Exposure Notification

Digital contact tracing protocols typically have two major responsibilities: encounter logging and infection reporting. Exposure Notification only involves encounter logging which is a decentralized architecture. The majority of infection reporting is centralized in individual app implementations.{{Cite web|title=Android Contact Tracing API|url=https://blog.google/documents/55/Android_Contact_Tracing_API.pdf|date=2020-04-10|website=Blog.google|access-date=2020-05-08}}

To handle encounter logging, the system uses Bluetooth Low Energy to send tracking messages to nearby devices running the protocol to discover encounters with other people. The tracking messages contain unique identifiers that are encrypted with a secret daily key held by the sending device. These identifiers change every 15–20 minutes as well as Bluetooth MAC address in order to prevent tracking of clients by malicious third parties through observing static identifiers over time.{{Cn|date=March 2023}}

The sender's daily encryption keys are generated using a random number generator.{{Cite web|url=https://techcrunch.com/2020/04/24/apple-and-google-update-joint-coronavirus-tracing-tech-to-improve-user-privacy-and-developer-flexibility/|title=Apple and Google update joint coronavirus tracing tech to improve user privacy and developer flexibility|website=TechCrunch|date=24 April 2020|language=en-US|access-date=2020-04-27|archive-date=2021-06-04|archive-url=https://web.archive.org/web/20210604040434/https://techcrunch.com/2020/04/24/apple-and-google-update-joint-coronavirus-tracing-tech-to-improve-user-privacy-and-developer-flexibility/|url-status=live}} Devices record received messages, retaining them locally for 14 days. If a user tests positive for infection, the last 14 days of their daily encryption keys can be uploaded to a central server, where it is then broadcast to all devices on the network. The method through which daily encryption keys are transmitted to the central server and broadcast is defined by individual app developers. The Google-developed reference implementation calls for a health official to request a one-time verification code (VC) from a verification server, which the user enters into the encounter logging app. This causes the app to obtain a cryptographically signed certificate, which is used to authorize the submission of keys to the central reporting server.{{Cite web|title=Exposure Notifications verification server|url=https://developers.google.com/android/exposure-notifications/verification-system|access-date=2020-09-01|website=Google Developers|language=en}}

The received keys are then provided to the protocol, where each client individually searches for matches in their local encounter history. If a match meeting certain risk parameters is found, the app notifies the user of potential exposure to the infection.{{Cite web|title=Exposure Notification Frequently Asked Questions Preliminary — Subject to Modification and Extension|url=https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.1.pdf|date=2020-05-01|website=Apple|access-date=2020-05-08|archive-date=2020-05-06|archive-url=https://web.archive.org/web/20200506015327/https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.1.pdf|url-status=dead}} Google and Apple intend to use the received signal strength (RSSI) of the beacon messages as a source to infer proximity.{{Cite magazine|url=https://www.wired.com/story/apple-google-contact-tracing-strengths-weaknesses/|title=Is Apple and Google's Covid-19 Contact Tracing a Privacy Risk?|magazine=Wired|access-date=2020-04-18|language=en|issn=1059-1028}} RSSI and other signal metadata will also be encrypted to resist deanonymization attacks.

To generate encounter identifiers, first a persistent 32-byte private Tracing Key ($tk$) is generated by a client. From this a 16 byte Daily Tracing Key is derived using the algorithm $dtk\_i\; =\; HKDF(tk,\; NULL,\; \backslash text\{\text{'}CT-DTK\text{'}\}||D\_i,\; 16)$, where $HKDF(\backslash text\{Key,\; Salt,\; Data,\; OutputLength\})$ is a HKDF function using SHA-256, and $D\_i$ is the day number for the 24-hour window the broadcast is in starting from Unix Epoch Time. These generated keys are later sent to the central reporting server should a user become infected.{{Cite web|date=April 2020|title=Contact Tracing - Cryptography Specification|url=https://blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf|access-date=2020-06-14}}

From the daily tracing key a 16-byte temporary Rolling Proximity Identifier is generated every 10 minutes with the algorithm $RPI\_\{i,j\}\; =\; \backslash text\{Truncate\}(HMAC(dtk\_i,\; \backslash text\{\text{'}CT-RPI\text{'}\}||TIN\_j),16)$, where $HMAC(\backslash text\{Key,\; Data\})$ is a HMAC function using SHA-256, and $TIN\_j$ is the time interval number, representing a unique index for every 10 minute period in a 24-hour day. The Truncate function returns the first 16 bytes of the HMAC value. When two clients come within proximity of each other they exchange and locally store the current $RPI\_\{i,j\}$ as the encounter identifier.

