The new COVID-19 app: the promises and the tradeoffs

As we wait for scientists to produce a COVID-19 vaccine, contract tracing is one of the most reliable ways to stop the spread. Now, Pennsylvania and Delaware have also released a new “exposure notification app” to let users know if they’ve been near someone who’s tested positive for the virus. New Jersey is piloting its app on college campuses.

WHYY health and science reporter Alan Yu explains this could help reach people traditional contact tracing isn’t — but there’s a tradeoff: The privacy protections put in place to convince more people to download the app could make it much more difficult to know how effective it is.

Interview highlights

On how exactly the exposure notification app works

Pennsylvania and Delaware, their apps are built on a platform that use Apple and Google’s operating systems. So your smartphone already has Bluetooth in it. That’s how you get, for example, your wireless headphones to connect to your smartphone. And the way that this exposure notification works is that your phone will send out little chirps, or Bluetooth signals, to other phones around you. And so once you download the app, your phone can send these Bluetooth chirps, and with other phones that have the app, your phones record it. And so if you’ve been close to someone (and close here is defined as being within six feet for at least 15 minutes) then you will know that you have had a close contact. And if someone tests positive and they have the app, then their phone will have a record of all the other phones with the app that it’s been close to in the past two weeks. And that can alert the people that you might have got in touch with.

On privacy concerns this app manages to avoid 

There have been indeed quite a number of privacy concerns when it comes to using apps for contact tracing. So one particular example was in Norway. So Norway started using apps for contact tracing very early on. And the app that they use actually tracked people with Bluetooth and their location data and stored that on a central server. And this got to the point where the government’s own data protection agency told the health department to stop using the app and delete all the because it intruded on people’s privacy. So the way that the Pennsylvania and Delaware apps are different is that their apps do not track location data. And all of the positive matching is done on your phone and not some database that other people have access to.

On why privacy protections could make it hard to know if the app is helping

Switzerland was the first country to make an exposure notification app using the Apple and Google Bluetooth platform. And researchers there say that there is some early evidence that it does help with contact tracing. But the ultimate promise is that this will help reach people that traditional contact tracing does not reach. And right now, we just don’t have evidence to say that indeed it does.

The interesting thing, though, is that the privacy protections actually make it a little bit hard to study how effective the app is. And so the Swiss researchers wrote that the restriction to information on peoples’ devices mean that it’s going to be harder for them to easily study how effective this is for contact tracing, and if they need information, they have to gather it somewhere else.

But on the other hand though, this app, its success depends on having more people use it. And so in countries like the U.S., and other societies where people value their privacy, if you don’t have robust privacy protections, you might not have as many people using the app to begin with. And so it’s a fundamental tradeoff. You have to decide: Do you want to have really robust privacy protections, even if it means you can’t get as many data from the app as contact tracers or researchers would like to study its effectiveness? Or do you have an app that gathers more information, but then you run the risk of people sort of being worried as to how much information is being gathered and then not using it? Because that doesn’t really work either. So, there’s no really right way to do it, but it’s a balance that societies and public health authorities will have to strike for themselves.