Over the weekend, Google and the state of Massachusetts managed to make creepy COVID tracking apps even creepier by automatically installing them on people's Android phones.

Numerous reports on Reddit, Hacker News, and in-app reviews claim that "MassNotify," Massachusetts' COVID tracking app, silently installed on their Android device without user consent.

The "functionality" of COVID exposure-tracking apps are built into Google Play Services as an API that government apps can use for their tracking initiatives and can be "automatically distributed by the Google Play Store.".

Thanks to Abner Li from 9to5Google for pointing out that the screenshots in the Play Store are wrong and that the auto-installed version of MassNotify does not actually have app icon or a public health statistics UI.

It only lives in Settings -> Google -> COVID-19 Exposure Notifications, where you can turn on tracking and report that you have COVID.

With no app icon, the easiest way to see if MassNotify auto-installed itself on your device is to click on this Play Store link and see if the install button is past tense ("Installed" versus "Install")!

With no app icon, the auto-installed version of MassNotify will only show up in the app info system settings, and even then, if you want to uninstall it, it's not called "MassNotify." Instead, it is vaguely called "Massachusetts Department of Heath.".

The version of MassNotify that is not auto-installed is a full COVID app, with a statistics UI and an app icon.

The Play Store only shows install numbers in tiers, so the "1,000,000+" label on MassNotify means "More than 1 million and less than 5 million," which is the next tier up.

MassNotify is now the most popular COVID tracking app on the Play Store.

If you're wondering "Can Google really install apps to an Android device without user input?" the answer is "Can they ever!" Push installs are actually the only way Google Play installs apps.

When you open up the Play Store and press the install button, you're actually requesting that Google push you an app install over Firebase Cloud Messaging. Users can actually view this in action themselves by remote-installing an app from the Google Play website on a desktop computer.

Last year when this whole COVID tracking app idea was being kicked around, one poll found that half of Americans don't trust these COVID tracking apps with their privacy.