The new contract-tracing privacy bill is nice, but it may be too late

U.S. senators on Monday introduced a new bill to regulate coronavirus contact-tracing technology from Google and Apple. The bill, called the Exposure Notification Privacy Act, would ensure nobody is forced to enable the tracking technology, and that anyone who does enable contact-tracing wouldn't have their data used for advertising or commercial purposes.

The move comes as regions around the country cautiously begin to reopen for business. It's unclear how that might affect adoption of contact-tracing, which is opt-in. Coronavirus cases have been spiking in some areas following the relaxation of restrictions.

Google and Apple announced plans in April to quickly implement contact-tracing technology into their operating systems. Contact-tracing uses Bluetooth to create a log of a person's steps that is saved into a specially-approved app. In the event they test positive for COVID-19, those logs can be used to alert anyone who's been in close contact with them so those individuals can take necessary steps to protect themselves and others. Any data is supposed to remain on an individual user's device until they report their status to a medical professional and grant permission for the data to be broadcast to other users.

Promises made, promises not met — The tech industry's vast reach and acumen were supposed to be a savior in the current epidemic but despite big promises, privacy has still been an issue.

Both Apple and Google promised a high standard of privacy, but results have been mixed as a third-party app designed for North and South Dakota was found to be sending location data to Foursquare in violation of guidelines around contact-tracing apps. Foursquare says it was merely using a user's GPS coordinates to label the exact names of businesses the user has visited — making it easier for a human to read the location data — and that it deleted all such data from its servers afterwards.

Still, such mistakes could shake trust in the voluntary programs that are supposed to slow the spread of coronavirus. Adoption has been low elsewhere in the world. Even on the small island of Iceland, adoption was only 40 percent as of late. The last thing we need is advertisers getting hold of the data and targeting infected people with advertisements that exploit their fears to sell snake oil. The U.K. was so distrustful of Apple and Google's model that it chose to build its own solution instead that centralizes data on its own servers, believing that Apple and Google's decentralized model is less safe.

Is it too late? — Lawmakers see regulation as key to ensuring that the public trusts contact-tracing and is willing to adopt it as it would create real consequences for any misuse. The actual efficacy of the technology is still up for debate, however, due in part to that adoption issue but also because experts believe it might alert users that they've been in contact with a positive case even when there's no danger — for instance, if someone in your apartment building a few floors below you tested positive. Iceland's own officials overseeing their contact--tracing initiative say the technology has only been useful in a handful of cases, and only when combined with manual tracing — a.k.a. humans making calls and talking to people.

“[Contract-tracing technology] is more or less … I wouldn’t say useless,” said Gestur Pálmason, a detective inspector with the Icelandic Police Service in an interview with MIT Technology Review. “But it’s the integration of the two that gives you results." Mobile phone tracking cannot capture every possible interaction.

Now that many regions of the U.S. are opening back up, it's possible we may never learn how effective this technology can be stateside. It wouldn't be surprising to see interest in the apps wane for now as people turn their sights to hitting the beach as soon as possible.