Data Management and Privacy Policy of COVID-19 Contact-Tracing Apps: Systematic Review and Content Analysis

Abstract

Background COVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users’ permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users’ privacy. Objective This study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies’ readability, and the information included in them. Methods We used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user’s privacy. We assessed the privacy policies’ readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs. Results We identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=−0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=−0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one’s data, the lower the apps’ ratings and transparency index. Conclusions Many contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

The German COVID-19 Digital Contact Tracing App: A Socioeconomic Evaluation

“…While manual contact tracing is considered an established response to infectious disease outbreaks [ 55 , 56 ], DCT apps were first developed in response to COVID-19 and have been studied extensively since then [ 57 ]. From the earliest stages, issues of privacy, security, and ethics were raised [ 58 , 59 , 60 , 61 , 62 , 63 , 64 , 65 ], with doubts about privacy identified as the biggest barrier to widespread use of such solutions [ 60 ]. Numerous studies investigated potentially promising DCT approaches from technical perspectives, including the currently mainly applied Bluetooth-based method [ 2 , 66 ] but also proximity tracing based on GPS [ 67 ], ultrasound [ 68 , 69 ], facial recognition approaches [ 61 ], blockchain-based approaches [ 70 ], or QR code scanning technology [ 71 ].…”

Ten Years of TeleHealth and Digital Healthcare: Where Are We?

“…In addition to the consolidated applications in this sector, new ones have been activated. An application that has exponentially developed in this period has been digital contact tracing for control, monitoring, and epidemic alerting through mobile apps and mHealth solutions [ 42 , 43 , 44 , 45 , 46 , 47 , 48 ]. TH and DH have also been integrated in the use of artificial AI tools in the diagnosis and treatment of COVID-19.…”

Machine learning algorithms for smart and intelligent healthcare system in Society 5.0

“…To understand need of inputs in recent application of ML in Quantum computing inputs, ML deduces patterns from data. Standard numerical modeling methods 41 can't handle some aspects of the problem. When it comes to fixing challenges, ML approaches are critical.…”

“…Even while it's impossible to predict how quantum computers will affect ML, the possibilities are seemingly unlimited and with each new algorithm, ML seems to be an area where quantum computers may undoubtedly improve. Quantum ML appears to be a methodology that will lead to a better future in our society, where large volumes of data are generated and processed every minute, and where fresh and unique research methods can have huge impacts on both life and economy 41–44 . We've covered a variety of quantum ML algorithms in this article.…”

“…Quantum ML appears to be a methodology that will lead to a better future in our society, where large volumes of data are generated and processed every minute, and where fresh and unique research methods can have huge impacts on both life and economy. [41][42][43][44] We've covered a variety of quantum ML algorithms in this article. Currently, much of the work in this area is theoretical, with only a few experiments devoted to showing how quantum mechanics can be applied to AI recent applications.…”