A viral chain message spreading across Facebook urges friends to “please delete me and my family from your phone contact list and Facebook BEFORE installing this app on your smartphone.” It's in regards to a pair of apps aimed at contact tracing amid the coronavirus pandemic.
The message claims that if you install the “Healthy Together” or “ABTrace Together” app, “your contacts will be known as well as your contacts’ contacts. This will all be done without prior consent or knowledge, so please count me out!”
The main concern in these messages is that the apps will automatically read the user’s contacts and track them.
But that’s a misrepresentation of what the apps do.
THE QUESTION
Will the contact tracing apps ABTraceTogether and Healthy Together automatically have access to your contacts and track them?
THE ANSWER
No. While you can choose to share your contacts if you’d like, sharing that information is not required to use the app and none of the apps use your Facebook contact information.
The two apps specifically mentioned in these chain messages can only be used by residents of their respective region. So if you don’t live in Utah or Alberta, Canada, you can ignore the apps and the chain messages about them.
WHAT WE FOUND
Both apps were worked on by or in partnership with state-level governments. ABTraceTogether was developed by the government of Alberta in Canada. Healthy Together was worked on by a company called Twenty Labs in partnership with the state of Utah. ABTraceTogether doesn’t appear to be available for download in the United States. Healthy Together can be downloaded by anyone, but you’re not going to get the full functionality of the app unless you’re in Utah.
So there’s not much of a reason for anyone outside of Alberta or Utah to download these apps in the first place. But even if you or someone you know does use one of these apps, it won’t do what the claims say.
All apps on the Google Play store must show the permissions the app will require on the store page. The ABTraceTogether app has no permissions requesting access to your phone contacts or Facebook contacts. That’s enough to show the claims regarding ABTraceTogether are false.
Healthy Together does request permission to read your phone’s contacts. However, you don’t necessarily have to grant it that permission. If you download the app on your phone and go through the registration process, it will ask you if you want to share your contacts with the app. If you say no, you can still use the app as normal.
On the second page of the app’s privacy policy, they say they ask for your contacts list so they can store the names and phone numbers of contacts to enable you to invite contacts to the app. If you don’t want them to have that information, you can simply say no and continue using the app. The VERIFY team tried this on both the iOS and Android versions of the app and were able to tell the app not to access contacts as it was setup.
It’s also worth noting that the app does not have any permissions to access your Facebook contacts.
Apple and Google have worked on contact tracing apps themselves that people in the rest of the United States can use. Their app doesn’t access your contacts either.
The app, which later will become a part of the operating systems of iPhones and Androids, uses anonymous Bluetooth data to see what devices have been near each other. But they don’t access any of the personal information on that device.
The CDC has a section on contact tracing on its website where it explains the usage of digital tools like smartphones to let people know if they have been in contact with an infected person.