The Privacy ICAO Address, the Fifty-Dollar Receiver Anyone Can Buy, and the ADS-B Tracking Problem the FAA Had to Fix

Your aircraft broadcasts its position, altitude, groundspeed, and a registration-linked identifier to anyone within roughly 100 miles - unencrypted, unauthenticated, and receivable with a $50 USB dongle. The FAA built a solution called the Privacy ICAO Address (PIA) program, but most pilots who would benefit from it don’t know it exists.

What ADS-B Actually Broadcasts

ADS-B stands for Automatic Dependent Surveillance-Broadcast. The FAA mandated ADS-B Out for most controlled airspace effective January 1, 2020. If you fly in Class B, Class C, above 10,000 feet MSL, or in several other designated areas, your aircraft is required to have it.

Every second, your transponder fires a radio message called a squitter. That squitter contains your aircraft’s ICAO 24-bit address - a unique identifier mathematically derived from your registration number - along with GPS-derived latitude and longitude, plus altitude, groundspeed, track, and vertical rate.

All of it goes out over the air at 1090 MHz. It is not encrypted. It is not authenticated in any meaningful way. It is a plain radio broadcast that anyone within range can receive.

The $50 Receiver Anyone Can Buy

The hardware required to receive ADS-B is not sophisticated. A software-defined radio (SDR) USB dongle costs between $25 and $60. Pair it with a basic antenna and free open-source software on any laptop, and you have a working ADS-B receiver capable of tracking aircraft at altitude within 100 to 200 nautical miles.

The ICAO address in every squitter has a mathematical relationship to your tail number. Someone who knows your N-number can calculate your ICAO code. Someone who knows your ICAO code can reverse it to your tail number using the FAA’s publicly accessible civil aircraft registry. From there, they can watch the ADS-B feed, log every flight, and build a year’s worth of movement history in seconds - without hacking anything or filing any request.

How the Public Tracking Networks Were Built

Aviation enthusiasts recognized this quickly. Hobbyists began setting up home receivers and feeding data to central aggregators, which is how the major crowdsourced tracking networks were built.

FlightAware launched in 2005 and expanded to incorporate ADS-B as the technology proliferated. FlightRadar24 grew a massive volunteer receiver network across Europe and eventually worldwide. ADS-B Exchange built an unfiltered feed from thousands of receivers with an explicit policy of not honoring requests to suppress specific aircraft.

Today the combined receiver infrastructure covers the continental United States with remarkable density. In populated areas, your aircraft is likely tracked continuously from the moment you rotate off the runway to the moment your wheels stop at the destination. The data feeds publicly accessible websites that anyone with an internet connection can use for free.

The Controversy That Forced a Reckoning

The public debate sharpened in 2022 and 2023 when a high-profile technology executive’s private jet became the subject of a tracking account run by a college student. The student built software that monitored the jet’s ADS-B transponder and broadcast its position publicly on social media. The executive’s legal team asked several tracking platforms to suppress the data. Most complied. ADS-B Exchange did not.

Their stated position: the signal is a public broadcast required by federal law, it is not theirs to suppress, and filtering it selectively creates a two-tiered system where wealthy operators can hide their movements while ordinary operators cannot.

The controversy forced a broader reckoning. The surveillance infrastructure built for safety is also a surveillance system that works on everyone in it. That is not a design flaw - it is a consequence of an unencrypted, broadcast-to-all architecture. The engineers who specified ADS-B in the 1990s and early 2000s were optimizing for safety, redundancy, and global interoperability. Privacy was not a design requirement.

What the FAA Built: The Privacy ICAO Address Program

The FAA had actually anticipated the problem before the 2020 mandate took effect. The Privacy ICAO Address (PIA) program was created specifically to give general aviation operators a way to protect their identities while still complying with ADS-B Out requirements.

Your aircraft’s normal ICAO address has a mathematical relationship to your registration. With PIA, the FAA assigns your avionics a randomly generated ICAO address that has no public relationship to your tail number. Your transponder broadcasts that random address instead of your real one.

