In China’s Hubei province, where COVID hit first and hard, residents carry around QR codes that are scanned each time they attempt to enter a store, their office or take public transportation. When the scan causes their phone to flash the color green, they are permitted entry; red or yellow means they must return home and isolate for up to 14 days.

The codes contain information about a person’s health, namely, whether they are carriers of or have likely been exposed to the virus. When new information is added to the code — such as a temperature reading that is too high, or new exposure to the virus — that information is conveyed to the phones of every person who has crossed their paths and an algorithm that determines their risk turns those screens red or yellow, too, requiring them to return to isolate as well. Authorities are notified if phones move out of quarantined residents’ homes.

Welcome to contact tracing, Wuhan-style. While such surveillance may be perceived as invasive and even impossible in countries without authoritarian regimes (Russia has also released a QR code program), it is given a lot of credit for curbing the transmission of the coronavirus in Wuhan.

Many other countries around the world are now working on versions of contact tracing tuned to work for their populations, with a goal of controlling the spread of COVID. They’re considering a range of methods, from passive, contactless surveillance-state methods like those in Wuhan, to voluntary technologies and even old-fashioned phone-calling, which has been the most common and effective contact-tracing tactic over the past century. None of the strategies are new; change the words “contact tracing” to “location marketing” and even the most seemingly invasive technologies become almost commonplace. The difference is a matter of perception: consumers don’t mind their data used for a targeted ad; but many get nervous when government authority is brought to bear. At the heart of the debate are tradeoffs between privacy, data, and control that have been raging well before the pandemic (read more about COVID’s impact on the “techlash” here).

Contactless surveillance through phones and transactions 

Across Asia, contactless, tech-based forms of contact tracing are a big part of containment. In Hong Kong, residents are required to wear wristbands that ping the government when quarantined individuals leave their home, and trace others who may have been exposed to the virus. Singapore uses a bluetooth-enabled app called TraceTogether that is not mandatory, but is the only such app in the country, and the government has campaigned heavily for widespread adoption. In China, there is also no mandated app installation, but WeChat and AliPay, two of the most widely used apps in that country, have put the QR codes into their software, ensuring widespread reach.

All phones come equipped with tracking technology, and for years, people have been allowing their phones to do just that: In Foursquare’s early days, for example, users were happily allowing the company to automatically broadcast their locations to anyone else who used the app, even if they weren’t in their contacts list. And any iPhone owner is well aware that most apps are tracking their whereabouts unless the location tracking setting is turned off.

There are still other ways of using data to trace individuals without their explicit permission for COVID tracking. In South Korea, the government tracks individuals’ movements through phone networks, credit card transactions and cameras in stores and other public places, then informs the population about confirmed cases.

It may all sound ominous, but both marketers and the US Immigrations and Customs Enforcement alike regularly buy location data for a variety of purposes, without violating any privacy laws. In Israel, cell phone location data is regularly used in counterterrorism; now, it’s also being used to track cases of coronavirus.

Opt-in, tech-based contact tracing

Aware of privacy concerns, many companies involved in developing contact tracing tools have looked for ways to give users control over their data and its usage. Apple and Google, for instance, have developed software focused on anonymized “exposure notification.” The technology is built to be integrated into existing mobile phone apps—one app per country—and it relies on bluetooth and “handshakes” between phones that have the software installed, sending an “exposure notification” generated when a phone comes within range of a confirmed case of COVID or has come within range of them in the past. Users opt in to share their symptoms and diagnosis, their location is never tracked and all data is anonymized. Critics say the technology will fail unless enough people opt in, and even then only if people take action when notified, such as getting tested or isolating. Last month, SwissCovid, in Switzerland, became the first app to use this technology.

Lower-tech text-messaging services have also sprouted up, such as CovidIQ, which uncovered 100,000 cases of COVID in Jacksonville, Florida, in March, as well as identifying the demographics most at risk. CovidIQ works via text messaging opt-in, sending weekly messages that ask recipients if they will answer a series of questions about how they are feeling. After responses are received, the services then sends the individual local statistics as well as information about whether they should seek testing or medical help.

Interview-based contact tracing

Since World War II, contact tracing by phone has been the most effective form of containing the spread of diseases, from syphilis to SARS and Ebola. Trained public health workers interview people, inform them of their potential risk, ask about their symptoms and make recommendations for testing, isolation or other needs they may have in quarantine. They call businesses and people who have interacted with confirmed cases, to inform and search for further people who have been exposed and infected. In this pandemic, an estimated 180,000 jobs are expected to be created by states and cities to handle this type of work.

Despite its historical successes, there are issues with this approach, too. Training and tactics around COVID have varied from state to state, even as outreach crosses state lines. Identifying the right individuals for the job is tricky, too, as the job requires a mix of empathy, persistence, and a certain amount of knowledge about everything from getting tested to the details of surviving the isolation of quarantine. Although this method of contact tracing is seen as the most effective, it doesn’t eliminate issues of privacy and data collection. What’s more, in this day of caller ID and an easy “ignore” button, people are only likely to pick up an unknown caller 6% of the time, according to Pew Research. Could that be an issue? It’s too soon to tell.

—

Whichever the path for contact tracing (and “exposure notification”), the virus has hit at a moment of greater public awareness of privacy and data risks. Countries with authoritarian regimes will have less of a need to take these concerns into account, but even in democracies, residents in areas harder hit by the virus may be more open to contactless tracing. Marketers who use location technologies should take note.