Once a registered health authority has confirmed the infection of a user, the user's Daily Tracing Key for the past 14 days is uploaded to the central reporting server. Clients then download this report and individually recalculate every Rolling Proximity Identifier used in the report period, matching it against the user's local encounter log. If a matching entry is found, then contact has been established and the app presents a notification to the user warning them of potential infection.

Unlike version 1.0 of the protocol, version 1.1 does not use a persistent tracing key, rather every day a new random 16-byte Temporary Exposure Key ($tek\_i$) is generated. This is analogous to the daily tracing key from version 1.0. Here $i$ denotes the time is discretized in 10 minute intervals starting from Unix Epoch Time. From this two 128-bit keys are calculated, the Rolling Proximity Identifier Key ($RPIK\_i$) and the Associated Encrypted Metadata Key ($AEMK\_i$). $RPIK\_i$ is calculated with the algorithm $RPIK\_i\; =\; HKDF(tek\_i,\; NULL,\; \backslash text\{\text{'}EN-RPIK\text{'}\},16)$, and $AEMK\_i$ using the algorithm$AEMK\_i\; =\; HKDF(tek\_i,\; NULL,\; \backslash text\{\text{'}EN-AEMK\text{'}\},16)$.

From these values a temporary Rolling Proximity Identifier ($RPI\_\{i,j\}$) is generated every time the BLE MAC address changes, roughly every 15–20 minutes. The following algorithm is used: $RPI\_\{i,j\}\; =\; AES128(RPIK\_i,\; \backslash text\{\text{'}EN-RPI\text{'}\}\; ||\; \backslash mathtt\{0x000000000000\}\; ||\; ENIN\_j)$, where $AES128(\backslash text\{Key,\; Data\})$ is an AES cryptography function with a 128-bit key, the data is one 16-byte block, $j$ denotes the Unix Epoch Time at the moment the roll occurs, and $ENIN\_j$ is the corresponding 10-minute interval number. Next, additional Associated Encrypted Metadata is encrypted. What the metadata represents is not specified, likely to allow the later expansion of the protocol. The following algorithm is used: $\backslash text\{Associated\; Encrypted\; Metadata\}\_\{i,j\}\; =\; AES128\backslash \_CTR(AEMK\_i,\; RPI\_\{i,j\},\; \backslash text\{Metadata\})$, where $AES128\backslash \_CTR(\backslash text\{Key,\; IV,\; Data\})$ denotes AES encryption with a 128-bit key in CTR mode. The Rolling Proximity Identifier and the Associated Encrypted Metadata are then combined and broadcast using BLE. Clients exchange and log these payloads.

Once a registered health authority has confirmed the infection of a user, the user's Temporary Exposure Keys $tek\_i$ and their respective interval numbers $i$ for the past 14 days are uploaded to the central reporting server. Clients then download this report and individually recalculate every Rolling Proximity Identifier starting from interval number $i$, matching it against the user's local encounter log. If a matching entry is found, then contact has been established and the app presents a notification to the user warning them of potential infection.

Version 1.2 of the protocol is identical to version 1.1, only introducing minor terminology changes.{{Cite web|title=Exposure Notification - Cryptography Specification|url=https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-CryptographySpecificationv1.2.pdf|date=April 2020|website=Apple|access-date=2020-05-22}}

