Google touts privacy with virus app but can still track

When Google and Apple announced plans in April for free software to help alert people of their possible exposure to the coronavirus, the companies promoted it as “privacy preserving” and said it would not track users’ locations. Encouraged by those guarantees, Germany, Switzerland and other countries used the code to develop national virus alert apps that have been downloaded more than 20 million times.

But for the apps to work on smartphones with Google’s Android operating system — the most popular in the world — users must first turn on the device location setting, which enables GPS and may allow Google to determine their locations.

Some government officials seemed surprised that the company could detect Android users’ locations. After learning about it, Cecilie Lumbye Thorup, a spokeswoman for Denmark’s Health Ministry, said her agency intended to “start a dialogue with Google about how they in general use location data.”

Switzerland said it had pushed Google for weeks to alter the location setting requirement.

“Users should be able to use such proximity tracing apps without any bindings with other services,” said Dr. Sang-Il Kim, the department head for digital transformation at Switzerland’s Federal Office of Public Health,

who oversees the country’s virus-alert app.

Latvia said it had pressed Google on the issue as it was developing its virus app. “We don’t like that the GPS must be on,” said Elina Dimina, head of the infectious-disease surveillance unit at Latvia’s Center for Disease Prevention and Control.

Google’s location requirement adds to the slew of privacy and security concerns with virus-tracing apps, many of which were developed by governments before the new Apple-Google software became available. Government officials and epidemiologists say the apps can be a helpful complement to public health efforts to stem the pandemic. But human rights groups and technologists have warned that aggressive data collection and security flaws in many apps put hundreds of millions of people at risk for stalking, scams, identity theft or oppressive government tracking.

Now the Android location issue could undermine the privacy promises that governments made to the public.

Pete Voss, a Google spokesman, said the virus alert apps that use the company’s software do not use device location. That’s including for people who test positive for the virus and use the apps to notify other users. The apps use Bluetooth scanning signals to detect smartphones that come into close contact with one another — without needing to know the devices’ locations at all.

Apple, which does not require iPhone users of the virus apps to turn on location, declined to comment on Google’s location practices.

The Android location requirement underscores a troubling power imbalance between governments and two tech giants that dominate the mobile market, some security and privacy experts said. Countries using the software, they said, have little recourse against the new global standards that the companies are setting for public health technology.

Google and Apple, for instance, bar government virus apps using their technology from tracking users’ locations. But Google may determine and use the device locations of Android users of the apps, depending on their settings.

“We are giving too much control to two big companies,” said Alexandra Dmitrienko, a professor of secure software systems at the University of Würzburg in Germany. “They are monopolizing it.”