Google is facing a lawsuit after a privacy vulnerability in its contact tracing system left users' data exposed.
Google was alerted in February that users' sensitive data was exposed to third-party apps that were already installed on their mobile devices and that it failed to inform the public, according to the analysis company AppCensus and a report from The Markup. Google told The Verge that it was finding a solution to the privacy flaw.
The lawsuit, filed by two users affected in a US district court in California, is demanding that Google fix the security problem and be held accountable for "damages and restitution."
The Google Apple Exposure Notification System, or GAEN, is a digital contract tracing system developed by Apple and Google designed to use Bluetooth signals to alert users if they had come in contact with someone who has tested positive for COVID-19.
"Because Google's implementation of GAEN allows this sensitive contact tracing data to be placed on a device's system logs and provides dozens or even hundreds of third parties access to these system logs, Google has exposed GAEN participants' private personal and medical information associated with contact tracing, including notifications to Android device users of their potential exposure to COVID-19," the lawsuit reads.
Apple and Google did not immediately respond to Insider's request for comment.
Read more: How Deutsche Bank is using contact tracing to bring its 90,000 employees safely back to work
In May 2020, the technology was made available to public health officials around the world to integrate with government health apps and verify and log a user's contact status. Experts told Insider's Aaron Holmes last April that the system would only be useful if Apple and Google could recruit enough people to use it.
The technology first launched in August as part of a state-wide initiative in Virginia. According to the filing, more than 28 million people across 25 states, as well as Guam and Washington, DC, have used contact tracing apps equipped with Google and Apple's technology or have activated notifications on their phones to alert them if they were exposed.
Contact tracing apps that use the technology run on both Google's Android and Apple's iOS operating systems. The analysis that AppCensus conducted did not find the flaw on iPhones running the software, according to The Verge.
