Colombia traced Covid contacts through mobile ad IDs instead of building a tracing app

In 2020, Bogotá and the Colombian department of Antioquia needed to trace Covid-19 contacts, but dedicated contact-tracing apps worldwide were struggling with low download and opt-in rates, undercutting their coverage. Both governments contracted the local company Servinformación, which proposed skipping a new app entirely and instead using the mobile advertising infrastructure already running on most phones.

Every phone carries an advertising ID, assigned by Google or Apple, that ad networks use to target users across apps. Servinformación matched this ID system against confirmed patients: each week, officials sent patient addresses, and the company found which IDs regularly spent the night there, then which other IDs stayed within 10 meters of those devices for 30+ minutes. Rather than building an app, it bought geotargeted ads and SMS blasts through networks already reaching those phones, warning of possible exposure and linking to a symptom-check form.

The system required no download, no install, and no active consent step — it worked on anyone whose phone already carried the standard advertising ID, which is nearly everyone with a smartphone. Health officials in Antioquia also used the aggregated location data to direct epidemiological teams to specific city blocks with clusters of exposed IDs, rather than testing broadly.

Reuse the ad-tech ID already on every phone instead of building an app people have to install

Piggybacking on advertising IDs meant zero adoption friction — there was no app to download, so coverage matched however many phones already ran ad-supported apps, which is nearly all of them.

The 10-meter, 30-minute proximity match reused an existing ad-tech targeting primitive instead of requiring new location-tracking software to be built and deployed.

Feeding results back through existing ad networks and SMS gateways meant the outreach channel was already built and already reached the target phones.

Aggregating exposed IDs by city block let health officials target testing teams geographically instead of the harder problem of identifying and testing every possible contact individually.

When adoption is the bottleneck, check whether the infrastructure you need is already installed on target devices for an unrelated purpose — it beats a purpose-built app since nobody has to opt in.

By the time Rest of World reported the story, Antioquia officials said they had sent more than 411,000 ads and text messages since April 2020, triggering over 1,600 calls to health services — a 0.4% response rate, just under the 0.5–0.7% benchmark for digital marketing campaigns. Privacy researchers at Karisma Foundation and the Electronic Frontier Foundation warned the same ID-matching technique could double as surveillance, since knowing a patient's home address makes it easy to infer which advertising ID belongs to them.