Preservation of privacy was referred to as a major component of the protocol; it is designed so that no personally identifiable information can be obtained about the user or their device.{{Cite web|title=Apple and Google update joint coronavirus tracing tech to improve user privacy and developer flexibility|url=https://techcrunch.com/2020/04/24/apple-and-google-update-joint-coronavirus-tracing-tech-to-improve-user-privacy-and-developer-flexibility/|website=TechCrunch|date=24 April 2020|language=en-US|access-date=2020-05-21|archive-date=2021-06-04|archive-url=https://web.archive.org/web/20210604040434/https://techcrunch.com/2020/04/24/apple-and-google-update-joint-coronavirus-tracing-tech-to-improve-user-privacy-and-developer-flexibility/|url-status=live}}{{Cite web|title=Why countries keep bowing to Apple and Google's contact tracing app requirements|url=https://www.theverge.com/interface/2020/5/8/21250744/apple-google-contact-tracing-england-germany-exposure-notification-india-privacy|last=Newton|first=Casey|date=2020-05-08|website=The Verge|language=en|access-date=2020-05-21}}{{Cite web|title=Apple, Google announce new privacy features for coronavirus tracking tech|url=https://www.cnet.com/news/apple-google-announce-new-privacy-features-for-coronavirus-tracking-tech/|last=Sherr|first=Ian|website=CNET|language=en|access-date=2020-05-21}} Apps implementing Exposure Notification are only allowed to collect personal information from users on a voluntary basis. Consent must be obtained by the user to enable the system or publicize a positive result through the system, and apps using the system are prohibited from collecting location data.{{Cite news|title=Apple and Google release sample code, UI and detailed policies for COVID-19 exposure-notification apps|url=https://techcrunch.com/2020/05/04/apple-and-google-release-sample-code-and-detailed-policies-for-covid-19-exposure-notification-apps/|access-date=2020-09-01|website=TechCrunch|language=en-US}} As an additional measure, the companies stated that it would sunset the protocol by-region once they determine that it is "no longer needed".{{Cite web|last=Newton|first=Casey|date=2020-04-14|title=Apple and Google have a clever way of encouraging people to install contact-tracing apps for COVID-19|url=https://www.theverge.com/interface/2020/4/14/21219289/apple-google-contact-tracing-app-android-ios-pros-cons-quarantine-testing|access-date=2020-04-15|website=The Verge|language=en}}

The Electronic Frontier Foundation showed concerns the protocol was vulnerable to "linkage attacks", where sufficiently capable third parties who had recorded beacon traffic may retroactively be able to turn this information into tracking information, for only areas in which they had already recorded beacons, for a limited time segment and for only users who have disclosed their COVID-19 status, once a device's set of daily encryption keys have been revealed.{{Cite web|title=Apple and Google's COVID-19 Exposure Notification API: Questions and Answers|url=https://www.eff.org/deeplinks/2020/04/apple-and-googles-covid-19-exposure-notification-api-questions-and-answers|last=Gebhart|first=Bennett Cyphers and Gennie|date=2020-04-28|website=Electronic Frontier Foundation|language=en|access-date=2020-05-21}}

On April 16, the European Union started the process of assessing the proposed system for compatibility with privacy and data protection laws, including the General Data Protection Regulation (GDPR).{{Cite news|last=Drozdiak|first=Natalia|date=16 April 2020|title=Google, Apple Covid-19 Tracking Tech Faces EU Scrutiny|url=https://www.bloomberg.com/news/articles/2020-04-16/google-apple-covid-19-tracking-tech-faces-eu-scrutiny|newspaper=Bloomberg.com}} On April 17, 2020, the UK's Information Commissioner's Office, a supervisory authority for data protection, published an opinion analyzing both Exposure Notification and the Decentralized Privacy-Preserving Proximity Tracing protocol, stating that the systems are "aligned with the principles of data protection by design and by default" (as mandated by the GDPR).{{Cite web|last=ICO|date=17 April 2020|title=Apple and Google joint initiative on COVID-19 contact tracing technology|url=https://ico.org.uk/media/about-the-ico/documents/2617653/apple-google-api-opinion-final-april-2020.pdf|website=Information Commissioner's Office}}

Exposure Notification is compatible with Android devices supporting Bluetooth Low Energy and running Android 6.0 "Marshmallow" and newer with Google Mobile Services. It is serviced via updates to Google Play Services, ensuring compatibility with the majority of Android devices released outside of Mainland China, and not requiring it to be integrated into Android firmware updates (which would hinder deployment by relying on individual OEMs). It is not compatible with devices that do not have GMS, such as Huawei devices released since May 2019.{{Cite web |last=Bohn |first=Dieter |date=2020-04-13 |title=Android phones will get the COVID-19 tracking updates via Google Play |url=https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing |access-date=2020-04-16 |website=The Verge |language=en}}{{Cite web |date=2020-05-25 |title=Apple And Google's Contact Tracing Software Won't Work On Some Huawei Devices |url=https://www.gizmodo.com.au/2020/05/apple-google-coronavirus-huawei-exposure-notification-system/ |access-date=2020-10-07 |website=Gizmodo Australia |language=en-AU}} On iOS, EN is serviced via operating system updates. It was first introduced as part of iOS 13.5 on May 20, 2020.{{Cite web|last=Gartenberg|first=Chaim|date=2020-04-14|title=Here's how Apple and Google will track the coronavirus with Bluetooth|url=https://www.theverge.com/2020/4/14/21220644/apple-googles-bluetooth-low-energy-le-coronavirus-tracking-contact-tracing|access-date=2020-09-01|website=The Verge|language=en}}{{Cite web |last=Miller |first=Chance |date=2020-12-14 |title=Apple releases iOS 12.5 for older iPhones with support for COVID-19 exposure notifications |url=https://9to5mac.com/2020/12/14/apple-releases-ios-12-5-for-older-iphones-with-support-for-covid-19-exposure-notifications/ |access-date=2020-12-14 |website=9to5Mac |language=en-US}} In December 2020, Apple released iOS 12.5, which backported EN support to iPhone models that cannot be upgraded to iOS 13, including iPhone 6 and older.

