Massachusetts Dept. of Public Health Secretly Installed COVID-19 Contact-Tracing Apps on Android Devices, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

The Massachusetts Department of Public Health (DPH) faces a proposed class action after allegedly installing a contact-tracing app on more than one million Android users’ smartphones without their knowledge or consent while the program was still in effect. 

The 35-page lawsuit claims the Massachusetts DPH and State Commissioner of Public Health Margret R. Cooke have “brazen[ly]” disregarded consumers’ civil liberties in their “unconstitutional” efforts to boost adoption of the state’s contact-tracing app, which was developed with the help of Google and phased out last December. The suit says that when some Android users, including those who live or work in or simply traveled through Massachusetts, discovered and subsequently deleted the app—which causes a device to constantly connect and exchange information with other nearby devices via Bluetooth, creating a record of other such connections—the Massachusetts DPH would re-install it. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

According to the complaint, the Massachusetts DPH’s installation of its contact-tracing app on Android users’ phones without their knowledge or permission, which allegedly began around June 15, 2021, amounts to a computer crime under federal and state law. 

“Upon information and belief, DPH and Google developed the revised [MassNotify v.3] App in order to overcome Android users’ low rate of voluntary adoption of the initial App,” the filing reads. “According to the Google Play Store, DPH’s Contact Tracing App was installed onto over one million Android [devices]. On information and belief, the overwhelming majority of these installs were surreptitious.” 

The lawsuit adds that because the contact tracing app did not appear on a device’s home screen, many consumers “remain[ed] unaware of its presence,” and even those who discovered the app in their settings sometimes had trouble uninstalling it, per the case. 

If a user opted into the system and reported being infected with COVID-19, an exposure notification was sent to other individuals on the person’s connection record, the case says. Even if a user did not opt in, the DPH’s contact-tracing app still caused a mobile device to broadcast and receive Bluetooth signals, resulting in data exchanges with nearby devices, the lawsuit relays. 

“The exchanged data, both random and non-random, are time-stamped and stored in each device alongside other personal identifiers, including the device owner’s MAC address, wireless network IP addresses, phone numbers, and personal emails. When this stored data is written onto mobile devices’ system logs, it becomes available to DPH, Google, application developers, device manufacturers, network providers, and other third parties with access to the logs. DPH and third parties can use the MAC address of a device owner and other personal identifiers to trace the logged data back to determine the individual identity of the owners.” 

The filing claims that although at least two dozen other states have developed contact-tracing apps using Google’s API and engaged in community outreach to encourage residents to voluntarily download and use the apps, Massachusetts was the only one to secretly install the app on consumers’ mobile devices without their knowledge or consent. The case argues that the app installations not only invade consumers’ reasonable expectation of privacy but also intrude upon smartphone users’ property rights by taking up valuable storage space. 

“In sum, DPH installed spyware that deliberately tracks and records movement and personal contacts onto over a million mobile devices without their owners’ permission and awareness,” the lawsuit alleges. “On knowledge and belief, that spyware still exists on the overwhelming majority of the devices on which it was installed.” 

The suit summarizes that although contact tracing was widely used and believed to be effective during the early stage of the pandemic, by 2021 there was enough evidence to indicate that it was largely ineffective at slowing transmission of the virus and improving public health. The “perceived efficacy” of contact tracing was “further undermined” by the availability of vaccines and newer, highly infectious COVID-19 variants, the case adds. 

In December 2021, Massachusetts shuttered its contact-tracing program, in part due to its expense and ineffectiveness, the lawsuit states.  

The case aims to represent all persons in the United States on whose smartphones or mobile devices the Massachusetts DPH, working with Google, installed its contact-tracing app without the device owner’s permission. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.