I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr

I recommend actually reading the specification before imagine how to abuse it. There is no fixed, per-user ID being broadcast. Or if you don't want to, a tl;dr is: 1. Your phone broadcasts a message via BLE every X milliseconds with a "random" ID. The ID is only predictable with a secret key which never leaves user device before "voluntarily revealing" (I agree this can be shaddy). The "random" ID is rotated every Y minutes. 2. The secret key will be rotated daily. The user device only reveals last 14 keys if user voluntarily do so. 3. Note that every BLE advertisement already contains a hardware address and your phone does this regularly. Guess how they mitigate this privacy issue? Rotating the hardware address every Y minutes. So no additional entropy being leaked here, unless you have the user's secret key.