Covid-19 tracking apps and the behavioural battle between health and privacy
European countries continue to roll out Covid-19 tracking apps. It's argued that, if used effectively, they could slow down the spread of the coronavirus. But how ready are we to share our data for the benefit of public health? And how worried should we be about privacy? The tradeoff might not be so rational
Would you be willing to install a corona tracking app? 53% of German smartphone users over 16 reported they would, some 28 million people. Now, eight weeks after the launch of the Corona-Warn-App, 16.6 million Germans have downloaded it, a lot less than the number who said they would. So what can explain the apparent gap between people’s intentions and behaviours?
What explains the gap between intentions and behaviours?
We see the same mismatch between intentions and actions when it comes to people’s privacy, both in the debate around Covid-19 apps and elsewhere. People generally consider their privacy to be important and worth protecting. However, when the benefits of information disclosure seem to outweigh the potential risks, many happily give up on our privacy concerns. This is also called the “privacy paradox”: we say we care about our personal data, but if there is an opportunity, we trade it for something that we think will benefit us.
We already share our location in return for navigation instructions, and let Spotify, for example, create playlists recommended just for the user. The tradeoff between privacy concerns and the benefits of sharing information is also a known phenomenon in the financial domain. We easily tell our bank how much we earn and have in savings for the best mortgage advice, but are hesitant to do so for simple money management tools. So what factors determine whether we also share our data with these tracing apps in return for a slowdown of the coronavirus?
Before we look at the learnings from behavioural science and privacy dilemmas in other domains, we need to understand how a Covid-19 app actually works.
What data do we actually share?
Most of the coronavirus tracking apps being developed in Europe use Bluetooth to track and trace people with whom an infected person has been in closed contact. In contrast to common belief, and with the exception of Norway’s halted Smittestopp app, they do not track people’s location. The German Corona-Warn-App, for example, exchanges anonymised and randomly generated Bluetooth-ID numbers with nearby phones, a Bluetooth handshake if you will. Once a user reports symptoms or a positive test, the app sends notifications to phones they have been near.
A Bluetooth handshake
Many of these Bluetooth apps, however, are built onto a joint system from Google and Apple that allows the Bluetooth signals from Android and IOS to communicate with each other. If the app were to be actively used by enough people, it could reduce the coronavirus’ reproduction number from three (during outbreaks) to below one. Sounds promising, doesn’t it?
Engagement is key
For the apps to have an impact, people need to do more than just downloading it. Users need to turn on Bluetooth and take their phones everywhere they go. At the same time, they have to give consent for the exchange of data between their phones and those around them. Given that many people in Europe and Germany in particular, are protective of their data, this step may already be more challenging than it sounds. People also need to actively and honestly report coronavirus-related symptoms or a positive test. And, perhaps most importantly, they must follow the instructions from the app to go into quarantine.
To share or not to share
When we look at the barriers and motivations for people to share, or not, their data, we know that at least three factors play an important role, regardless of the type of data concerned.
- First, people need to trust the organisation that collects and monitors the data.
- Second, the organisation collecting the data must be transparent about how the data is being handled and used.
- Third, people need to feel they are in control of their data in order to feel comfortable disclosing personal information.
It is important for people to know whether their data is in safe hands, but also who benefits from the information. Is it the companies with whom they have a primary relationship or third parties to which data is being sold? Or are the people sharing the data the main beneficiaries, for example, when receiving online healthcare advice based on reported symptoms?
Interestingly, the extent to which people understand how organisations handle their data is known to depend on how strongly data privacy is regulated in a country. In Belgium and Germany, less than 20% have a good comprehension of what companies do with their data, compared with more than 45% in China. Attitudes towards data sharing thus also depend on regional differences.
A behavioural science view
Even if all of the above criteria have been met, people find it difficult to weigh the potential risks of data sharing against the expected benefits for society. They are bound by cognitive limitations and rely on heuristics instead.
For example, individuals have difficulty calculating how valuable their data is, and therefore also the value of protecting it. Furthermore, people are subject to immediate gratification bias. This means that they tend to value the present benefits of information disclosure more than the potential privacy risks in the future.
On top of that, the sooner people experience the present benefits (today rather than tomorrow), the more they perceive these benefits to be higher and risks to be lower. This is referred to as benefit immediacy. In other words, the sooner the benefit, the more we perceive the risk of data sharing to be worth it. Think of accepting cookies on a website; you can access the website immediately afterwards. Since the benefits of data sharing via the Covid-19 app are only visible after a while - when the spread of coronavirus slows down - the bias for immediate benefits could be an additional barrier for people to start using the app.
Doing it for them
Clearly, there are many factors which influence whether coronavirus apps will be adopted and whether we will give Bluetooth handshakes the benefit of the doubt. And with good reason, so long as we know little about what type of data is being collected, by whom, and how our privacy is protected.
The power of others
But if we are open to trying a new app, we may only need one more thing to change intentions into behaviour: the power of others. While we are used to weighing privacy risks against the benefits for ourselves (e.g., with financial apps), as far as coronavirus apps are concerned, the benefits lie in the health of the people around us – friends, family, neighbours, and so on. Emphasising the benefits for society, and the social norm to care about others could stimulate people to start using the app. After all, if there is one example that shows individuals are prepared to sacrifice a little bit of themselves for the health of others, let’s remember the global lockdowns and hope we can prevent more in the future.
"THINK Outside" is a collection of specially commissioned content from third-party sources, such as economic think-tanks and academic institutions, that ING deems reliable and from non-research departments within ING. ING Bank N.V. ("ING") uses these sources to expand the range of opinions you can find on the THINK website. Some of these sources are not the property of or managed by ING, and therefore ING cannot always guarantee the correctness, completeness, actuality and quality of such sources, nor the availability at any given time of the data and information provided, and ING cannot accept any liability in this respect, insofar as this is permissible pursuant to the applicable laws and regulations.
This publication does not necessarily reflect the ING house view. This publication has been prepared solely for information purposes without regard to any particular user's investment objectives, financial situation, or means. The information in the publication is not an investment recommendation and it is not investment, legal or tax advice or an offer or solicitation to purchase or sell any financial instrument. Reasonable care has been taken to ensure that this publication is not untrue or misleading when published, but ING does not represent that it is accurate or complete. ING does not accept any liability for any direct, indirect or consequential loss arising from any use of this publication. Unless otherwise stated, any views, forecasts, or estimates are solely those of the author(s), as of the date of the publication and are subject to change without notice.
The distribution of this publication may be restricted by law or regulation in different jurisdictions and persons into whose possession this publication comes should inform themselves about, and observe, such restrictions.
Copyright and database rights protection exists in this report and it may not be reproduced, distributed or published by any person for any purpose without the prior express consent of ING. All rights are reserved.
ING Bank N.V. is authorised by the Dutch Central Bank and supervised by the European Central Bank (ECB), the Dutch Central Bank (DNB) and the Dutch Authority for the Financial Markets (AFM). ING Bank N.V. is incorporated in the Netherlands (Trade Register no. 33031431 Amsterdam).