From a safety standpoint, nothing changes. Air traffic control can still identify your aircraft because the FAA maintains an internal mapping between your PIA code and your actual registration - and that mapping is not available to outside parties. You remain visible on every traffic display. Other ADS-B In-equipped aircraft see you as traffic. Collision avoidance works identically.

What changes is the public-facing connection. To FlightAware, FlightRadar24, ADS-B Exchange, or any private receiver operator, you appear as an anonymous transponder code with no link to your registration. The chain from ICAO address to tail number to owner is broken at the public level.

The PIA code also rotates on a periodic schedule, adding another layer of difficulty. Even if a determined observer identified your anonymous code through patient pattern analysis, the rotation eventually breaks that association and resets the clock.

How to Enroll in PIA

Enrollment is not automatic. You apply to the FAA, provide aircraft and operator information, and the FAA vets the request. If approved, they issue an address to load into your avionics - a process that varies by equipment manufacturer.

The FAA’s documentation covers the full procedure. AOPA has published practical enrollment guidance for members. The program is not heavily advertised: it exists, it is documented on the FAA website, but it does not appear in primary flight training syllabi or at most safety seminars. Pilots who would benefit most from knowing about it are often the last to hear it exists.

What PIA Does Not Do

PIA does not make you invisible. You are still broadcasting position, altitude, speed, and track every second. That data is visible on every traffic system, every ATC display, every receiver. PIA protects your identity, not your presence.

If your operations are predictable enough, a patient observer can still build inferences through behavioral pattern analysis - same route, same schedule, same departure time. PIA adds significant friction. It does not eliminate the possibility of identification.

PIA is also generally limited to Part 91 general aviation operators. Commercial operations under Part 121 and Part 135 have different requirements and different oversight structures. The public interest in tracking commercial aviation is generally considered to outweigh the privacy considerations - that debate is separate from the GA case.

The Policy Debate: U.S. vs. Europe

The European Union Aviation Safety Agency (EASA) took a different approach, implementing rules that restrict how publicly accessible platforms can display certain flight data. Some aircraft categories receive automatic anonymization. The burden falls on data aggregators to filter, not on operators to opt in.

The American model trusts operators to find the program and enroll if they need it. The consequence is that most operators who would benefit from PIA do not know it is there. Neither approach has clearly won the argument - they reflect different assumptions about where privacy protection belongs and who should bear the burden of implementing it.

Why This Matters for Pilots

The overwhelming majority of people looking at flight tracking websites are plane spotters, aviation enthusiasts, operations professionals, and people waiting for flights. Surveillance use cases represent a small fraction of actual traffic to these platforms - but one that creates real consequences for real people.

If you fly a Cessna 172 on weekend cross-countries, your ADS-B data is almost certainly being collected, and that is probably fine. You are one of tens of thousands of small aircraft broadcasting into a system designed to see all of them.

If you operate under circumstances where your movements are commercially sensitive, where client confidentiality is a concern, or where you simply do not want your full flight history publicly searchable, the Privacy ICAO Address program is worth looking into. It works as intended for what it is designed to do.

What is not a defensible position is not knowing your options.

Key Takeaways

ADS-B Out has been mandatory since January 1, 2020 for most controlled airspace, and every squitter your transponder fires is an unencrypted public broadcast receivable by anyone with a $50 SDR dongle.
Your ICAO address is mathematically linked to your tail number, making it straightforward to connect ADS-B data to a specific registered aircraft and its owner using publicly available FAA databases.
The Privacy ICAO Address (PIA) program lets Part 91 GA operators broadcast a randomly generated, rotating ICAO address with no public link to their registration - while remaining fully visible to ATC and traffic avoidance systems.
Enrollment is not automatic - you apply to the FAA; AOPA has published practical guidance for members on the process.
PIA protects your identity in the public data stream, but it does not hide your presence. You are still visible; you are simply anonymous.