The Mixed Success of COVID Exposure Notification Apps

Technology can be a powerful tool in efforts to save lives and stabilize shaky economic conditions. It can also help preserve vestiges of normalcy amid a global pandemic. During the COVID-19 pandemic, public interest technology tools, like COVID smartphone apps, were intended to augment personal preventative measures, like social distancing and masks. As COVID proliferated in 2020, many governments tried to harness new tools to slow the spread. But all new tools face the same challenge: How do you get people to use them? Efficacy hinges on adoption and, in the case of technology, implementation.

Since the earliest days of the pandemic, California has leveraged technology and policy to become a leader in the fight to slow the transmission of COVID. Other states also used technology to address the public health crisis, but California’s robust portfolio of pandemic-related apps and software sets the state apart. At the start of the pandemic, California residents could find the latest COVID data in an online hub. Later, they used their smartphones to schedule vaccinations and download their digital vaccine passports. An exposure notification app helped people determine if they’d been in close contact with someone infected with COVID.

To date, more than 9.6 million cases of COVID have been reported in California and the official death toll has surpassed 91,000. How effective were the Golden State’s efforts to keep its residents healthy and safe? Were Californians receptive to using the tools and apps developed to help them? Was the effort necessary to roll out these public technology responses worth it? The results are mixed.

California’s statewide exposure notification app—CA Notify—wasn’t the first of its kind released in the United States, that was Virginia’s Covidwise. But CA Notify, Covidwise, and the apps of 20 other states and the District of Columbia are built upon exposure notification technology developed through a Silicon Valley partnership.

The Google Apple Exposure Notifications framework uses a smartphone’s Bluetooth signal to determine a person’s potential exposure by measuring how long and how close phones have been near each other. If one phone’s user later tests positive for COVID, the app notifies the users of the phones that were in proximity to it. Those phones receive a push notification urging users to take steps to prevent the transmission of coronavirus to others, like testing or quarantining.

The California Department of Public Health opted to use the Google/Apple Exposure Notification Express for its CA Notify app. EN Express is a ready-to-use option that allowed for rapid development of the app as COVID ravaged the state. But, once the app launched statewide, privacy and other concerns deterred residents from downloading or using it.

According to a May 2020 study, Americans’ willingness to actually install and use a COVID app hinges on three main factors: benefit, accuracy, and privacy. Researchers from Microsoft and several universities surveyed 4,500 Americans through questionnaires.

Survey results indicate that motivation to use the app is directly linked to the public or personal health benefits of using an app. People who know someone who died from COVID are five times as likely to install an app, even if it’s not 100 percent accurate. Further, survey respondents were 65 percent more willing to install an app that reports false positives than false negatives.

CA Notify doesn’t collect or exchange any personal information about its users. Instead, users’ phones share anonymous keys—randomly generated strings of numbers—when Bluetooth is turned on. These keys are used to create a log of contacts who came within six feet for more than 15 total minutes over the past two weeks. Keys are frequently changed, never stored on devices, and the identity of a COVID-positive person is never shared. The app automatically deletes information after 14 days, after which it cannot be recovered. But, even with safeguards in place for apps like CA Notify, privacy concerns remain.

Privacy and doubts about efficacy were also barriers to app usage, according to a 2021 research report from the Brennan Center for Justice, a nonpartisan policy and law organization. It characterized exposure notification apps in the United States as having “over­prom­ised and under­delivered,” a “failure” primarily stemming from poor uptake. More than 70 percent of Americans said they wouldn’t download a COVID app because of concerns about protecting their digital privacy. “If Amer­ic­ans’ concerns about privacy resul­ted in decreased parti­cip­a­tion in the expos­ure noti­fic­a­tion apps, it also under­mined their useful­ness.”

Apps like CA Notify are interchangeably referred to as “contact tracing” and “exposure notification systems,” but they are actually the latter. Exposure notification systems, like CA Notify, don’t track or trace your personal information to flag a COVID exposure. Rather, they measure how close your smartphone was to another smartphone whose user reported an exposure or infection.

True contact tracing is how public health crises, like outbreaks of sexually transmitted infections such as HIV, are managed. In that case, health care providers personally contact individuals who test positive and ask them for the names of everyone with whom they’ve had intimate contact.

Digital contact tracing apps simplify this process by leveraging GPS location data to notify a smartphone user if they were within close proximity to someone with COVID and where the contact occurred. As a result, contact tracing apps that rely upon GPS have privacy issues around location data that apps using Bluetooth don’t have. GPS-based apps also drain phone batteries and might not be accurate beyond a distance of 65 feet, according to Wirecutter’s privacy and security editor Thorin Klosowski, in a November 2020 article.

However, Klosowski also argued that exposure notification apps that rely on Bluetooth, like CA Notify and similar apps, aren’t necessarily any better. Bluetooth measures proximity, but it cannot take into account other factors, such as how people are separated (like by a plexiglass barrier in a grocery store or an apartment building wall) or whether they are masked. “Bluetooth and GPS weren’t made for this function, so quirks in the technologies may prohibit them from being effective,” wrote Klosowski.

Other experts agree.

