COVID-19 digital contact tracing worked — heed the lessons for future pandemics

During the first year of the COVID-19 pandemic, around 50 countries deployed digital contact tracing. When someone tested positive for SARS-CoV-2, anyone who had been in close proximity to that person (usually for 15 minutes or more) would be notified as long as both individuals had installed the contact-tracing app on their devices.

Digital contact tracing received much media attention, and much criticism, in that first year. Many worried that the technology provided a way for governments and technology companies to have even more control over people’s lives than they already do. Others dismissed the apps as a failure, after public-health authorities hit problems in deploying them.

Three years on, the data tell a different story.

The United Kingdom successfully integrated a digital contact-tracing app with other public-health programmes and interventions, and collected data to assess the app’s effectiveness. Several analyses now show that, even with the challenges of introducing a new technology during an emergency, and despite relatively low uptake, the app saved thousands of lives. It has also become clearer that many of the problems encountered elsewhere were not to do with the technology itself, but with integrating a twenty-first-century technology into what are largely twentieth-century public-health infrastructures.

The past, present and future of digital contact tracing

Today, national and international health authorities are not investing in digital contact tracing. Nor are they including it in pandemic-preparedness plans (see, for example, go.nature.com/434gvja). Even the announcement of a major digital health initiative, launched by the World Health Organization (WHO) and the European Commission last month to “protect citizens across the world from on-going and future health threats” failed to mention it (see go.nature.com/3ckypcg). This misses a crucial opportunity to prevent future outbreaks from escalating into pandemics.

To harness this potentially transformative tool in future, policymakers and other stakeholders must heed the evidence — and the lessons — now emerging from its use during the COVID-19 pandemic.

Privacy, please

In March 2020, it became clear that the speed of SARS-CoV-2 transmission would outpace conventional contact tracing¹, which generally involves public-health workers interviewing people known to have contracted the virus and then reaching out to identified contacts to ask them to get tested or go into quarantine. Stuck at home, scientists and engineers worldwide — myself included — began to collaborate remotely on how to implement digital contact tracing at scale.

At the time, health authorities in many countries were envisioning a centralized system. Many of the people I spoke to argued that having a database under government control would be crucial to ascertain whether the approach was working, and to improving it. They often seemed unaware of the potential privacy implications of a centralized database. (These became clearer later, for instance, when the Singapore authorities admitted that data from a centralized digital contact-tracing system, called TraceTogether, could also be accessed by the police, contrary to previous assurances.) In the media, too, a narrative seemed to be emerging that in the face of a historic pandemic, privacy concerns would have to take a back seat.

To some of us, however, the perceived conflict between curbing the disease and protecting privacy was a mirage. We set out to develop a decentralized system that would notify people of whether they had been exposed to COVID-19, without letting central actors gather massive databases of highly sensitive information. One of these systems was the DP3T protocol², which I helped to develop at the Swiss Federal Institute of Technology in Lausanne (EPFL), along with engineers, computer scientists and legal experts at other universities.

Instead of gathering contact information on central servers, the DP3T protocol, which we made publicly available on GitHub on 3 April 2020, kept it safely on people’s smartphones. Any decision about notifying someone would be made by an app on the phone, rather than a central server. In other words, the protocol ensured that people would get notified without governments having access to information on their contacts³.

Contact-tracing apps help reduce COVID infections, data suggest

On 10 April 2020, Google and Apple, the providers of the world’s two dominant mobile operating systems, announced their release of ‘Exposure Notification’ technology — essentially a variant of the DP3T protocol. Public-health agencies would now be able to incorporate it into their own contact-tracing apps.

At this time, I was having frequent virtual meetings with health officials from many countries, or their scientific advisers. It was clear that Google’s and Apple’s insistence on privacy-preserving contact-tracing apps frustrated governments around the world. At the time, many health authorities planning to roll out digital contact tracing pleaded with the tech giants to reconsider their stance. But eventually, most of them began to deploy the Exposure Notification protocol.

