India’s digital contact tracing app is controlling the behaviour of millions. One evening in the first week of May, Jyoti Bandooni, left her home for her weekend grocery run at the nearby supermarket. For Bandooni, 24, who lives with her parents in suburban Delhi and works in events management, it had become second nature to go shopping after six weeks of lockdown. But this time, her parents were worried sick.

Just that evening, on May 3, police officials in the Noida region had passed new orders giving them to fine people up to Rs. 1000 (£11) or put people in jail for six months if they were found without the government’s Aarogya Setu contact tracing app installed on their smartphones.

Bandooni is one of the last few standouts in her neighbourhood, in Sector 15A – which is marked as a ​“red” containment zone – who has refused to install the app. ​“If downloading an app alone helps not to leave the fate of our world to chance, I would. Truth is it doesn’t,” she says. Bandooni was lucky to have not been stopped by patrol police, but others in India cannot afford to be as stubborn or as fortunate as her.

India’s Aarogya Setu Covid-19 tracing app was initially rolled out in early April as voluntary, but it is now starting to be pushed by various government, non-government and private agencies as being mandatory. The move has resulted in several instances where the absence or the presence of the app has been used to make people behave in a certain way. And the government’s poor record on the pervasive use of digital tools has left many experts sceptical about the use of data from the app to build a health surveillance system or curb civil liberties.

The app is quickly becoming integral to people being able to return to normal life. In one instance in the North Indian territory of Chandigarh, 190 people who violated a curfew imposed due to the lockdown were forced to download the app before being released from police detention. In another, a photographer was denied entry into a pharmacy inside a residential complex in Noida after refusing to download the app. Residents of Noida have challenged the mandatory push as an ​“executive overreach”.

As per data curated by Internet Democracy Project (IDP) there have been over half a dozen instances so far, where the absence of the app has been used as an excuse by law enforcement officials or resident welfare associations to force people to download it. Last month, online food delivery startups Zomato and Swiggy asked frontline workers to download the state-backed contact tracing app. And as India gears up for a phased reopening of its economy, the government has proposed to make the app mandatory for air travel, and has made it compulsory for passengers traveling by trains.

For lawyer Nishtha Krina, who had contracted an eye infection during lockdown, renowned eye care hospital Narayana Nethralaya refused to schedule an appointment without Arogya Setu. ​“They said unless and until I downloaded the app they would not treat me, and it was an internal policy.” Krina was forced to visit a different hospital to get her eye treated.

India is the first democracy to take this approach – the only other country to make its Covid-19 response apps compulsory is China. Tanisha Ranjit, a researcher at IDP tracking the mandatory push says: ​“Linking the app to necessary areas such as employment and travel leads to a situation where there is very little choice left to not download it. People would rather download the app than not have the opportunity to go to work or travel.”

A federal government order from the Ministry of Home Affairs, has even said that public officials can be punished for not imposing installation in containment zones, areas where positive coronavirus cases are identified. Heads of private companies are also liable for non-compliance.

Such coercive measures, coupled with prime minister Narendra Modi’s flailing endorsement of the app has already led to over 100 million downloads making it one of fastest downloaded apps of all time. While the government’s intention to make it mandatory is clear, some see the compulsory push as exclusionary since only 24 per cent of Indians have access to smartphones, according to one study, leaving out a significant chunk of the 1.3 billion population.

Built by India’s Ministry of Electronics and Information Technology (Meity) the app uses a mix of GPS data and bluetooth, to locate all the people a user has come in contact with by comparing it to a government database of known Covid-19 cases.

This is in contrast with many countries around the world, which are building contact tracing apps that do not rely on knowing the identities of users. This is being done through a privacy-preserving protocol that has been developed in combination by Apple and Google.

Aarogya Setu has more capabilities than just contact tracing. It has a built-in self-assessment tool to check a person’s health status, and asks for personal information such as name, age, gender, and travel history. Like its counterparts in other countries, the app segregates containment zones as red, yellow and green.

According to press reports, the aggregate anonymised data from the app has so far been used to predict 300 ​‘emerging’ coronavirus hotspots. While some question the efficacy of contact tracing apps, the Indian government’s aggressive approach is aimed at replicating the early success of Singapore, Taiwan and China which used such apps to help slow down the spread of the virus. The countries used apps as one part of their overall response to the coronavirus.

While India’s app has been criticised on various grounds, the biggest objection has been that despite collecting sensitive personal information it is not governed by a law. ​“A technology exercise of this scale being rolled out without an anchoring law is mind boggling,” says Vrinda Bhandari, a lawyer in India’s Supreme court. It’s egregious, ​“especially considering India still does not have a data protection law in place.” Justice Bellur Narayanaswamy Sri Krishna, who chaired the expert committee that drafted a Personal Data Protection Bill, termed the mandatory use of the app as ​“utterly illegal”. At the time of publication Meity had not responded to questions about the lawfulness of the app or other criticisms that have been raised.

In Australia, where millions of people have downloaded the country’s contact tracing app, a law to protect users of the app has been introduced. In the UK a draft bill has been proposed by Parliament’s Human Rights Committee, but it has yet to be adopted. Instead of legislation, India has introduced a ​“protocol” which aims to assure users that health information will be deleted in 180 days. ​“The protocol is nowhere close to a law, and can have arbitrary changes in the future,” says Raman Jit Singh Chima, senior international counsel at Access Now, an internet advocacy group. There has also been no clear directive on whether or not it will open source the app.

The power of the ruling Indian government to bypass parliamentary procedures, and implement privacy invading decisions such as the mandatory installation of Aarogya Setu is being justified under the Disaster Management Act, which has been invoked during the pandemic. Digital rights activists see it as the ​“perfect example” of personal privacy being whittled down to vestiges in a post-Covid world. The validity of the ​“unlawful” move is currently being challenged in court by one state government.

There are also concerns of mission creep. While Aarogya Setu’s stated purpose was contact tracing it has slowly expanded to integrate e‑pass functionality, a digital pass issuance system for inter and intra state travel; information bulletins, telemedicine consultations, and a self-assessment tool, which provides a Covid risk score that’s computed based on the personal data the app collects. This score is based on the personal data the app collects, information bulletins and telemedicine consultations. On May 12, the Indian railways tweeted that the app was mandatory for railway travellers and the government is mulling over making it compulsory for air travel.

For many people and digital rights activists, the steady expansion of the use of Aarogya Setu is oddly reminiscent of India’s controversial biometric ID project, Aadhaar.

When Aadhaar was initially rolled out in 2009, it was envisaged as a scheme to fix India’s corrupt welfare delivery system. The use of a 12-digit unique identifier – linked to a person’s iris and fingerprint – slowly expanded over five years becoming necessary to access everything from procuring a phone connection, writing an exam, opening a bank account, paying taxes and over a 100 other schemes. Its expansive use was later challenged in India’s Supreme court which after a long drawn legal battle limited the mandatory use of Aadhaar back to its stated purpose of government benefits.

Aadhaar much like Aarogya Setu was rolled out without a legislative sanction. ​“They went about enrolling millions of people and their biometrics without an underlying law. And ultimately created a law when there was public backlash,” Bhandari says. The fear that a contact tracing app will soon become a precondition for accessing various goods and services, and other essential facilities, is already starting to show. ​“I’m irritated,” says, Ankita Sharma, a 29-year-old social management executive, who was compelled to download the contact tracing app before booking her rail ticket from Lucknow to Delhi next week. ​“That Aarogya Setu could become a bare minimum necessity in the near future like Aadhaar worries me,” she says.