Law360 is providing free access to its coronavirus coverage to make sure all members of the legal community have accurate information in this time of uncertainty and change. Use the form below to sign up for any of our weekly newsletters. Signing up for any of our section newsletters will opt you in to the weekly Coronavirus briefing.
Sign up for our Technology newsletter
You must correct or enter the following before you can sign up:
Thank You!
Law360 (June 16, 2020, 10:25 PM EDT) -- Attorneys general from nearly 40 U.S. states and territories are pressing Google and Apple to ensure that their app stores are only offering mechanisms to track the spread of COVID-19 that are affiliated with public health authorities and that all contact tracing apps are taken down once the public health crisis has ended.
As governments around the world continue to fight the spread of the novel coronavirus, both apps and physical teams of people are being deployed to keep tabs on had who's had contact with individuals who have tested positive for the virus. These efforts include a recent joint initiative by Google and Apple to develop software that governments can use to build apps to digitally track the virus' spread through Bluetooth technology.
In a letter sent to the CEOs of Apple and Google on Tuesday, a bipartisan coalition of 39 state and territory attorneys general acknowledged the value that digital contact tracing is likely to have in containing the virus' spread. They also appeared receptive to the tech giants' offering, which the companies have stressed will only be available to public health authorities and can only be used if certain features to protect consumer privacy are in place, including barring the collection of geolocation data and the use of personal information for targeted advertising purposes.
But while the attorneys general welcomed Google and Apple's "stated focus on a privacy-centered notification tool," they said that they had "strong concerns" about other COVID-19 contact tracing apps that are already available or may soon emerge on Google Play and Apple's App Store that don't provide similar consumer privacy protections.
"Some of those apps may endanger consumers' personal information," the coalition wrote, noting that they are "particularly concerned about purportedly 'free' apps that utilize GPS tracking, contain advertisements and/or in-app purchases, and are not affiliated with any public health authority or legitimate research institution."
In a footnote, the attorneys general specifically pointed to an app called "Contact Tracing," which was developed by Piusworks LLC — a business that the state enforcers described as "a California company with a suspended registration" — and as of last month was the first result when a consumer searched for "contact tracing" in both app stores.
According to a description that was posted on Google Play, the app "uses geolocation tracking, contains ads, and offers in-app purchases, and it has been installed over 50,000 times," the attorneys general said. They added that the app has since been removed from Google Play but is still available on the App Store.
Their letter also expressed concern that as public health authorities use the software developed by Apple and Google to build their own apps, other developers may try to "take advantage" of the increased media and consumer attention on exposure notification and contact tracing apps and build their own offerings that don't incorporate adequate consumer privacy protections, including the types of safeguards proposed in bipartisan legislation pending in the U.S. Senate.
The attorneys general coalition, led by Nebraska Attorney General Douglas Peterson and Oregon Attorney General Ellen F. Rosenblum, asked Google and Apple to take several steps to combat this threat, including verifying that every app labeled or marketed as related to COVID-19 contact tracing or exposure notification is affiliated with a municipal, county, state or federal public health authority, or a hospital or university in the U.S. that is working with such public health authorities.
The regulators also want the tech companies to remove any app that doesn't meet these requirements and to separately pledge to remove all COVID-19-related exposure notification and contact tracing apps, including the ones created using the companies' new software, from their app stores "once the COVID-19 national emergency ends."
The attorneys general clarified in a footnote that this end date referred to the expiration of the emergency declared by the secretary of Health and Human Services on Jan. 31. They also requested that Google and Apple provide their offices with written confirmation that the apps have been removed or an explanation why removal of a particular app would impair the public health authorities affiliated with each app.
"Implementing these limited measures could help protect the personally identifiable information and sensitive health data of millions of consumers during this crisis," according to the letter, which was signed by attorneys general from across the country, including California, New Jersey, Illinois, Hawaii, Michigan, Massachusetts, Iowa and Pennsylvania.
New York Attorney General Letitia James, who did not sign Tuesday's letter, sent her own missive to Apple and Google on Monday that similarly urged them to ensure that existing and future third-party contact tracing apps published through their app stores "do not inappropriately collect and retain users' sensitive information."
James said she was seeking to enlist the companies' help to prevent untrusted third-party apps from collecting sensitive personal health information, limit invasive data collection and ensure the appropriate deletion of consumer information. She added that she was asking the companies to "make clear to consumers" the difference between apps launched by governmental public health agencies that are meant to notify individuals when they are exposed to the virus and third-party apps that "could possibly take advantage of consumers for financial gain."
"As businesses open back up and Americans venture outdoors, technology can be an invaluable tool in helping us battle the coronavirus," James said in a statement Monday. "But some companies may seek to take advantage of consumers and use personal information to advertise, mine data, and unethically profit off this pandemic. Both Apple and Google can be invaluable partners in weeding out these bad actors and ensuring consumers are not taken advantage of by those seeking to capitalize on the fear around this public health crisis."
Representatives for Apple and Google did not respond to a request for comment Tuesday.
--Additional reporting by Ben Kochman. Editing by Bruce Goldman.
For a reprint of this article, please contact reprints@law360.com.
