Why have Apple and Google blocked the NHS Covid app update?

13 Apr 2021

Image: © bnenin/Stock.adobe.com

Apple and Google have blocked an updated version of the Covid-19 tracking app in England and Wales due to privacy concerns.

The latest update to the Covid-19 tracking app in England and Wales has been paused following objections from two major tech giants.

While the app is still available to download from both the Apple App Store and the Google Play Store, the companies have blocked the latest update as it violates their privacy rules.

The roll-out of the newest version of the app, which was due to coincide with the easing of lockdown restrictions in the UK this week, would have allowed users to upload a history of venues they had checked into if they tested positive for Covid-19. However, Apple and Google’s decentralised contact-tracing tech prevents the sharing of location data.

What has changed?

Last year, the NHS planned to develop its own centralised Covid-19 app, which would have meant that anonymised data from people who reported symptoms on the app would be held in an NHS database. But in a major U-turn, it later decided to adopt the decentralised contact-tracing solution from Google and Apple, the Exposure Notification API.

This means that data from the app is stored on a user’s own device and not shared with a centralised server. It was an approach adopted by many countries, including Ireland, as it is seen to offer greater user privacy.

Up until now, the Covid tracking app in England and Wales has allowed users to check in at venues such as bars and restaurants by scanning a QR code before they enter.

If a venue is identified as a potential virus hotspot, every device is sent this data and the app will check a user’s own log of locations and alert them in cases of potential exposure. In line with Apple and Google’s decentralised model, this data would all remain on the user’s device.

However, the newest version of the app, which was due to be rolled out on 8 April according to The Guardian, would ask users to share their venue history details if they tested positive for the virus.

Although this would seek user permission, Apple and Google blocked the update as it broke the rules they set out when building the contact-tracing technology.

The tech giants’ joint FAQ states that the Exposure Notifications System “does not share location data from the user’s device with the public health authority, Apple or Google”.

Scotland has launched a similar check-in system, but has avoided violating the tech giants’ terms by building the features into a separate app, Check In Scotland, rather than add them to its contact-tracing app.

The contact-tracing apps for Scotland, Northern Ireland, Jersey and Gibraltar were developed by Waterford company NearForm.

Jenny Darmody is the editor of Silicon Republic

editorial@siliconrepublic.com