On May 20, 2020, Google and Apple launched their mobile contact tracing technology to assist with COVID-19 efforts. Instead of a single national application, each U.S. state that chooses to use Google and Apple’s technology must develop its own iOS and Android app for its residents. Here’s what you need to know for your own privacy and security as states decide whether they will adopt the innovation:
1. Is participation in digital contact tracing mandatory?
Any digital contact tracing app is entirely optional. Neither the government nor any technology companies can collect or share your COVID infection status without your consent. Even if you opt-in, you can decide at any later point to turn off the technology.
2. How does the technology work?
The technology uses Bluetooth to determine if you have come into contact with an infected individual. It does this by broadcasting a signal known as a “beacon”—a string of random numbers that maintains your anonymity— from your mobile device to other devices, which will record and store that signal. While sending out its own signal for others, your phone will also simultaneously accept signals from other devices. These signals will encode the duration (time) and strength (distance) of the interaction.
Users who have tested positive for COVID-19 and who have consented to share this information within the app will have their unique signal documented on a positive diagnosis list. At least once per day, each phone will compare its own internal list of signals—representing people that you have come into contact with in the last 14 days—to the signals on that positive diagnosis list. If there is a match, then you will be sent a notification informing you of your exposure to COVID-19 and advised on next steps.
Two important distinctions:
1. The technology tracks proximity, not location. This means that while the app can determine who you have come into contact with, it cannot tell where this happened.
2. The technology only notifies of exposure, not source of exposure. Even if you choose to share your positive test result within the app, your name and other identifying information will never be shared with Apple, Google, or the users who you have been in contact with. The exposed individuals will never know who is on the positive diagnosis list.
3. If I choose to participate, how will my data be managed? What are my privacy rights?
Apple and Google’s technology uses a decentralized model of data storage, in which your health information is stored on your own phone, rather than in a central database controlled by the government or by Apple and Google. You control the data and the decision to share such data.
The data can only be used for contact tracing; no policing or monetization of any form is allowed. Furthermore, any apps that use Apple and Google’s technology must delete the data after it is no longer needed.
4. What are the limitations of this technology?
Participation: For digital contact tracing to be effective, public health experts believe 60 percent of the U.S. population needs to opt-in. This majority may be difficult to reach, given privacy and security concerns and distrust of government and the tech industry.
Accuracy: Apple and Google’s technology uses Bluetooth to determine people’s proximity. Because Bluetooth penetrates through walls and closed windows, it cannot differentiate between scenarios of equal distance and duration but very different severity. For example, two people talking 2 feet from each other without face masks have a high risk of transmission. In contrast, two people, each in their own cars, sitting 2 feet across from each other in traffic with their windows closed have a much lower risk of transmission. This means there can be false positives in which users are notified of exposure, when in reality, they have not been in contact with an infected person.
Engagement: Since Apple and Google’s technology is decentralized, it depends on the user to take responsible action. If those who test positive do not report their status within the app, then those exposed will not be informed. And if those who receive a notification do not isolate and seek testing, then digital contact tracing will not contribute much to containment efforts. In other words, digital contact tracing is not the singular solution to fighting the coronavirus; it must work in tandem with other public and private measures as a greater public health strategy.
5. Should I sign up for this technology?
We understand the concerns of undocumented immigrants, African Americans, American Muslims, and other vulnerable communities that have historically suffered from violations of patient privacy and racialized surveillance. Ultimately, only you can make that decision for yourself. Each person’s circumstances are unique; rather than making a generalized recommendation, the goal of this document is to help you weigh the pros and cons and come to an informed conclusion.
6. Which states are using this technology?
Note: the list below will be updated as news is made available.
States that have committed to participating: Alabama, North Dakota, South Carolina, and Virginia
States that will not be participating: Arizona, California, Colorado, Delaware, Maine, Maryland, Michigan, Missouri, Ohio, Pennsylvania, South Dakota, Tennessee, Texas, Washington, West Virginia, Wisconsin, and Wyoming
States that are still undecided about participating: Alaska, Arkansas, Connecticut, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Massachusetts, Minnesota, Mississippi, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, Nevada, Oklahoma, Oregon, Rhode Island, Utah, and Vermont