The implementation of digital contact tracing applications around the world to help reduce the spread of the COVID-19 pandemic represents one of the most ambitious uses of massive-scale citizen data ever attempted. There is major divergence among nations, however, between a "privacy-first" approach which protects citizens' data at the cost of extremely limited access for public health authorities and researchers, and a "data-first" approach which stores large amounts of data which, while of immeasurable value to epidemiologists and other researchers, may significantly intrude upon citizens' privacy. The lack of a consensus on privacy protection in the contact tracing process creates risks of non-compliance or deliberate obfuscation from citizens who fear revealing private aspects of their lives - a factor greatly exacerbated by recent major scandals over online privacy and the illicit use of citizens' digital information, which have heightened public consciousness of these issues and created significant new challenges for any collection of large-scale public data. While digital contact tracing for COVID-19 remains in its infancy, the lack of consensus around best practices for its implementation and for reassuring citizens of the protection of their privacy may already have impeded its capacity to contribute to the pandemic response.