The great post-Covid privacy creep

San Francisco’s Moscone Center is best-known as the site where tech companies stage blockbuster events. It was here in 2007 that Steve Jobs unveiled the original iPhone with the words, “Every once in a while, a revolutionary product comes along that changes everything.”

I used to be a regular visitor to Moscone but, over the past two years, I’ve been there just three times: twice for vaccine jabs and, more recently, for the Game Developers Conference, a gathering of video games creators, known as GDC. It was the largest event I’ve been to since the great re-emerging, with 12,000 people attending.

In the lead-up to it, I received an email telling me to download an app called Clear Health Pass. Americans who fly will be familiar with Clear — the company touts regularly for new business at airports. For a fee, Clear promises a fast-track through security.

Since May 2020, Clear has also made an app that verifies vaccination status, “giving you the confidence to move forward”, as it states on its Twitter feed. It certainly gave me the ability to move up the queue at GDC. Those who didn’t have it had to join a snaking line. 

Prompted by the app, I was asked to upload evidence of my vaccine (OK), take a picture of my passport’s photo page (Sure) and run a scan of my face (Um…). The app also needed my email, home address and phone number. What exactly Clear can do with all this data is laid out in a 4,596-word privacy policy.

A San Francisco bar wanted my email address before showing me the wine list

It explains that, by using the app to verify your vaccination status, you consent to your details being used to receive “services offered by our marketing partners”. Non-biometric data can be used to perform “data analyses” including “market and consumer research”. It also says that the company can use “your health information” to “evaluate and improve our services”.

And then there’s this: “We may also share de-identified information with public interest organisations, healthcare organisations and researchers. We will prohibit these organisations from attempting to re-identify the information we share with them.”

When I contacted Clear for more information, a spokesperson told me that it’s never had to take action against a company for breaking these policies. And when it shares information, it makes it “practically impossible to re-identify” specific individuals. Such reassurances are to be expected. But we must ask whether systems like this should be the cost of entry for public life post-Covid. 

I’ve highlighted Clear but similar, steroidal data gathering is everywhere. A bar in San Francisco wanted my email address before showing me the wine list. Ubiquitous QR codes often pick up data about you. For decades, companies dreamt of knowing more about what you do in the real world. And now they do.

Sensing public unease, lawmakers around the world have tended to duck the sensitive topic of “vaccine passports”. It’s clear we’re getting them anyway, but managed by corporations instead. Last year the American Civil Liberties Union warned against technology “putting more of our personal information and power into the hands of companies who profit at our expense”.

The Clear app is in use at events across the US. It’s free for the event-goer and, while technically optional, the convenience factor means mass adoption is inevitable. 

We’ve been at this crossroads before. The true implications of data gathering on the internet crept up on us. We should be mindful to not let the same thing happen again.

Dave Lee is an FT reporter in San Francisco

Follow @FTMag on Twitter to find out about our latest stories first