Kansas AG urges Apple, Google to crack down on contact tracing apps

Jonathan Riley
Kansas has prohibited mobile apps for coronavirus "contact tracing" from using cellphone location tracking data. --

PITTSBURG, Kan. — Kansas Attorney General Derek Schmidt joined dozens of other state attorneys general this week in sending a letter to Apple and Google to urge the tech giants to do more to ensure that coronavirus “contact tracing” mobile applications on their platforms sufficiently protect the privacy of consumers’ personal information.

“Digital contact tracing may provide a valuable tool to understand the spread of COVID-19 and assist the public health response to the pandemic,” the letter stated. “However, such technology also poses a risk to consumers’ personally identifiable information, including sensitive health information, that could continue long after the present public health emergency ends.”

Specific measures the letter asked the tech companies to take included verification “that every app labeled or marketed as related to contact tracing, COVID-19 contact tracing, or coronavirus contact tracing or exposure notification is affiliated with a municipal, county, state or federal public health authority, or a hospital or university in the U.S. that is working with such public health authorities,” and that any app not meeting that requirement be removed from Apple and Google’s mobile app store platforms.

Last month, a local company working on a contact tracing app in coordination with the City of Pittsburg and Pittsburg State University also secured a letter of support from the Crawford County Commission.

John Kuefler, co-owner of the local software development company DevSquared, which created the “Check-in Crawford County” app, said at the time that while he wanted use of the app to be strictly voluntary, he could not necessarily control what, for example, PSU administration might require of its students in terms of contact tracing.

Earlier this month, however, following Attorney General Schmidt’s recommendation, Gov. Laura Kelly signed the COVID-19 Contact Tracing Privacy Act, which requires contact tracing to be voluntary, rather than something that can be mandated by an entity such as a local government, education institution or employer.

The new contact tracing law also prohibited use of cell phone location tracking in contact tracing, apparently throwing a wrench into DevSquared’s plans for Check-in Crawford County, which aimed to collect GPS location data of users once they had scanned a QR code to check in at a location such as a business they were visiting, a classroom, or their workplace.

“One new provision of Kansas law prohibits state and local governments from using contact tracing apps and similar means of electronic tracking citizens' movements and associations,” Schmidt’s office noted in a press release about the letter sent to Apple and Google this week. “Thus, no contact tracing app currently available for download to cellphones is lawfully affiliated with any government health authority in Kansas.”

Mandatory contact tracing, which was briefly attempted in Linn County, was a “losing proposition in both the courts and the court of public opinion,” the Kansas City Star editorial board wrote last week.

Kuefler said last month that he expected more people would use DevSquared’s contact tracing app if it was voluntary than if it was required, and Schmidt has echoed that position.

“The way you get the participation is to assure people that they’re not being ordered by the government to divulge this data, but they’re doing it voluntarily for a good cause,” Schmidt told the Star. “I think the only way contact tracing can work is if it’s voluntary. And I think the way you get people to participate in a voluntary system is to give them confidence that they can participate safely, securely and privately.”