Are COVID-19 apps secretly tracking your phone contacts? Fact Check

A number of different messages spreading across social media warn readers not to install COVID-19 tracing apps because they can identify and track the contacts of someone who uses it.

MOSTLY FALSE

The messages warn readers that if they do install the COVID-19 apps, they should delete the person posting the warning. Many messages mention specific COVID-19 apps such as HealthyTogether and TraceTogether. Others just attribute the warning to “any COVID-19 app”.

Examples of such messages are below.

To all my contacts who intend to install any COVID-19 app such as HealthyTogether, or TraceTogether or any other related CoVid19 tracking and tracing app please delete me and my family from your phone contact list and Facebook BEFORE installing this app on your smartphone! You do not have my consent to use my phone number in connection with your app to identify, track or locate my family/friends with this app. As I understand it, all of your contacts will be known as well as your contacts’ contacts. This will all be done without prior consent or knowledge, so count me out! I REFUSE to have any part of it!! I will not use these apps and I also will protect my contacts. No one has the right to track private citizens. These are TRACKING apps that will TRACK every person in your Contacts list & then tracks all of theirs & so on!!! I highly Recommend to NOT download this app (Feel free to copy)–

To all my contacts who intend to install this new COVID-19 phone app called “HealthyTogether”…. please delete me and my family from your phone contact list, Instagram and Facebook BEFORE installing this app on your smartphone.
You do not have my consent to use my phone number in connection with your app to identify, track, trace or locate my family/friends.
As I understand it, all of your contacts will be known as well as your contacts’ contacts. This will all be done without prior consent or knowledge, so please count me out.
Thank you for your understanding. It is nothing personal.
I will not be using this app and I will protect my contacts. I do not agree to this technology or consent to being tracked or traced. (Feel free to copy)

To all my contacts who intend to install the COVID-19 app AB TraceTogether, or any other tracking app, please delete me from your phone contact list and Facebook before installing the app on your smartphone!
You do not have my consent to use my phone number in connection with your app to identify, track or locate me because you have this app. All your contacts will be known and theirs will as well, and it will be against their will or knowledge!
I don’t want anything to do with this at all!
Thank you for your understanding and cooperation.
(Feel free to copy)
Health Insurance Portability and Accountability Act:
Medical Definition of HIPAA
HIPAA: Acronym that stands for the Health Insurance Portability and Accountability Act, a US law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals and other health care providers

Just in case since You haven’t heard of this before now…
I am respectfully asking this of all my friends and family. I understand that some of us differ in our beliefs regarding COVID19.
I also understand that some of you will be downloading the COVID19 app which promotes “for the greater good, for our safety, for the safety of our loved ones”!
If I am one of your “contacts” and YOU intend on installing the app, “Healthy Together” “AB Trace Together” or a similar tracing app, please DELETE ME from your phone contact list, Facebook, Instagram or Twitter pages PRIOR to installing the app on your Smartphone!
The app WILL ask for permission to access your contact list, and NO ONE has my consent to use my phone number or any other identifying contact info in connection with these tracking apps which will identify me and locate me without my knowledge or permission.
Even Snopes verifies that GPS capabilities are part of these apps and there are several more in development that have raised serious privacy issues. Thank you for understanding that this is NOTHING personal!
To educate yourself simply Google COVID19 APP ~ and feel free to copy and paste this to your page if you want!

Please note: To all FB friends who intend to install the COVID-19 app for tracking: I am asking you to please delete me and my details from your phone contact list & any other app, as well as unfriend me on Facebook before installing the tracking app on your smartphone. This app will ask permission to access all of your contacts.
You Do Not have my Consent in either written, oral or “assumed” format to use my phone number or facebook contact in connection with your app to identify, track, or locate me without my prior knowledge or written & signed consent.
Copied & shared

TLDR: Most contact tracing apps do NOT ask for any access to your phone and social media contacts. Other apps optionally request access to phone contacts so the app can be shared easily, but this can be denied. However there are NO apps that track or monitor the phone or social media contacts of people who use them. COVID-19 apps differ in how they operate, so any “catch-all” copy and paste message is going to be inaccurate. Also, putting legal sounding jargon on your social media profile has no bearing on your (or others) legal rights.

