The “by-design” approach, that is, the belief that pre-embedding values in technology itself will bring about the desired social outcome, has become a cornerstone of modern regulatory approach to technology. In recent years it has become a golden standard for laws and reform initiatives related to privacy, copyright and Artificial Intelligence. This paper challenges the by-design approach, by exploring the case study of Contact Tracing Apps used to tackle the spread of COVID-19. In the wake of the pandemic, a variety of design solutions were introduced around the world, each reflecting a distinct trade-off between the need to respect users’ privacy and the information needed for public health purposes. After a brief success, the quest for a panacea technological remedy to arrest the pandemic eventually failed. The case study discussed in this paper demonstrates a major flaw in the approach which focuses predominantly on by-design solutions. It describes how technological affordances were shaped by social institutions in ways that divert from their pre-designed functions. On the one hand, a privacy-preserving design has led to unintended consequences, shaped by social norms and market forces. On the other hand, the intrusion on privacy by mandatory mass surveillance was somewhat mitigated by legal restraints. The case study further highlights the key role of law in shaping the social outcome of technology, with some important lessons to policymakers.