
Privacy Review: North Dakota's Contact Tracing App 'Care19' leaks data to Google - aspenmayer
https://blog.jumboprivacy.com/jumbo-privacy-review-north-dakota-s-contact-tracing-app.html
======
aspenmayer
tl;dr: The Care19 app [1] leaks advertising ID and/or location data to
Foursquare and Google [2]

'The Care19 privacy policy indicates that “Your data is identified by an
anonymous code.” We were able to validate that the app, indeed, uses an
anonymous code (in the format of US-84825167-5 or something similar). However,
our research has found that the anonymous code was transmitted to:

'Foursquare, along with the phone’s Advertising Identifier.

'Bugfender, along with the phone’s Name (probably including your first name)'

'Our research also shows that Google (via Firebase) also receives the IDFA.'

[1]
[https://ndresponse.gov/covid-19-resources/care19](https://ndresponse.gov/covid-19-resources/care19)

In the news:

[https://www.fastcompany.com/90508044/north-dakotas-
covid-19-...](https://www.fastcompany.com/90508044/north-dakotas-covid-19-app-
has-been-sending-data-to-foursquare-and-google)

Original title lacked context. It was:

Jumbo Privacy Review: North Dakota's Contact Tracing App

