Congress plans legislation to regulate contact tracing apps

The U.S. Senate plans to unveil bipartisan legislation Monday to introduce regulations on COVID-19 contact tracing and exposure notification apps.

The so-called "Exposure Notification Privacy Act" would include federal regulations around COVID-19 contact tracing efforts by the tech industry, which are focused on tracking who a user comes into contact with and alerting them if one of those contacts tests positive for the virus.

Democrat and Republican lawmakers, led by Sen. Maria Cantwell (D-WA), say that the legislation is necessary to ensure that contact tracing isn't forced onto unwilling participants and that any data collected is protected, The Washington Post reported.

Some of the privacy protections in the legislation include requiring companies to work with public health agencies on apps and obtain explicit consent before tracking a user's location. It would also keep collected data from being used for commercial purposes, and would give the government more power to penalize breaches of privacy and security.

Efforts into researching and developing digital contact tracing have boomed during the global health crisis. In May, Apple and Google launched a developer framework that public health agencies can use to build apps that track the spread of COVID-19.

The Apple-Google API already does away with many of the concerns listed by Cantwell. It's exclusively opt in, stores user data in a decentralized manner and doesn't collect personally identifiable information or location data. Similarly, only vetted health authorities can build apps using the platform.

As of publication time, no U.S. state has released an app using the Apple-Google API, however. Several states, including Alabama, North Dakota and South Carolina, have signaled that they are exploring solutions built using the framework.

Other contact tracing platforms have fewer privacy protections in place. Utah's proprietary solution, developed by a social media company, collects GPS, location and Bluetooth data to track virus spread.

The bill does appear to at least partly aimed at employer-created contact tracing technology, specifically to address concerns that workers may be forced into installing tracking software onto their personal devices. Businesses would be barred from discriminating against employees who don't participate.

The Post points out that public confidence in contact tracing is low, with nearly half of Americans saying that they're unlikely to use it. Experts maintain that contact tracing apps will rely on a significant portion of the population using them to be effective.