Even though North Dakota’s new COVID-19 contact-tracing app, Care19, promises to keep users’ data confidential, the app is actually transmitting some users’ location data to Foursquare, according
to a report by privacy company Jumbo.

App developer ProudCloud confirmed the
location-sharing to The Washington Post. The company reportedly said it will revise the
app’s privacy policy, and will share less data in the future.

A Foursquare spokesperson added to the Post that the company sheds the data without using it.

Jumbo also reports that even
though Care19 says it identifies data by an “anonymous” code, the app combines that code with advertising identifiers when transmitting it to Foursquare.

“Sharing what is
supposed to be an anonymous code along with an Advertising Identifier (referred to as IDFA) has serious privacy risks,” Jumbo writes. “An IDFA is an identifier that is shared across all
apps on your phone, and often leaked by third-party [software development kits], along with personal information.”

The ad industry has argued that advertising identifiers — typically
alphanumeric strings — are “pseudonymous,” but privacy advocates often argue that the identifiers can be combined with other data to piece together people’s names.

Care19 is one
of the first contact-tracing apps that aims to stem the spread of COVID-19.

Google and Apple are developing a separate system, designed to work in conjunction with public health apps. The
companies have said that system will be voluntary, and won’t collect data from users — though people who test positive reportedly will be able to upload information to the cloud.