The second wave of COVID-19 hit soon after the apps using this technology were being introduced in mid-2020, in countries such as Switzerland, Germany, Italy and Latvia. Amid a lull in cases beforehand, and mounting media criticism of the apps, public-health authorities struggled to integrate them into their health-care systems — and to convince the public to use them⁴. When COVID-19 surged in the Northern Hemisphere in autumn, digital contact tracing often fell by the wayside while governments focused on health-care provision.

Many countries had already been struggling to keep up with the demand for COVID-19 testing. In countries such as Switzerland and Finland⁵, health authorities now also struggled to keep up with demand for app activation codes. The delays frustrated users and undermined the main purpose of digital contact tracing: to deliver information at speed⁶. Thus, the perception grew globally that the apps were a failure.

Although it is easier, in principle, to assess the effectiveness of digital contact tracing when it is centralized, there are ways to do this for decentralized versions, too^7,8. Instead of relying on centralized data collection, analysts can use questionnaires or approaches such as telemetry to map how many notifications were made and where, how many of these happened on phones that also reported a positive test result and so on. All of this can be done without revealing the identities of the people whose phones were receiving the alerts.

Few countries gathered these data during the chaos of the first year of the pandemic, but the United Kingdom did. A study conducted during the first three months of the UK National Health Service’s (NHS’s) deployment of a decentralized contact-tracing app — the NHS COVID-19 app for England and Wales — showed that the app could trace more than twice as many contacts as could conventional contact tracing⁹. Two analysis methods were used: one using modelling and the other a statistical approach. These estimated that, in just three months, the app prevented 284,000 or 594,000 cases, respectively — despite only 28% of the population in those regions using it. The study also suggested that for every 1% increment in app usage, the number of cases could be reduced by 0.8% and 2.3%, respectively.

The most compelling evidence yet, however, comes from an analysis published earlier this year of the usage and impact of the NHS COVID-19 app in its first year of deployment¹⁰. It found that the app prevented around one million infections and saved more than 9,600 lives in England and Wales between September 2020 and September 2021. And it achieved this even though, on average over the year, only around 25% of the population was using it (see ‘What the data say’).

Invest now

In April this year, the WHO launched an initiative to improve preparedness for pandemics and other emerging threats (see go.nature.com/3nn8rd5). In my view, the WHO should strongly advise countries to adopt privacy-protecting digital contact tracing. The WHO is also well positioned to develop guidance on evaluating digital contact tracing. Such guidance can build on initiatives during the COVID-19 pandemic, such as the ‘indicator framework’¹¹ of the WHO and the European Centre for Disease Control and Prevention, which provides countries with a standardized approach for this evaluation.

The WHO is not yet a leading actor in digital health, and a separate organization should be created to focus on further developing digital contact-tracing technology, in collaboration with the companies that control mobile operating systems. A diversity of players would need to be involved — specialists in epidemiology, privacy, psychology, the design of user-friendly interfaces and so on. The fruits of any software development would need to be publicly available, and all agreements between stakeholders would need to be transparent. Such openness (which was achieved during the COVID-19 pandemic) is crucial to winning public trust.

Why many countries failed at COVID contact-tracing — but some got it right

In the longer term, a better solution would be to produce a protocol that is tied neither to a particular technology company, nor to a pre-existing device. Any future solution needs to combine affordability and platform independence. As an example, low-cost wristbands equipped with ultra-wideband technology could, in a future outbreak, act as standalone contact-tracing devices alongside whatever high-end devices are widespread.

Health authorities must prioritize privacy-preserving digital contact tracing, and governments must commit to long-term investments in this area. But it is just as important that public-health systems become more digitally savvy. In the United Kingdom, people could book COVID-19 tests, receive the results and get notifications about potential exposure, all in the NHS COVID-19 app. And the NHS regularly updated the software to improve the efficacy of digital contact tracing over time¹⁰.

People’s scepticism about the effectiveness — and trustworthiness — of digital contact tracing is understandable, particularly given that it was rolled out at scale during fraught times. But the science showing just how effective privacy-preserving contact tracing could be in a future outbreak must not be ignored.