Location tracking banned for use in Apple and Google’s contact-tracing API

5 May 2020

Image: fermate/Depositphotos

In the contact-tracing API developed jointly by Apple and Google, location data, among other things, cannot be harvested.

Apple and Google have released new details about their contact-tracing technology, which has been renamed the Exposure Notification API. Many governments across the world are turning to the solution being offered by the two tech giants to help slow the spread of Covid-19, amid calls for decentralisation of data in contact-tracing apps.

Among the set of rules issued by Apple and Google for public health authorities to follow is a ban on harvesting location data. If health authorities want to use GPS location for their apps, they will have to use workarounds that could make some phones unstable.

The companies also stressed that explicit user consent is required before they can be notified of having come into close contact with someone recently diagnosed with Covid-19. The person diagnosed must also give consent to share their positive test result with anyone they may have come in close contact with, registered via Bluetooth ‘handshakes’ from their devices.

Any app developed using the API must collect the minimum amount of data necessary and it must only be used in relation to tracking the spread of Covid-19. Another stipulation for public health authorities is that there may only be one contact-tracing app per country in order to prevent fragmentation of data.

Irish app update

However, Apple and Google said they would find ways to support countries that have regional authorities coordinating different approaches, such as in the US or Australia. This means both companies will allow for multiple apps being released in their respective app stores in some countries. The full release of the API is scheduled for the middle of this month.

Meanwhile, the Irish Government has provided further details on the Irish contact-tracing app, which is based on the Exposure Notification API and is due to be launched by the end of May.

A document released by the Department of Health said that the app – developed by Waterford-based NearForm – can be used by anyone with an Apple or Google smartphone that is less than five years old.

The department’s estimates suggest that at least 25pc of the population will need to download the app for there to be a significant impact on tracing the spread of infection. However, concerns have been raised over the UK’s app, which may not be able to work alongside the Irish app.

This is because the UK has taken a centralised data approach, different from the decentralised Exposure Notification API. With a decentralised system, data is stored on the user’s device rather than being sent to a centralised server.

Hand holding a contact-tracing app. Image: fermate/Depositphotos

Colm Gorey was a senior journalist with Silicon Republic