For states’ COVID contact tracing apps, privacy tops utility

• By Lindsey Van Ness
• Mar 19, 2021

The digital contact tracing effort in Virginia is 2 million phones strong. Roughly a quarter of the adult population has downloaded the state’s COVIDWISE app or opted in on their iPhones to receive exposure notifications. Almost 26,000 times, a notification has been sent to let someone know they were likely exposed to a person with COVID-19.

But that’s the bulk of the information the state health department can glean.

The system doesn’t track user locations, so officials don’t know where exposures happened, according to Jeff Stover, an executive adviser to the commissioner of Virginia’s Department of Health. Officials can’t follow up on notifications to see whether exposed residents are isolating. Nor can they pinpoint potential hotspot locations. 

“The fact that we do not collect name or location data makes it a little more difficult to evaluate effectiveness,” he said.

Yet Stover and other health department officials say the limited data is the tradeoff required to assuage privacy concerns while still using the technology to slow the virus’ spread.

“I think the privacy concern of individuals is real,” he said. “It is a real issue and something we have to make sure we are getting right. I think we did do this right.”

Over the past year, 24 states and Washington, D.C., have spent millions developing and promoting the Apple and Google-based apps or systems. The tech giants made the basic platform free, but states have spent anywhere from $9,600 in North Dakota to $3 million in Washington state on app development and marketing.

More than 28 million people in the United States have downloaded the mobile apps or activated exposure notifications on their smartphones. The systems use Bluetooth technology and are both voluntary and anonymous.

Critics say the technology has overemphasized privacy at the cost of usefulness.

“I have yet to see any convincing evidence that they’re worth it,” said Ryan Calo, a University of Washington law professor who has written critically about the apps for months and testified in front of a congressional committee last April, in an interview with Stateline.

“A lot of money, a lot of attention, a lot of oxygen has gone into developing this app. That time and money should have been put other places,” he said, such as testing and manual contact tracing.

The states that haven't gone the route of digital contact tracing cite a range of reasons, from privacy concerns to a preference for manual contact tracing.

Still, even as the COVID-19 vaccine supply ramps up, the number of cases drops and states begin loosening restrictions, a few states have recently launched or are still planning to launch contact tracing apps. 

State officials and experts argue such systems add to their toolkits. They say the apps help to reach younger people and provide an alternative for those skeptical of traditional contact tracing, which relies heavily on public health employees reaching people by phone. And they say the technology has a role to play as Americans begin to travel again -- and face the uncertain effects of virus variants.

“There is a possibility that we could have another spike in cases coming up later this summer or in the fall,” said Sam Gibbs, deputy secretary for technology and operations of the North Carolina Department of Health and Human Services.

He hoped the state’s app would draw 500,000 people; it’s been downloaded 785,000 times.

“This is a time where we don't want to let our guard down,” Gibbs said. “We need to continue to be conscious of the disease even if we have been vaccinated.”

‘The perfect app would have failed’

In spring 2020, as states began shoring up responses to the pandemic, state officials realized cellphone data could be used to track the spread of COVID-19. Privacy advocates balked. Polling showed Americans were divided on whether it was acceptable for the government to use phones to track people who tested positive for the virus, according to the Pew Research Center. (The Pew Charitable Trusts funds the center and Stateline.)

In response to the public concern, Apple and Google forged an unlikely partnership to develop a form of digital contact tracing with a tamer name—an exposure notifications system. The Bluetooth-based setup is opt-in only and anonymous.

When a person opts in to exposure notifications, their phone emits a signal that is exchanged with nearby phones that also have opted in to the system. If a person tests positive for the coronavirus and enters a code from a public health authority into the system, notifications are sent to people whose phones picked up the infected person’s signal in the previous 14 days.

Codes change regularly, and the warnings are anonymous. You’re told you were possibly exposed, but not where and by whom.

Google’s Android phones use an app that each user must download. Apple offers apps but also has integrated the exposure notifications system into its operating system, iOS. States can use that to send notifications to users, encouraging them to opt in, without requiring them to download an app. 

Only public health authorities can activate the system.

“This was architected in a way to secure privacy,” said Calo, the Washington professor. “They sacrificed the ability to effectively measure if it worked.”