Massachusetts Violates Consumer Consent

Government + Technology Companies = Trouble. 

A recent lawsuit reveals the problems that arise from the unholy union between technology firms and government actors. The most recent kerfuffle involves an unconstitutional scheme between Google and the Massachusetts Department of Public Health to automatically download a COVID-19 tracking app onto Android users’ phones without their consent.

This lawsuit comes on the heels of Google’s $391.5 million settlement with forty states in a lawsuit alleging the tech giant continued to gather location data even after users opted out of tracking. However, the most recent lawsuit shows private companies are not the only parties alleged to have engaged in the secret gathering of location data. 

Last Month, Robert Wright, a resident of South Dakota who works in Massachusetts, became one of two named plaintiffs in this class-action lawsuit, filed by the New Civil Liberties Alliance.

Wright’s attorney, Sheng Li, said the application in question was developed by the Massachusetts Department of Public Health (DPH) using an interface developed by Google. Li said that, once downloaded, the app “uses your Bluetooth signals to develop a record of everything and everywhere and everyone you’ve been in close proximity with.”

Li argues the DPH violated his client’s property and privacy rights. 

First, secretly downloading an application onto a user’s phone violates the individual’s property rights by taking up storage space on the phone and gathering an unknown amount of data while on the user’s device. Second, this government program violated Fourth Amendment privacy rights by working with Google to automatically download an application without user consent.

Indeed, because the software downloads on individual phones without the user’s knowledge or consent, it amounts to a form of spyware under the Congressional Research Service’s definition of the term. In a written statement, Google confirmed it worked with Massachusetts DPH to “automatically distribute” DPH’s application to Android phones.

Li described this statement as a “smoking gun” in his lawsuit against the state of Massachusetts because it removes any ambiguity regarding whether the application is controlled by the state and whether it was intended to download on user devices without their knowledge.

Because the app appeared to download on devices based on location data, it is unclear how many Android users were impacted by Massachusetts DPH actions. The lawsuit estimates over one million devices were compromised. Future discovery in the lawsuit could shed light on the breadth of consumer impact.

Wright said he discovered the state’s COVID-19 tracking app was downloaded on his phone without his knowledge in January 2021, not long after taking a job located in the state of Massachusetts. 

He was frustrated that possible benefits of this COVID-19 tracking application were not presented to individuals as a consumer choice. Instead, the application was installed on phones without user consent. Wright said learning of the presence of the app on his phone was violating because “there is no justification for intruding on my privacy by surreptitiously adding an app onto my phone.”

Wright said he hopes this lawsuit will prevent governments from engaging in schemes to track individuals through their digital devices. He sees filing suit as a way to “restore some constitutional checks” on overreaching government action that undermines public consent.

This lawsuit serves as yet another example of the problems that can arise when government and technology companies work together to advance government aims without public input. Android users should not have to be concerned that their phones may be subject to applications downloading to their device without their consent. 

Instead, Americans should be in full control of how their smartphones are used. Government attempts to control digital devices, no matter how well intentioned, violate constitutional protections and should be immediately remedied through the judicial process.

Civil libertarians and those who value individual rights must continue to monitor this case and any similar infringements on the individual right to privacy in digital property.