The state of Utah has rejected the Apple-Google Exposure Notification framework in favor of a less private contact tracing app created by social media startup Twenty.
Screenshots of Utah's new 'Healthy Together' contact tracing app. Credit: Twenty
Digital contact tracing, or using software to track and curb the spread of diseases like COVID-19, is seen as a way out of current social distancing and stay-at-home mandates. On April 10, Apple and Google announced a developer framework that would allow public health organizations to create their own contact tracing apps. Just a couple of weeks later, Utah unveiled an app called Healthy Together.
Although the ultimate goal of the two solutions is the same, the systems take vastly different approaches. Healthy Together was created by a company called Twenty, known for an app that lets young people meet up in person. Unlike the Apple-Google API, Utah's contact tracing solution relies on personally identifiable information.
Some of the data Healthy Together collects includes GPS, cell tower location data, and Bluetooth signal data. It also requests access to a user's phone contacts, according to national security blog Lawfare. Healthy Together's privacy policy states that this data may be shared with public health officials and a "limited number" of development staffers working at Twenty.
That stands in stark contrast to the Apple-Google API, which relies on anonymized Bluetooth identifiers and only stores data locally on a user's device. The Apple-Google solution isn't an app -- it's a toolkit that health organizations can use to build their own exposure notification apps.
On Utah's government website, state officials argue that relying on Bluetooth alone gives a "less accurate picture" than its solution. That's the reason for adding GPS location data into the mix, as well as the reason why the state has rejected the Apple-Google framework.
Twenty's founders told CNBC that the app is opt-in, and users can choose to limit Bluetooth and Location Services permissions if they want. Any data stored on Twenty's servers is deleted after 30 days, they added.
Privacy experts and civil liberties advocates have long had concerns about mass location surveillance. And although the Apple-Google solution isn't perfect, it places great emphasis on protecting user privacy.
It's also worth noting that, by rejecting the Apple-Google API, it's likely that Healthy Together will work less effectively in the background due to built-in security restrictions in iOS.
Americans appear to be skeptical of contact tracing efforts, per some early surveys. Technologists generally think trust will be important as public health organizations attempt to get to the reported 60% adoption rate required for contact tracing to be effective.
A Utah public health spokesperson told CNBC that Healthy Together's use of personally identifiable location data makes that 60% adoption statistic less necessary.
Healthy Together is currently in beta testing and no data is being used for contact tracing. Twenty eventually hopes to sell the app and back-end to other states, as well as private companies, CNBC reported.
In addition to digital contact tracing, Healthy Together also has resources about coronavirus symptoms, testing facilities and a feature that lets users see their test results within the app.
The state of Utah isn't the only government to reject Apple's and Google's framework. In the UK, the National Health Service has also decided to forego the API in favor of its own contact tracing app.