Google Coronavirus Apps Give it Way to Access Location Data - The New York Times
▻https://www.nytimes.com/2020/07/20/technology/google-covid-tracker-app.html
When Google and Apple announced plans in April for free software to help alert people of their possible exposure to the coronavirus, the companies promoted it as “privacy preserving” and said it would not track users’ locations. Encouraged by those guarantees, Germany, Switzerland and other countries used the code to develop national virus alert apps that have been downloaded more than 20 million times.
But for the apps to work on smartphones with Google’s Android operating system — the most popular in the world — users must first turn on the device location setting, which enables GPS and may allow Google to determine their locations.
Some government officials seemed surprised that the company could detect Android users’ locations. After learning about it, Cecilie Lumbye Thorup, a spokeswoman for Denmark’s Health Ministry, said her agency intended to “start a dialogue with Google about how they in general use location data.”
Switzerland said it had pushed Google for weeks to alter the location setting requirement.
“Users should be able to use such proximity tracing apps without any bindings with other services,” said Dr. Sang-Il Kim, the department head for digital transformation at Switzerland’s Federal Office of Public Health, who oversees the country’s virus-alert app.
Image
Pete Voss, a Google spokesman, said the virus alert apps that use the company’s software do not use device location. That’s including for people who test positive for the virus and use the apps to notify other users. The apps use Bluetooth scanning signals to detect smartphones that come into close contact with one another — without needing to know the devices’ locations at all.
Since 2015, Google’s Android system has required users to enable location on their phones to scan for other Bluetooth devices, Mr. Voss said, because some apps may use Bluetooth to infer user location. For instance, some apps use Bluetooth beacons in stores to help marketers understand which aisle a smartphone user may be in.
Once Android users turn on location, however, Google may determine their precise locations, using Wi-Fi, mobile networks and Bluetooth beacons, through a setting called Google Location Accuracy, and use the data to improve location services. Mr. Voss said apps that did not have user permission could not gain access to a person’s Android device location.
Apple, which does not require iPhone users of the virus apps to turn on location, declined to comment on Google’s location practices.
“This app deserves your trust. It protects your privacy,” Angela Merkel, the chancellor of Germany, said in a recent video address about her government’s Corona-Warn-App, which is based on the Apple-Google model. “No geodata is collected,” Ms. Merkel said.
But privacy and security experts said they were troubled that Google’s location practices might deter some people from using public health agency apps during the pandemic.
“The point of the Apple-Google exposure notification design is to protect privacy and mitigate barriers to adoption,” said Jonathan Mayer, an assistant professor of computer science and public affairs at Princeton.
Some Android users in Europe say they feel misled by their governments. Instructions on many of the apps direct Android users to turn on location, for instance, but make no mention of Google or that users can stop the company from determining their precise locations by turning off the accuracy feature within the location setting.
“With this app, you’re invited, by the government strongly appealing to your sense of responsibility and morality, to give away your live location to entities that are getting a profit out of it, in order to protect public health,” said Massimo Zannoni, an electronic engineer in Zurich.