The Electronic Frontier Foundation is a San Francisco-based nonprofit that advocates for digital rights and privacy. “We don’t have evidence that this works at scale. We don’t have evidence that it works in a lot of different places and a lot of different types of communities,” Gennie Gebhart, EFF’s activism director, said in an interview with Klosowski.

University College London researchers reviewed more than 100 studies on automated COVID contact tracing, like smartphone apps, and concluded that the contact-tracing technologies they studied showed no empirical evidence of effectiveness in identifying infected contacts or reducing disease transmission.

The state of California is telling a different story. “Our preliminary analyses using mathematical modeling suggest CA Notify may have prevented thousands of new COVID-19 cases and averted hundreds of deaths in California since its launch” on December 10, 2020, according to an email from CDPH’s communications office.

CA Notify is available to both Android and iPhone users equally, but their ease of use varies. While iPhone users only need to enable exposure notifications in their phone’s settings, Android users must download the app and activate it. In 14 months, according to CDPH, 16.5 million cell phone users activated the app on both platforms, resulting in 1.19 million exposure notifications being sent out to users in California. By comparison, more than 4.2 million cases of COVID were reported statewide from December 2020 through December 2021.

By the state’s estimates, about 52 percent of its 31.9 million residents aged 15 and older eligible to activate CA Notify actually did so. (The app’s terms of service require users to be at least 13 years old.) But state officials said that privacy reasons make them unable to determine how many Android users disabled or deleted the app after downloading it.

Whether Californians benefited from CA Notify might depend on the type of smartphone they use. PC Magazine estimates that in California, 40 percent of smartphone owners use Android devices, versus 58 percent for iPhone. Given iPhone’s significantly higher price than Android until recent years, and the additional labor required to activate the app on an Android device, the findings around who used the app aren’t surprising.

“The essential workers at the grocery store or the fast-food restaurant are more likely to be Android users and appear less likely to have activated the system,” Christopher Longhurst, chief medical officer and chief digital officer for UC San Diego Health, told the California Health Care Foundation in March 2021. He oversaw a pilot test of CA Notify and its rollout to UC campuses and other UC health systems. Seniors, another vulnerable group, Longhurst said, are less likely to own any kind of smartphone.

Longhurst’s concerns about vulnerable groups being left behind are backed by research. Age, education, and income are determinants in smartphone ownership. According to a June 2021 survey from Pew Research Center, people who said they owned a cellphone that wasn’t a smartphone were more likely to be age 65 and older, have a high school diploma or less, or live in a household with an annual income of $30,000 or less. “While [the survey] couldn’t explain why someone owned a smartphone, it painted a clear demographic picture as to who did, and didn’t, own a smartphone,” said Monica Anderson, associate director of research at Pew Research.

Poverty and related systemic inequities have been linked to more COVID cases and deaths in Indigenous, Black, and Latina/o communities. These groups’ overrepresentation among essential workers is one reason.

According to the Urban Institute, more than half of Black, Indigenous, and Latina/o workers have jobs that must be done in person, compared to 41 percent of white workers. Black, Indigenous, and Latina/o workers are more likely to have jobs that put them at a greater risk of being exposed to or being infected with COVID, earn less money, and are less likely to have health insurance. In addition, essential workers are more frequently caregivers to children and seniors, and are more likely to be aged 50 and over, according to the Center for Economic and Policy Research.

The very people who were most at risk for COVID exposure were also the least likely to use, or even be able to access, the exposure notification apps that might have protected them.

Aside from accessibility issues, a lack of trust in government surfaces time and again as the primary reason why people did not want to use a technology tool that had the potential to save lives. When it came to CA Notify, Americans distrusted how their personal information would be used, who designed and produced the tool, and the app’s efficacy.

The Public Affairs Pulse Survey, conducted by the nonpartisan Public Affairs Council (PAC), surveys Americans' opinions on business and government. From 2012 to 2017, the tech sector ranked at the top of the list for trustworthiness, but its ranking gradually slipped over the next few years. In 2021, PAC reported that tech fell into sixth place. Of the survey f respondents, 32 percent considered the sector to be less trustworthy than other industries, like banks and auto, and only 16 percent said it is more trustworthy.

Mounting tensions over the tech industry’s under-regulation and mergers, antitrust scrutiny of the tech industry and the spread of misinformation by Big Tech have led to a steep decline in trust of the sector. “[We’ve] seen a gradual decline in trust in the technology industry,” PAC’s report asserts, “and [an accompanying] rise in public appetite for more oversight of tech firms.”

So, what can we learn from CA Notify’s development and rollout? EFF’s Gebhart sums it up best: “We cannot ‘tech’ ourselves out of this pandemic.” The state of California should be applauded for its attempt to work with private sector tech companies to adapt existing technologies—while preserving people’s right to privacy—for the public good.

But any future apps designed and implemented for public adoption should heed the lessons from CA Notify. It is the government’s responsibility to serve all residents equitably, regardless of income, location, race, or ethnicity. Technology is not currently accessed in our nation such that tech solutions offer an equitable experience for all. Any government effort that relies on technology must take this reality into account.

Are tech-driven solutions to public health crises—and other types of social problems—the future? Yes. But in order for these solutions to be effective, they must be rooted in better integration of government, technology, and the people being served by both.