He finds data collection and Google frameworks in many iOS COVID-19 apps.

One byproduct of mobile-era internet has been the private sector — especially Apple, Google and to a lesser degree Facebook and the carriers — taking over tasks that were formerly province of the public-sector.

The COVID-19 pandemic has accelerated this trend, bringing health authorities, nonprofits and enterprising people to focus on the pandemic — and on our phones as gateways to our attention.

Jonathan Albright looked into the iOS application permissions requested by hundreds of iOS apps used for COVID-19 information and contact tracing. He found lots and lots of Google libraries.

By examining the entitlements and embedded SDKs used by almost 500 iOS apps, Albright found widespread use of device permissions that could be used for data collection, and also many analytics and performance reporting APIs. Some apps use the privacy-preserving Exposure Notifications API developed by Apple and Google. Others might rely on Google datastore libraries or Facebook analytics — or even ad or location-tracking libraries. About half of these apps use at least one Google SDK.

Perhaps the prominence of frameworks should be no surprise given the economic realities of contemporary iOS development. But he points out that this degree of centralized and private data collection is new for public health communication.

I simply do not remember a time when global public communication channels have been so codified and platformitized. By this, I mean that 2020 marks the stage—quite literally—when hundreds of public health agencies and government communication channels simultaneously collapsed their efforts into exactly two tightly controlled commercial marketplaces: Apple’s iOS and Google’s Play stores.

Not to mention the code infrastructure (SDKs) for at least half of these iOS apps has been built by one of the companies (Google). And of course the Bluetooth exposure notification system that governments around the world use—98 of them so far—has been conceived, built, and distributed by the same two companies.

— Jonathan Albright, The Pandemic App Ecosystem: Investigating 493 Covid-Related iOS Apps across 98 Countries

All of this is impressive legwork, and he’s released his research in a tableau visualization that can be filtered in various ways.