sorry I didn't mean the MAC address but rather an HMAC-based key derivation. I suspect they rotate MAC addresses every half hour or so, but the broadcast itself

sorry I didn't mean the MAC address but rather an HMAC-based key derivation. I suspect they rotate MAC addresses every half hour or so, but the broadcast itself is encrypted such that you can't tell two belong to the same AirTag without knowing the secret. I might have a secret key for the AirTag, and the encrypted messages derive a new key each day based on the current date, then encrypt a check-in message based on the current time. If I share the secret key, its permanent access until a hardware reset of the AirTag. If I want to share "for a while", I just share a bag of those derived keys for the date range. The UX might represent it as not having a date range, and my devices which know the secret just periodically share out the derived keys when online to give out keys, and effectively make it so that any revocation of permission takes a week. The other option is for me to be able to share enough information with Apple's servers that (on permission change) it blocks the AirTag web service query itself. That won't help you with any shared secrets allowing someone to detect its the same tag even after MAC rotation.