While such messages attempt to raise legitimate privacy concerns that may arise with apps specifically designed to trace whether people have shared the same physical location, such warnings exaggerate certain privacy issues, while providing misleading and inaccurate information. Specifically, most of these warnings falsely assert that COVID-19 tracing apps have the ability to identify and trace the phone contacts or social media contacts of the people who install them, despite those people not using the app.

The point of COVID-19 contact tracing apps is to determine and record which people a user has come into contact with, so one can be notified if the other develops COVID-19. This, naturally, requires the app to record a certain amount of data on the movements of those who use them.

Sponsored Content. Continued below...

Different apps work in different ways. For example, some use only Bluetooth to record proximity between two people using the app, but don’t record where they were. Others, however, also use GPS data to record infection “hotspots” (i.e. where exactly the users were when they came into contact.) Most apps we’ve seen give the user control over what type of data the app records.

Of course, the person installing and using the app can expect a certain amount of data about their movements to be recorded, since that is the reason they installed the app in the first place (it would, after all, be unreasonable to expect an app to record zero data related to our movement yet still expect it to determine if we’ve come into contact with others who develop COVID-19.) The real issue posited by the messages above is about whether the apps can identify and trace the contacts of those who install them (i.e. people that have not installed the app or given permission for such apps to track them.)

And this is where such messages fall short. Of the apps that we have seen, none could be capable of tracking a user’s phone contacts.

For example, the ABTraceTogether app used in Alberta, Canada, collects only the phone number of the person installing it (so they can be contacted.) If a person develops COVID-19, they will be asked to share the contact tracing logs containing anonymous IDs the app collected via Bluetooth, so people who have come into contact with that person can be warned. None of this would allow the app to access the phone or social media contacts of the user, much less identify or track them. From the ABTraceTogether app’s FAQ under What data is collected?

During the app set up, the only personal data we collect is your mobile number, so Alberta Health Services can contact you quickly if you were in close proximity to a COVID-19 case.
With your consent, the ABTraceTogether app exchanges Bluetooth proximity data with nearby phones running the same app. This data is anonymized and encrypted, and does not reveal your identity or the other person’s identity. In order to measure distance, information about your phone model and the signal strength recorded is also shared, since different phone models transmit at a different power.
This data is stored only on your phone, and is not shared with Alberta Health Services. Should Alberta Health Services need the data for contact tracing, they will ask you directly to share it with them and enable an upload of your contact tracing logs.

In this instance, the app is actually considerably more privacy-aware and far less intrusive than a number of popular apps that most people tend to have on their phones.

The HealthyTogether app used in Utah uses both Bluetooth and GPS data to work, but users can disable the latter so it works in a similar fashion to ABTraceTogether. This app does invite users to share the phone contacts with the app “to enable [a user] to invite [their] contacts to Healthy Together and help facilitate [their] user experience.”

Contact List. If you choose to share your mobile device contacts or address book with Healthy Together, we will store your contacts or address book information, including the phone numbers and names of your contacts, to enable you to invite your contacts to Healthy Together and help facilitate your user experience.

However this step is optional and like other COVID-19 tracing apps, this doesn’t mean the app can trace or locate the phone contacts or social media contacts of those who install it.

The functionality in all the tracing apps we looked at involve the apps working by two phones with the app active swapping an ID number with each other whenever they came into contact. That ID was then stored in the phone for a certain period of time before being deleted. This number is used to determine if someone needed to be alerted if someone they came into contact with developed COVID-19. Since it is the app swapping an ID number with its counterpart on another phone, the app doesn’t detect or track other people that don’t have the app installed and active on their device.

Sponsored Content. Continued below...

Since none of the COVID-19 apps we looked at (including the most popularly mentioned, HealthyTogether and ABTraceTogether) force a user to hand over access to their phone contacts, nor would the app detect users who don’t use the app, the claim they can trace, identify and locate a user’s phone or social media contacts isn’t true.

It is true that some apps, including HealthyTogether, ask (optionally) for a user to upload their phone’s contacts, this doesn’t allow the app to trace them.

It is natural that contact tracing apps be scrutinised from both a security and privacy perspective, given the very nature of the information about us that they need in order to work correctly. And it is also right that we demand such apps not collect unnecessary or superfluous about users. But the information in these messages is inaccurate, and we don’t recommend spreading them.

If you are concerned with what a particular tracing app can access and what it does with your information, you can check their privacy policy as we have done so here.