New York AG asks Apple and Google to ensure that coronavirus contact tracing apps on iOS and Android do not collect sensitive personal health information
Both Apple and Google are having a hard time regulating all the third-party COVID-19 contact tracing apps that popped up on their app stores recently …
Context & Ripple Effects
Apple and Google designed their joint exposure-notification system specifically to keep health data off central servers: the API proposal modeled on Singapore's TraceTogether led to the public launch of the Exposure Notification API in iOS and Android updates in May, with US states building official apps on top of it. The companies even published an FAQ addressing privacy concerns and pledged to shut the APIs down once the pandemic is contained.
The New York AG's letter targets the gap around that system: third-party COVID-19 tracing apps have proliferated on both app stores without going through the joint API, so the privacy architecture Apple and Google built for themselves does not govern what independent developers collect. The AG is asking the platforms to enforce that boundary at the store level.
First-order effects
- Apple and Google must now audit or vet third-party contact-tracing apps across their stores for sensitive health data collection — review burden lands directly on two platform teams already managing a flood of pandemic-related submissions.
Second-order effects
- Independent tracing-app developers face stricter store gatekeeping just as at least three US states launch official apps through the Exposure Notification API, pushing users and public-health buyers toward state-built options over commercial lookalikes.
Third-order effects
- With the EU already scrutinizing the joint APIs for interoperability, a US state AG policing store-level health-data practices points toward app-store health-app governance becoming a formal regulatory matter rather than a voluntary platform policy.
The trend: Pandemic-era contact tracing is forcing Apple and Google's app stores to evolve from general gatekeepers into active regulators of health data collected by third-party software.