Growing interest is being directed to the health applications of so-called 'passive data' collected through wearables and sensors without active input by users. High promises are attached to passive data and their potential to unlock new insights into health and illness, but as researchers and commentators have noted, this mode of data gathering also raises fundamental questions regarding the subject's agency, autonomy and privacy. To explore how these tensions are negotiated in practice, we present and discuss findings from an interview study with 30 members of the public in the UK and Italy, which examined their views and experiences of the coronavirus disease 2019 contact tracing apps as a large-scale, high-impact example of digital health technology using passive data. We argue that, contrary to what the phrasing 'passive data' suggests, passivity is not a quality of specific modes of data collection but is contingent on the very practices that the technology is supposed to unobtrusively capture.