An evaluation of privacy policies used in digital contact tracing apps for COVID-19

Background: After coronavirus disease 2019 (COVID-19) spread across the globe, quarantine regulations were supplemented by digital contact tracing initiatives in the form of mobile applications and other surveillance. This paper examines digital contact tracing on a global scale using English privacy policy information from mobile digital contact tracing applications (DCTAs) compared to guidelines on digital proximity tracing from the World Health Organization (WHO) published in May 2020. Methods: Based on the WHO guidelines, six criteria were created to evaluate the ethical development of DCTAs using privacy policies: data deletion, geolocation turned off, time limitation, third parties sharing off, non-commercialization of data, Internet Protocol address (IP) or Unique Device Identifier (UDID) removed. Each criterion was answered by yes, no, or not mentioned to determine compliance with WHO guidelines. Results: The most respected criterion was the non-commercialization of data, where more than 85% of the applications specified not using the data for commercial purposes. A unique difference was the tracking of geolocation, where 66.7% of applications use Bluetooth while 21.4% rely on geolocation collection. A concern arose from 45.2% of applications not mentioning whether an individual's identifier like IP and UDID would be collected or not. On top of this, privacy policies that satisfy the least respected WHO criterion are more likely to satisfy other WHO criteria, and those that failed the least respected criteria are more likely to fail in other criteria. Conclusions: The results of this paper suggest that tracking of geolocation is the area that has the largest area for improvement in privacy policy development. To protect the privacy of an individual, following the WHO regulations worldwide is recommended and being transparent on the privacy policies by addressing all information in the criteria is essential. In the case of the COVID-19 pandemic, the regulations encourage the use of QR codes and Bluetooth in digital contact tracing since they minimize geolocation tracking, although sharing of data with third parties is another concern as it is up to the discretion of the developer with no current international body regulation.