Privacy and App-Driven Contact Tracing

Jul 9, 2020, 13:58 PM by BBB National Programs

SARS-CoV-2, commonly known as coronavirus, hit the world by storm, altering the lives of people from the American midwest to Shanghai. As the world unites to “flatten the curve” and guard the surge capacities of hospitals, a common term that has emerged is “contact tracing.” Contact tracing is broadly defined as monitoring individuals that have had contact with a person infected by a disease to ensure that they get treatment and prevent further transmission.

Effective contact tracing is a key strategy to fighting transmissible disease and has been employed throughout history – from the outbreak of syphilis in the sixteenth century to the 2014 Ebola outbreak. Today, major tech corporations have proposed new methods for contact tracing powered by a fixture of 21st century life – the smartphone.  

Mobile Tech vs Coronavirus

In the world of epidemiology, traditional methods for contact tracing consist of recordkeeping, mass interviews, and maintaining lines of communication with infected individuals to learn about infection, treatment, and movement. Often, medical personnel conduct interviews with individuals to determine which people they’ve been around over a 14-day period, a strategy which frequently relies on human memory.

After the start of the coronavirus pandemic, governments and corporations quickly noted that existing technologies in mobile operating systems and apps can be used to achieve the same ends.

For example, a typical smartphone can track its location (using the GPS satellite network) and send signals to other devices (using Bluetooth). As the recording of an infected person’s movement and social encounters is a key part of any contact tracing strategy, the ubiquity of smartphones can theoretically be harnessed to help stop the spread of the virus.

To use these technologies for contact tracing, some corporations and governments have proposed creating mobile apps that allow users to log information about:

  1. Whether or not they have tested positive for coronavirus, and
  2. Which other individuals they have been near during the time they’ve been infected.


If a user indicates they are positive for the virus, their mobile device alerts other individuals they have recently been around that they may have been in contact with a carrier. The users receiving alerts can then take appropriate steps to limit contact, seek treatment, or quarantine themselves.  


The Approach: Centralized vs. Decentralized

Though many proposed contact tracing strategies fit the pattern described above, each method falls on a spectrum between “centralized” and “decentralized” approaches.

A “centralized” approach takes data generated from the use of contact tracing technology and stores it on a server accessible by a government or corporation. In theory, this allows a public health authority to analyze data about the rate of infection and the location of individuals suffering from the virus. While this approach is understood to be less protective of individual privacy, advocates of a centralized approach insist that this provides valuable information to public health authorities regarding the geographical spread of a virus.

In contrast, a “decentralized” approach does not permit data generated by contact tracing technology to be accessible to a third party. For example, if user Jane logs herself as positive for coronavirus through a contact tracing app and the app alerts user John about his recent proximity to Jane, data generated about these events would only be stored locally on John and Jane’s devices.


The Tech: Bluetooth vs. Location Data

Google and Apple: the Bluetooth model

The two biggest players in the mobile operating system marketplace, Google and Apple, have taken the unusual step of joining forces to build a modern contact tracing strategy, which they have referred to as an “Exposure Notification” system.

Currently, the companies are developing new enhancements for their operating systems and an application program interface (API) that would allow app developers to build their own contact tracing software. Their proposal would use Bluetooth LE to track users’ proximity to other individuals through a device “handshake,” then alert users if an individual in their proximity is later diagnosed with coronavirus.  

This strategy represents a decentralized approach, as data about contact with other phones is never transmitted elsewhere. Moreover, by using “ephemeral” IDs for the Bluetooth handshake, it is difficult to identify a diagnosed person with certainty. An alerted user would only be informed that they had been in contact recently with a carrier, but not who the carrier is. Notably, their proposed system will not allow the use of GPS location tracking for contact tracing, and cannot be integrated into centralized models.

Apple and Google launched their API in May 2020 and Switzerland was the first country to launch an app based on this approach.

The location data model

Some other companies and governments have proposed utilizing precise location data for contact tracing. For example, GPS technology and crowdsourced WiFi data, which can track a user’s location, could provide valuable information about the movement of infected individuals, those they encounter, and locations that require disinfection. But because technologies like GPS that capture a mobile app user’s precise location consume more energy from a user’s battery, this method is understood to be both less privacy protective and less efficient.


Caution and Criticism

As the world works to fight coronavirus, many governments are employing the methods described above – across the United States, Europe, Asia, and Australia, governments are building their own contact tracing mobile apps and pairing them with other types of technology. But whether the approach is centralized or decentralized, or relies on GPS or Bluetooth, there are shortcomings and tradeoffs that should be analyzed to ensure that contact tracing works effectively. It’s critical that citizens, businesses and regulators understand these emerging strategies, so we can work together to return to a healthier world.  

Other Blog Articles


Harmful Stereotyping in Advertising Must Not Be a “Forever Problem”

Though the annual celebration of Black History Month is drawing to a close, the plethora of issues raised by the study of Black history must always remain top of mind. For those of us who work in truth in advertising at BBB National Programs’ National Advertising Division (NAD), we are paying very close attention to the issues of diversity and stereotyping, as presented in various forms of advertising. Developing a mechanism to addressing representation in advertisements would not be simple, but the time is now to start the conversation. Harmful stereotypes in advertising must not be a forever problem.
Read more

5 Tips for Truthful and Transparent Influencer Marketing and Product Reviews

BBB National Programs’ National Advertising Division is dedicated to truth-in-advertising. To help you ensure that influencer marketing and the use of product reviews in your advertising is both transparent and truthful, we offer the following five tips.
Read more

In 2021, Consumer And Stakeholder Privacy Is About Defining Trust

As business and nonprofit leaders navigate the Fourth Industrial Revolution, consumer and stakeholder privacy has become a matter of defining trust. As new digital services and connected devices fueled by personal data flourish, consumers’ reasonable expectation of privacy shifts. If expectations do not match reality, it can lead to gaps in trust and new paths for litigation and regulatory enforcement. In this piece I outline a few 2021 privacy developments business and nonprofit leaders should note.
Read more

Broadening the Definition of Express and Implicit Representation in Children’s Advertising

One way to gauge exactly how far we have come in implementing diversity and inclusion is by analyzing what we see on our screens, particularly in advertising. The Children’s Advertising Review Unit (CARU) recognizes the special vulnerabilities of children with their limited knowledge, experience, sophistication, and maturity and often places itself in children’s shoes to gain insight when assessing the role advertisement has in shaping their perception.
Read more