Privacy Tracker: Contact Tracing & Digital Health Certificate Apps

The goal of this tracker was to monitor the flood of new initiatives introduced by governments around the world in response to Covid-19 that posed a potential risk to data privacy and security.

While this index is no longer being updated, it remains a vitally important document of the wide range of location tracking used by authorities, the proliferation of contact tracing mobile apps, and introduction of new physical mass surveillance.

Some of these may well have been proportionate, necessary and legitimate actions during an extremely challenging period of time. However, some dramatically threatened citizens’ civil liberties and right to privacy.

In maintaining this document, our aim remains to help stem overreach, promote scrutiny, and ensure that intrusive measures don’t continue for any longer than absolutely necessary.

See our complete findings in this public Google Sheet.

We have documented 120 contact tracing apps in 71 countries, with many more scheduled to be rolled out in the coming weeks.

Much like VPN applications, contact tracing apps have provoked heated discussions in regards to their data privacy and inclusivity.

The data privacy concerns raised initially have gradually eased in recent months by the increasingly widespread adoption of Google and Apple’s Exposure Notifications API. That’s because Google and Apple’s API requires mobile app developers to adopt a decentralized approach if they want to utilize the API’s functionalities.

The decentralized system provides users with randomly generated, anonymous temporary keys. Upon a positive test result, the users’ app will share the temporary codes it’s used to a central server. These codes are then sent to every other device with the app installed to perform contact matching risk analysis and, if the random key matches one that the app has previously logged and meets the specified risk exposure criteria, it will send an alert and ask the user to self-quarantine.

Unlike the centralized approach, the decentralized approach protects users’ anonymity by performing the contact matching analysis at the local level, rather than at the point of the central server.

Overall, 45 contact tracing apps are currently using Google and Apple’s API, including 13 contact tracing apps in the U.S. There are also plans in another six U.S. states to use the API in the future.

While an increasing number of countries have adopted the decentralized approach, an alarming number still put users’ sensitive data privacy at risk. 19 contact tracing apps, which have been downloaded over 4 million times combined, don’t even have a dedicated privacy policy.

Contact tracing apps often use GPS technology to track your precise location – a VPN that spoofs GPS is among the only consumer technology that can prevent this from happening.

Issues surrounding the interoperability of contact tracing apps dominate the public debate. The EU Commission has announced^[3] that European apps would begin to be interoperable from October 17, with the German and Italian apps the first to connect.

Similarly, in the U.S. an increasing number of contact tracing apps are using the national key server created by The Association of Public Health Laboratories.^[4]

In-Depth Analysis

We analyzed 47 contact tracing apps in 28 countries in detail and found that many put users’ data privacy at risk.

In our analysis of these mobile apps, we found code relating to Google’s advertising and tracking platforms in 17 contact tracing apps. This includes AdSense, Google’s advertising network that allows publishers to make money by showing ads to their users, and also the much more powerful Google Ad Manager, formerly known as DoubleClick for Publishers, which allows publishers to show ads from a huge array of sources.

Aside from the ethics of monetizing this type of app, the presence of such tracking code in contact tracing apps raises red flags around data privacy and personal data collection due to the targeting options offered by Google’s ad platforms.

We also found code that enabled varying levels of integration with Facebook in seven apps. This ranges from direct integration with Facebook’s advertising platform to functionality allowing users of the apps to link their Facebook accounts, or to share content from the contact tracing apps to Facebook.

The general lack of data privacy features in these apps exacerbates concerns that contact tracing apps may be used to harvest citizens’ personal data.

Access this Google Sheet for our complete findings.

Many public health authorities around the world have turned to initiatives involving location-based services to help monitor their populations.

Measures have included the use of aggregated mobile location data to track citizens during lockdowns, mobile apps designed to help identify the location of those infected, and the deployment of advanced cellphone monitoring technologies.

We have compiled a reverse chronological list of confirmed location tracking being adopted around the world on this public Google Sheet.

Authorities around the world are also adopting increasingly extensive physical mass surveillance measures that significantly intrude on individuals’ right to privacy.

These include the deployment of facial recognition cameras equipped with heat sensors, surveillance drones used to monitor citizens’ movements, and extensive CCTV networks in a bid to help enforce curfews.

See a reverse chronological list of such measures implemented around the world on this public Google Sheet.

For more updates on proposed and confirmed developments from around the world, follow Privacy International’s live tracker, Tracking the Global Response to COVID-19, and this document created by Dr. Andrew Dwyer.