The Care19 app, developed by ProudCrowd of North Dakota, was one of the first contact tracking apps approved by state governments in response to the coronavirus. Governors of both states promoted it as a way to help health officials stop the outbreaks and retrace the steps of people with infections, while assuring them that their data is protected. But tech privacy company Jumbo Privacy reported this week that developers included lines of code that send user locations and identification data to third-party companies like Foursquare, BugFender, and Google.
Concerned citizens have been watching the tradeoff between controlling outbreaks using apps and privacy intrusions. Civil liberty groups and technology guardians have warned about contact tracking applications, saying governments and companies should not be able to access personal data.
The Care19 app shared location data with Foursquare, an advertising company that markets people based on their location.
ProudCrowd CEO Tim Brookins said his company sends data to Foursquare to determine what businesses a user has visited, but the data is discarded and is not used for commercial purposes.
"The simple general fact here is that we have stated, and Foursquare has confirmed, that they have not collected, nor will they collect, data from Care19 users. Period," Brookins said.
The application generates an anonymous code for each user. The Jumbo Privacy report noted that the code, along with the phone ID, was sent to BugFender, a Barcelona-based company that helps developers track down the malfunction. The app also sent an advertising identifier linked to the user's phone to Google's Firebase service. That adds to "serious privacy risks," Jumbo said.
"It really is an oversight of them," said Jumbo Privacy CEO Pierre Valade. "It is not a bad intention. They were quick to build this product."
As of Friday, Care19's privacy statement told users that their location data "would not be shared with anyone, including government entities or third parties, unless you consent or ProudCrowd is bound by federal regulations."
A revised statement says that third parties "may have temporary access to aspects of their data for their specific data processing tasks. However, they will not collect this data in a way that allows them or others to access or use this data,quot;
South Dakota Health Secretary Kim Malsam-Rysdon said the Care19 app does not violate the privacy statement and that users have always had to grant permission for the app to use their data. The South Dakota version of the app has been downloaded more than 18,000 times, but has not yet been used to track an active infection.
"This is a voluntary voluntary application," he said.
Republican North Dakota Governor Doug Burgum said in a statement that the app, which has more than 33,000 downloads in his state, does not use names, addresses or other personal information.
"The anonymous information that Care19 is collecting can save lives, and the smart and secure use of technology is one more way to help us accelerate the recovery of our economy," he said.
Copyright 2020 The Associated Press. All rights reserved. This material may not be published, transmitted, rewritten, or redistributed without permission.