Accuracy, Incentives, Honesty: Insights from COVID-19 Exposure Notification Apps
The next pandemic response must respect user preferences or risk low adoption
By Elissa M. Redmiles and Oshrat Ayalon
Four years after COVID-19 was first declared a pandemic, policy makers, companies and citizens alike have moved on. The CDC no longer offers separate guidance for COVID-19. Apple and Google have shut down their exposure notification infrastructure, which was used heavily in the US and Europe. As COVID-19 spread, technologists were called to serve by building and deploying exposure notification apps to scale parts of the contact tracing process. These apps allowed users to report when they tested positive for COVID-19 and to notify other users when they had been in the vicinity of an infected user. But getting people to use exposure notification apps during the pandemic proved challenging.
More than three million lives have been lost to COVID-19 over the past four years. Any hope of losing fewer lives during the next pandemic rests on reflection: what did we do, what can we learn from it, and what can we do better next time? Here, we offer five key lessons-learned from research on COVID-19 apps in the US and Europe that can help us prepare for the next pandemic.
Privacy is important, but accuracy also matters
Privacy was the primary focus in early exposure notification apps, and rightfully so. The apps all trace their users’ medical information and movements in various ways, and may store some or all of that information in a central database in order to inform other users of potential infection. The misuse of this information could easily result in unintentional, or even intentional, harm.
However, research into whether (and how) people used exposure notification apps during the pandemic showed that privacy might not be the most important factor. People care about accuracy, or an app’s rate of incorrect reports of COVID-19 exposure (both false positives and false negatives), which may have also influenced rates of public app adoption. Yet, we still know little about how effective the deployed exposure notification apps were. Future apps will need to have measurement tools and methods designed into them before they are released to accurately track their usefulness.
We need to better understand the role of incentives
Researchers discovered that using direct incentives, such as monetary compensation, to get people to install exposure notification apps worked at first, but had little effect in the long term. In fact, one field study found that people who received money were less likely to still be using the app eight months later than those who didn’t. Paying people to download a contact tracing app is even less effective when the app is perceived to be bad quality or inaccurate. However, monetary incentives may be able to “compensate” when the app is perceived to be costly in other ways, such as eating up mobile data.
Given the ethical problems and lack of success with direct incentives, focusing on indirect incentives, such as functionality, may be key to increasing adoption. Exposure notification apps have the potential to serve a greater purpose during pandemics than merely exposure notification. Our research found that people using exposure notification apps wanted them to serve as a “one-stop-shop” for quick receipt of test results, information on the state of public health in their region, and assistance finding testing centers.
Future app design needs to examine user wants and expectations to ensure widespread adoption. This is hardly a new concept — every successful “fun” app begins with this user-centered model. Apps that provide these extra benefits to users will not only be better adopted, they will also see more frequent and prolonged use.
…Over a third of the Coronalert app users we interviewed believed that it tracked their location, despite repeated communications over the course of a year that it used proximity rather than location to detect possible exposures.
Honesty is the most effective communication strategy
Exposure notification apps are often framed to the public as having inherent individual benefits: if you use this app, you’ll be able to tell when you’ve been exposed to a disease. In reality, exposure notification apps have a stronger collective benefit of preventing the overall spread of disease in communities. Being honest with potential users about the true benefits is more effective than playing up the less significant individual benefit. When examining how to best advertise Louisiana’s exposure notification app, we found that people were most receptive to the app when its collectivistic benefits were centered.
Honesty and openness in privacy is also essential, especially when it comes to data collection and storage. Despite this transparency, however, people may still make assumptions based on false preconceptions or logic. For example, over a third of the Coronalert app users we interviewed believed that it tracked their location, despite repeated communications over the course of a year that it used proximity rather than location to detect possible exposures.
Integration with existing health systems is essential
There was a disconnect between COVID-19 exposure notification apps and public healthcare systems, even in countries with universal healthcare and government-supported apps. Belgium’s Coronalert app, for example, allowed users to receive their test results faster by linking their test to their app using a unique code. But, testing center staff were not trained on the app and failed to prompt users for that code. Not only was receiving test results a primary motivator in getting people to use the app; failing to link positive results to specific app users reduced the app’s efficacy.
This disconnect may be far greater in countries without universal healthcare or where exposure notification apps are privately created. In order for these apps to be effective, developers must collaborate with public health workers to develop a shared understanding of how testing centers operate, determine the information needed to provide accurate tracking, and decide on the best way to follow up on potential infections.
Resourcing technical capacity is critical
A wide range of exposure notification apps were developed to combat COVID-19, and by many different organizations. In the absence of immediate government action, many of the earliest efforts were led by universities or volunteer efforts. Academics developed the DP3T proximity tracing protocol, which guided Google and Apple’s development of exposure notification infrastructure for Android and iOS phones.
However, privatization of exposure notification infrastructure created an enormous potential for private medical and other information to fall into the hands of corporations who are in the business of big data. It also subjected exposure notification technology to private company’s rules (and whims).
Google and Apple released exposure notification infrastructure in April 2020 but did not release direct-to-user exposure notification functionality until later in the pandemic. This decision left the development of exposure notification apps to public health agencies that lacked the resources and technical capacity to do so. Volunteers stepped in to fill this void. For example, the PathCheck foundation developed exposure notification apps for 7 states and countries on top of the Google-Apple Exposure Notification infrastructure.
“…We need to eliminate these scattered responses, align incentives, and integrate the strengths and perspectives of public, private, and academic bodies to develop protocols, models, and best practices.”
While it is natural for universities to support the public good, and encouraging that private citizens volunteered so much of their time and resources to do so, they should not have to in the next pandemic. To respond to future pandemics, we need to eliminate these scattered responses, align incentives, and integrate the strengths and perspectives of public, private, and academic bodies to develop protocols, models, and best practices.
Applying the lessons learned
Building tech responsibly means not just considering privacy, but providing technology that respects user preferences. When people give up their data, they expect a benefit — be that a collective benefit, such as fighting a pandemic or helping cancer research, or an individual one. They likewise expect utility: apps that are accurate, achieve their goals, and provide an holistic set of features.
If we continue to build tech based on our assumptions of what users want, we risk low adoption of these technologies. And during times of crisis, such as this still-ongoing COVID-19 pandemic, the consequences of low adoption are dire.
Elissa M. Redmiles is a computer scientist specializing in security and privacy for marginalized & vulnerable groups at Georgetown University and Harvard’s Berkman Klein Center.
Oshrat Ayalon is a human-computer interaction researcher focusing on privacy and security at the University of Haifa.