Exposure Notification apps may only be released by public health authorities. To discourage fragmentation, each country will typically be restricted to one app, although Apple and Google stated that they would accommodate regionalized approaches if a country elects to do so. Apple and Google released reference implementations for apps utilizing the system, which can be used as a base.

On September 1, 2020, the consortium announced "Exposure Notifications Express" (EN Express), a system designed to ease adoption of the protocol by health authorities by removing the need to develop an app themselves. Under this system, a health authority provides parameters specific to their implementation (such as thresholds, branding, messaging, and key servers), which is then processed to generate the required functionality. On Android, this data is used to generate an app, and a configuration profile that can also be deployed to users via Google Play Services without a dedicated app. On iOS, the functionality is integrated directly at the system level on iOS 13.7 and newer without a dedicated app.{{Cite web|last=Brandom|first=Russell|date=2020-09-01|title=Apple and Google announce new automatic app system to track COVID exposures|url=https://www.theverge.com/2020/9/1/21410281/apple-google-coronavirus-exposure-notification-contact-tracing-app-system|access-date=2020-09-01|website=The Verge|language=en}}

The last information update on the “Exposure Notification Systems” partnership was a year end review issued by Google in December 2020:{{Cite web|url=https://blog.google/inside-google/covid-19/exposure-notifications-end-year-update/|title = Exposure Notifications: End of year update|date = 11 December 2020}} "we plan to keep you updated here with new information again next year". Nothing has however been issued on the one year anniversary of the launch of the “Exposure Notification Interface” API in spite of important changes on the pandemic front such as vaccination, variants, digital health passports, app adoption challenges as well as growing interest for tracking QR codes (and notifying from that basis) on a mostly airborne transmitted virus.{{Original research inline|date=June 2021}} The Frequently Asked Questions (FAQ) published document has not been revised since May 2020.{{Cite web |url=https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf |title=Archived copy |access-date=2020-04-27 |archive-date=2020-04-26 |archive-url=https://web.archive.org/web/20200426210251/https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf |url-status=dead }} Basic support remains provided through the apps store released by authorized public health agencies, including enforcement of the personal privacy protection framework as demonstrated on the UK NHS challenge in support of their contact tracers.{{Cite news|url=https://www.bbc.com/news/technology-56713017|title = NHS Covid-19 app update blocked for breaking Apple and Google's rules|work = BBC News}}

In June 2021, Google faced allegations that it had automatically downloaded Massachusetts' "MassNotify" app to Android devices without user consent. Google clarified that it had not actually downloaded the app to user devices, and that Google Play Services was being used to deploy an EN Express configuration profile that would allow it to be enabled via the Google Settings app without needing to download a separate app.{{Cite web|last=Amadeo|first=Ron|date=2021-06-21|title=Even creepier COVID tracking: Google silently pushed app to users' phones [Updated]|url=https://arstechnica.com/gadgets/2021/06/even-creepier-covid-tracking-google-silently-pushed-app-to-users-phones/|access-date=2021-06-22|website=Ars Technica|language=en-us}}

