full list of promises and how each one is enforced is on the privacy page.