Apple and Google release FAQ for contact tracing APIs, describe changes made to address privacy concerns, and pledge to disable APIs once pandemic is contained
The FAQ lands mid-arc in a fast-moving negotiation over who governs pandemic contact tracing. The EU had already said it would scrutinize the proposed APIs for interoperability with its own guidelines, putting privacy design under regulatory pressure before a single app shipped.
Apple and Google's answer is a documented set of concessions — described here as changes addressing privacy concerns — plus an unusual commitment to shut the whole system down once the pandemic ends. That pledge matters because the APIs were about to ship publicly in iOS and Android updates, with US states already building apps on top.
First-order effects
State health authorities building exposure notification apps now have written rules to code against, including the earlier policy prohibiting location data collection in any approved app.
The disable-on-containment pledge gives regulators like the EU a concrete sunset mechanism to weigh when deciding whether the APIs meet their compatibility and privacy bar.
Second-order effects
Public health agencies are locked into Apple and Google's terms as the price of reaching phones at OS level — no third-party tracing app can match that reach without their cooperation, shifting bargaining power to the two platform holders.
Competing approaches, including centralized or location-based tracing schemes floated by governments, face pressure to conform to the decentralized model the FAQ codifies or be excluded from iOS and Android entirely.
Third-order effects
If the pattern holds, OS vendors become de facto approvers of public-health infrastructure, setting privacy terms that governments must accept rather than legislate — a governance role usually reserved for regulators.
A time-boxed, revocable API establishes a template for emergency digital infrastructure: built fast by platforms, governed by published policy, and switched off rather than left to linger as surveillance residue.
The trend: Platform owners are converting crisis-driven API releases into durable governance authority over public-sector software, with sunset pledges as the concession that makes it politically viable.
They'll change the name to Health Tracker Plus, keep your data, make it nearly impossible to opt out, and nag you if you do. I.e., like all their other software. https://twitter.com/...
It's now called the “exposure notification system.” Which “...reflects that the new system should be ‘in service of broader contact tracing efforts by public health authorities.’” https://www.theverge.com/...
“The protocols were initially announced as a contact-tracing system, it is now referred to as an “exposure notification” system. The companies say the name change reflects that the new system should be “in service of broader contact tracing efforts by public health authorities.""…
Estonia is developing a new contact-tracing mobile application in the fight against #COVID19, in line with the recently announced API by @Google & @Apple, placing the principles of #privacy and #decentralisation at the core of this process. https://e-estonia.com/...
the critical change in today's Apple/Google news is a rebrand of sorts to call it exposure notification because (controversially) public health officials can't use it for traditional contact tracing https://www.axios.com/...
This is all great news. Shows hw important it was for Apple and Google to detail their plans early, take feedback and adjust. @russellbrandom had the details https://www.theverge.com/...
Apple and Google want to make it as easy as possible for health officials to build their own apps for this project. That includes supporting a potential white-label app to speed things up. Tip @Techmeme https://twitter.com/...
Apple and Google have updated their coronavirus contact tracing technology to try to address privacy concerns (and to make it easier for health authorities to write apps): https://www.cnet.com/... from @iansherr
Fascinating. Germany may justify a centralised app on grounds of data sovereignty over Gapple and need to collect > min data - and these may also inform @NHSX - but Ge app still adheres to no contact without positive test.1/2 https://twitter.com/...
So, the @NHSX has published SOME details at last on ‘Digital contact tracing: protecting the NHS and saving lives’ https://www.nhsx.nhs.uk/... But it's not enough. Where is the DPIA that really needs to be a HRIA? And then, there are aspects of the narrative that are 🤔
The #NHSX mobile tracing app announcement makes many positive claims about user data and privacy. There's nothing in the blog however to explain: • Will it work with Apple / Google protocol; • If contact matching done on device as per above https://www.nhsx.nhs.uk/... #Covid19UK