Through the FAA they can. But a lot of the tracking online is done by hobbyists collecting ADSB hex codes via home receiver. There’s quite the database on the adsb exchange mentioned earlier in the thread.
There are ways to disappear entirely if you have a legitimate need. Some parts of the government/ LEO apparatus are very aware and knowledgeable, and then there’s my former community where I, an enterprising LT and self-acknowledged aviation nerd put together a slide show on what ADS-B is and how it works. “Wait, who can see our location data?” We had it installed on all aircraft coming back from an avionics mod in depot and literally no one in the entire chain explained to the aircrew what it was or (most importantly to me) how to disable the ADS-B output. For my old T/M/S there was a way, but it was not intuitive and would reset to “on” when electrical power was cycled from the aircraft. Entirely unsat.
I’m the dude who believes the ADS-B out broadcast should say only “USG” or maybe “E-6” if we really want to try and be charitable (one could argue type aircraft is somehow tangentially necessary to collision avoidance), but we should not be broadcasting side numbers or any identifying information in my humble opinion. Put another way, on the civilian side of things anyone with an internet connection can see my fly over, find my n-number, tie that to my home address, and show up to do me harm all through a system that absolutely does not need to exist. Doesn’t work that way with your vehicle licenses plate.. If it’s that simple, imagine what the truly bad folks can do knowing precisely where and when our military aircraft are.