A number of Android phone users over the past weekend reported that a COVID-19 notifications system was automatically installed on their phones without warning or consent. Google, in a statement to several news outlets, did not confirm or deny whether the “automatically distributed” system was installed without users’ consent while noting that “COVID-19 Exposure Notifications are enabled only if a user proactively turns it on.”
“We have been working with the Massachusetts Department of Public Health to allow users to activate the Exposure Notifications System directly from their Android phone settings,” the tech giant said in a statement. “This functionality is built into the device settings and is automatically distributed by the Google Play Store, so users don’t have to download a separate app. COVID-19 Exposure Notifications are enabled only if a user proactively turns it on. Users decide whether to enable this functionality and whether to share information through the system to help warn others of possible exposure.”
It came after numerous users in Massachusetts claimed on Reddit, Hacker News, and in Google’s app reviews that the service was installed without them knowing.
In a 1-star review, one user wrote on Google Play that they “absolutely did not install this on my phone” and said it was “silently installed without any notification.”
Exposure Notifications “doesn’t have an app icon … you have to go through settings and view all apps,” according to the user. “This is a huge privacy and security overstep by [Gov. Charlie Baker] & Google.”
One woman described the program as “spyware,” alleged it “seems to want to track my location,” and noted that it uses Bluetooth.
“It’s pure madness that Play Services comes with this sort of backdoor. This is clearly what I would consider a deliberate … vulnerability,” opined one user on Hacker News.
There were also reports that another app called MassNotify was installed without users’ consent. MassNotify appears to be different than Massachusetts’ COVID-19 Exposure Notifications system.
Reports have noted that the Exposure Notifications program resides in the Android system Settings menu. Users can access it by going to Settings, then Google, then accessing the COVID-19 Exposure Notifications, where one can turn on tracking or report having COVID-19.