As of May 21, at least 22 countries had received access to the protocol.{{Cite web|title=Google and Apple unite to help countries like Australia fix their contact tracing apps|url=https://www.abc.net.au/news/2020-05-21/google-apple-technology-help-coronavirus-contact-tracing/12271728|date=2020-05-21|website=ABC News|language=en-AU|access-date=2020-05-21}} Switzerland and Austria were among the first to back the protocol.{{Cite web|title=Switzerland, Austria align with 'Gapple' on corona contact tracing|url=https://www.reuters.com/article/health-coronavirus-europe-tech/switzerland-austria-align-with-gapple-on-corona-contact-tracing-idUSL3N2CA36L|date=2020-04-22|work=Reuters|language=en|access-date=2020-05-06}} On April 26, after initially backing PEPP-PT, Germany announced it would back Exposure Notification,{{Cite news|date=2020-04-26|title=Germany flips to Apple-Google approach on smartphone contact tracing|language=en|work=Reuters|url=https://uk.reuters.com/article/uk-health-coronavirus-europe-tech-idUKKCN22807X|archive-url=https://web.archive.org/web/20200426110831/https://uk.reuters.com/article/uk-health-coronavirus-europe-tech-idUKKCN22807X|url-status=dead|archive-date=April 26, 2020|access-date=2020-04-26}} followed shortly after by Ireland {{Cite news|url=https://www.irishtimes.com/business/technology/hse-covid-19-tracing-app-data-will-be-stored-on-individual-devices-1.4240304|title=HSE Covid-19 tracing app data will be stored on individual devices|date=2020-04-29|newspaper=The Irish Times|access-date=2020-05-06|language=en}} and Italy.{{Cite web|url=https://bylinetimes.com/2020/05/01/is-it-safe-the-immuni-app-digital-surveillance-during-the-coronavirus-pandemic/|title=Is it Safe? THE IMMUNI APP Digital Surveillance during the Coronavirus Pandemic|date=2020-05-01|work=Byline Times / La Stampa|access-date=2020-05-06|language=en}} Despite already adopting the centralised BlueTrace protocol,{{Cite web|title=Five questions we need answered about the government's coronavirus contact tracing app|url=https://www.abc.net.au/news/science/2020-04-17/5-questions-the-governments-coronavirus-contact-tracing-app/12151264|date=2020-04-16|website=ABC News|language=en-AU|access-date=2020-05-21}} Australia's Department of Health and Digital Transformation Agency were investigating whether the protocol could be implemented to overcome limitations of its COVIDSafe app. On May 25, Switzerland became the first country to launch an app leveraging the protocol, SwissCovid, beginning with a small pilot group.{{cite web|date=25 May 2020|title=SwissCovid App startet in die Pilotphase|trans-title=SwissCovid app launched into pilot phase|url=https://www.bag.admin.ch/bag/de/home/das-bag/aktuell/medienmitteilungen.msg-id-79229.html|access-date=25 May 2020|language=de}}

In England, the National Health Service (NHS) trialed both an in-house app on a centralized platform developed by its NHSX division, and a second app using Exposure Notification.{{cite news|last1=Neville|first1=Sarah|last2=Bradshaw|first2=Tim|last3=Warrell|first3=Helen|title=UK starts to build second contact tracing app|url=https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b|access-date=8 May 2020|website=Financial Times|date=8 May 2020}} On June 18, the NHS announced that it would focus on using Exposure Notification to complement manual contact tracing, citing tests on the Isle of Wight showing that it had better cross-device compatibility (and would also be compatible with other European approaches), but that its distance calculations were not as reliable as the centralized version of the app,{{cite news|title=UK virus-tracing app switches to Apple-Google model|work=BBC News|date=18 June 2020|url=https://www.bbc.com/news/technology-53095336|access-date=2020-06-18}} an issue which was later rectified.{{cite arXiv|last1=Lovett|first1=Tom|last2=Briers|first2=Mark|last3=Charalambides|first3=Marcos|last4=Jersakova|first4=Radka|last5=Lomax|first5=James|last6=Holmes|first6=Chris|date=2020-07-09|title=Inferring proximity from Bluetooth Low Energy RSSI with Unscented Kalman Smoothers|class=eess.SP|eprint=2007.05057}}{{Cite web|title=Updates to the algorithm underlying the NHS COVID-19 app|url=https://www.turing.ac.uk/blog/updates-algorithm-underlying-nhs-covid-19-app|access-date=2021-06-30|website=The Alan Turing Institute|language=en}} Later, it was stated that the app would be supplemented by QR codes at venues.{{Cite web|last=O'Halloran|first=Joe|date=July 31, 2020|title=UK contact-tracing app to be launched 'shortly' as Northern Ireland deploys service|url=https://www.computerweekly.com/news/252486951/UK-contact-tracing-app-to-be-launched-shortly-as-Northern-Ireland-deploys-service|access-date=2020-07-31|website=Computer Weekly|language=en}} A study of the impact of Exposure Notification in England and Wales estimated that it averted 8,700 (95% confidence interval 4,700–13,500) deaths out of the 32,500 recorded from its introduction on 24 September 2020 to 31 December 2020.{{Cite journal|last1=Wymant|first1=Chris|last2=Ferretti|first2=Luca|last3=Tsallis|first3=Daphne|last4=Charalambides|first4=Marcos|last5=Abeler-Dörner|first5=Lucie|last6=Bonsall|first6=David|last7=Hinch|first7=Robert|last8=Kendall|first8=Michelle|last9=Milsom|first9=Luke|last10=Ayres|first10=Matthew|last11=Holmes|first11=Chris|date=2021-06-17|title=The epidemiological impact of the NHS COVID-19 app|journal=Nature|language=en|volume=594|issue=7863|pages=408–412|doi=10.1038/s41586-021-03606-z|pmid=33979832|bibcode=2021Natur.594..408W|s2cid=234484448|issn=0028-0836|doi-access=free}}

