The Massachusetts Department of Public Health partnered with Google and Apple to create a smartphone app called MassNotify, which tracks and traces people, advising users of others’ COVID-19 status.

For a tool that claims to have been developed “with a focus on privacy,”¹ imagine Massachusetts residents’ surprise when the app suddenly appeared on their Android phones out of nowhere. In a review on the Google Play Store, one shocked parent said:²

“This installed silently on my daughter’s phone without consent or notification. She cannot have installed it herself since we use Family Link and we have to approve all app installs.

I have no idea how they pulled this off, but it had to involve either Google, or Samsung, or both. Normal apps can’t just install themselves. I’m not sure what’s going on here, but this doesn’t count as ‘voluntary.’ We need information, and we need it now, folks.” 

The official MassNotify site, operated by the Massachusetts Department of Public Health, makes no mention that the app will automatically show up on residents’ phones without consent, stating only that MassNotify is a “new tool that works through smartphones, with a focus on privacy, to alert users who may have been exposed to COVID-19.”³

Reportedly, the feature must be enabled by the user for it to function, but it’s extremely disconcerting that the tool has been automatically added to people’s phones, whether they intend to use it or not.

Residents Alarmed Over ‘Spyware,’ ‘Government Overreach’

Android phone users were understandably alarmed when MassNotify appeared on their devices. The tool “doesn’t have an app icon,” one person reported on Google Play, “you have to go through settings and view all apps. This is a huge privacy and security overstep by [Gov. Charlie Baker] & Google.”⁴

Other people also described it as “spyware,” while a user on Hacker News wrote, “It’s pure madness that Play Services comes with this sort of backdoor. This is clearly what I would consider a deliberate … vulnerability.”⁵

In China, COVID-19 tracking apps have been used as surveillance tools in collaboration with its social credit system, raising red flags that this force-installed app could be tracking residents’ movements and contacts without their knowledge and consent. Reviews on the Google Play Store poured in from alarmed citizens worried about privacy violations, with comments such as:⁶

• “Automatically installed without consent. It has no icon, no way to open this and see what it even does, which is a huge red flag … I think it’s spyware, phishing as the DPH (Department of Public Health).”

• “Force-installed with no authorization or approval. App is hidden on the device to prevent uninstallation. Government overreach and corporate complicity should never be tolerated.”

• “Unethical breach of privacy and a forceful misappropriation of personal property … The degree to which my data is collected or distributed through it has not been disclosed neither in active nor inactive form … I can only conclude and caution others that it is disclosing your whereabouts and social contacts without permission.”

MassNotify ‘Built Into Device Settings,’ Difficult to Remove

When pressed for comment, Google released a statement to the media, but did not address the glaring issue of how or why the system was force-installed without users’ consent. Instead, they only stated:⁷

“We have been working with the Massachusetts Department of Public Health to allow users to activate the Exposure Notifications System directly from their Android phone settings. 

This functionality is built into the device settings and is automatically distributed by the Google Play Store, so users don’t have to download a separate app. COVID-19 Exposure Notifications are enabled only if a user proactively turns it on. Users decide whether to enable this functionality and whether to share information through the system to help warn others of possible exposure.”

The MassNotify app was released June 15, 2021, marking the 29th state to launch an app using Google and Apple’s Bluetooth-based Exposure Notifications Express program.

The software framework was first released in April 2020,⁸ with the goal of allowing users who test positive for COVID-19 to report their results, which then sends out an alert to anyone whose phone crossed paths with the positive case and may have been exposed. The Exposure Notifications Express program acts as a blueprint from which states can implement their own tracking systems without having to develop their own individual apps.

While other states have required users to download an app to use the system, MassNotify was integrated directly into the operating system of Android phones.⁹ “The contact-tracing feature does not work unless a user manually activates it, but you also can’t get rid of the software,” the Boston Globe reported. “(Meanwhile, Apple added the feature to iPhones months ago, with iOS 13.).”¹⁰