Exposure Notification: Benefits and Challenges of Smartphone Applications to Augment Contact Tracing

Fast Facts

If you were near a person who later tests positive for an infectious disease, an exposure notification app can let you know. These apps allow for more rapid and broader contact tracing—ideally helping to slow disease spread.

About half of the U.S. states had their own COVID-19 exposure notification apps as of June 2021. A national app wasn't available.

We found 5 challenges related to exposure notification apps, such as privacy concerns and a dearth of evidence showing that the apps are effective. To address challenges, we identified 4 policy options, e.g., collaborating on a national strategy for these apps.

COVID-19 Contact Tracing Mobile Application

Highlights

Why GAO Did This Study

With the emergence and rapid global spread of COVID-19, smartphone apps have been developed to supplement manual contact tracing, which is a public health measure used to slow the spread of infectious disease.
GAO was asked to conduct a technology assessment of exposure notification apps. This report discusses (1) the benefits of exposure notification apps; (2) the current level of deployment in the U.S.; (3) challenges affecting their use; and (4) policy options that may help address these challenges for future use.

To address these objectives, GAO reviewed agency documentation, met with officials from several federal agencies, and conducted a review of technical and policy literature. GAO also interviewed representatives from companies involved in the development of exposure notification apps, public health organizations, federally funded research and development centers, and academic researchers. In addition, GAO analyzed information from a selection of states. GAO is identifying policy options in this report.

GAO received technical comments on a draft of this report from five federal agencies and five organizations included in the review, which it incorporated as appropriate.

What GAO Found

Exposure notification applications (apps)—which determine the proximity of users and notify people who have been in close contact with another user who was likely infectious—are expected to enhance the speed and reach of contact tracing and help slow the spread of infectious diseases such as COVID-19. As of June 2021, almost half (26/56) of U.S. states, territories, and the District of Columbia had deployed an app for COVID-19, all using a system developed jointly by Google and Apple (see figure). In the absence of a national app, states independently launched apps, resulting in a staggered rollout over 10 months beginning in August 2020.

Map of deployment of exposure notification apps by U.S. states and territories, as of June 2021

Reported app development costs for selected states varied, ranging from no cost (provided by a nonprofit organization) to $700,000. Marketing costs for selected states ranged from $380,000 to $3.2 million. Reported app download levels in the selected states ranged from 200,000 to more than 2 million, as of June 2021.

GAO identified several challenges limiting app use and the ability of states and others to determine whether the apps were effective:

Accuracy of measurements	Technical limitations to measuring distance and exposure can result in inaccurate exposure notifications.
Privacy and security concerns	The public may lack confidence that its privacy is being protected, in part, due to a lack of independent privacy and security assessments and a lack of federal legal protections.
Adoption	States have faced challenges attracting public interest in downloading and using an exposure notification app.
Verification code delays	States faced challenges in promptly providing people who tested positive for COVID-19 with a verification code necessary to notify other close contacts of potential exposure using the app.
Evidence of effectiveness	Limited data are available to evaluate the effectiveness of the apps.

Source: GAO. | GAO-21-104622

GAO developed the following four policy options that could help address challenges related to exposure notification apps. The policy options identify possible actions by policymakers, which may include Congress, other elected officials, federal agencies, state and local governments, and industry. See below for details of the policy options and relevant opportunities and considerations.

Policy Options to Help Address Challenges of Exposure Notification Apps for Future Use

	Opportunities	Considerations
Research and Development (report page 41) Policymakers could promote research and development to address technological limitations.	Research on technological limitations could help increase accuracy, encouraging users to download and use the apps. Research on technologies and architectures other than those used by U.S. states could lead to improvements. Partnerships with technology companies could spur innovation and help with integrating improvements.	The research needed may be costly. Improvements may not be cost-effective, since existing apps may already be sufficiently accurate. Research may result in apps that are not functional for the next pandemic, since the current apps were developed for COVID-19.
Privacy and Security Standards and Practices (report page 42) Policymakers could promote uniform privacy and security standards and practices for exposure notification apps.	Uniform standards and best practices could help address real and perceived risks to the public’s data, potentially increasing adoption. Standards developed by a broad coalition of stakeholders could increase the likelihood of stakeholder agreement and buy-in.	Policymakers would need to balance the need for privacy and security with the costs of implementing standards and practices. Implementation of privacy requirements may need to be flexible, since jurisdictions could use different approaches. Standards and practices could be challenging to oversee and enforce.
Best Practices (report page 43) Policymakers could promote best practices for approaches to increasing adoption and to measure the effectiveness of exposure notification apps.	Best practices could help authorities better promote app adoption. Best practices could help state public health authorities by providing information on procedures and potential approaches for distributing verification codes in a timely manner. Best practices could help public health authorities establish a more rigorous way to measure the extent of app use and any resulting improvements in notifying exposed people.	Best practices could require consensus from many public- and private-sector stakeholders, which can be time- and resource-intensive. Current best practices may have limited relevance to a future pandemic. In some cases, stakeholders may lack sufficient information or the experience to develop best practices.
National Strategy (report page 44) Policymakers could collaborate to enhance the pandemic national strategy and promote a coordinated approach to the development and deployment of exposure notification apps.	Enhanced national coordination that builds on the underlying infrastructure and lessons learned from COVID-19 could prompt faster deployment of apps in the future. A future national marketing campaign with cohesive and coherent messaging could result in wider adoption. Policymakers could recommend a national app that public health authorities could decide to use based on their individual needs. A national app could add more functions by integrating exposure notification capabilities with test scheduling and vaccine delivery coordination.	A coordinated national approach would likely have associated costs and require sustained funding during the pandemic. Coordination of groups with divergent perspectives and interests may pose challenges to defining outcomes, measuring performance, and establishing a leadership approach. It is unclear whether potential users would be more or less likely to trust a national exposure notification app than one developed by a state government.

Source: GAO. | GAO-21-104622

For more information, contact Karen L. Howard at (202) 512-6888 or howardk@gao.gov or Vijay A. D’Souza, at (202) 512-6240, dsouzav@gao.gov.

Full Report

Highlights Page (2 pages)

Full Report (63 pages)

Accessible PDF (64 pages)

GAO Contacts

Vijay A. D'Souza

Director

Information Technology and Cybersecurity

dsouzav@gao.gov

Karen Howard

Director

Science, Technology Assessment, and Analytics

howardk@gao.gov

Media Inquiries

Sarah Kaczmarek

Managing Director

Office of Public Affairs

media@gao.gov

Public Inquiries

Topics

Information Technology

Public health emergenciesBest practicesBroadcasting standardsDisease controlGlobal positioning systemHomeland securityInfectious diseasespandemicsPersonally identifiable informationPrivacy protectionResearch and developmentScience and technology