Canada launched its COVID Alert app, co-developed in partnership with BlackBerry Limited and Shopify,{{Cite web|date=2020-07-23|title=Here's a first look at the government's 'COVID Alert' contact tracing app|url=https://mobilesyrup.com/2020/07/23/heres-a-first-look-at-the-governments-covid-alert-contact-tracing-app/|access-date=2020-07-24|website=MobileSyrup|language=en}} on July 31 in Ontario. As of February 2022, only around 57,000 positive cases had been reported via the app, leading some critics to dismiss it as a failure.{{Cite web |date=2021-05-27 |title=Was Canada's COVID Alert app a hit or a miss? |url=https://www.ctvnews.ca/health/coronavirus/was-canada-s-covid-alert-app-a-hit-or-a-miss-1.5445730 |access-date=2022-05-07 |website=CTV News |language=en}}{{Cite web |last=Nardi |first=Christopher |title=With low uptake, Canada 'gave up' on its COVID Alert app months ago, Newfoundland and Labrador health minister reveals in live update |url=https://www.saltwire.com/atlantic-canada/news/with-low-uptake-canada-gave-up-on-its-covid-alert-app-months-ago-newfoundland-and-labrador-health-minister-reveals-in-live-update-100675459/ |access-date=2022-05-07 |website= |publisher=SaltWire Network |language=en}}{{Cite web |last=Turnbull |first=Sarah |date=2021-12-30 |title=COVID Alert app still active, but rarely used to record positive tests |url=https://www.ctvnews.ca/health/coronavirus/covid-alert-app-still-active-but-rarely-used-to-record-positive-tests-1.5723556 |url-status=live |archive-url=https://web.archive.org/web/20211230201100/https://www.ctvnews.ca/health/coronavirus/covid-alert-app-still-active-but-rarely-used-to-record-positive-tests-1.5723556 |archive-date=2021-12-30 |access-date=2022-01-02 |website=CTV News |language=en}}

In May 2020, Covid Watch launched the first calibration and beta testing pilot of the GAEN APIs in the United States at the University of Arizona.{{Cite web|url=https://www.kold.com/2020/05/28/ua-testing-app-trace-covid-cases-campus/|title=UA testing app to trace COVID-19 cases on campus|date=2020-05-28|website=KOLD News 13|language=en|access-date=2020-05-28}}{{Cite web|url=https://tucson.com/news/local/education/college/online-apps-likely-to-play-a-big-role-in-rebooting-ua-campus-for-fall-semester/article_a7fe0f69-0db4-5f10-ad76-f6b1b4190ea7.html/|title=Online apps likely to play a big role in rebooting UA campus for fall semester|date=2020-05-28|website=Github|language=en|access-date=2020-05-28}} In Aug 2020, the app launched publicly for a phased roll-out in the state of Arizona.{{Cite web|date=2020-08-18|title=UArizona and Covid Watch Launch COVID-19 Exposure Notification App|url=https://news.arizona.edu/story/uarizona-and-covid-watch-launch-covid-19-exposure-notification-app|access-date=2020-08-20|website=University of Arizona News|language=en}}{{Cite web|title=Covid Watch Arizona|url=https://apps.apple.com/us/app/covid-watch-arizona/id1521655110|access-date=2020-08-20|website=App Store|language=en-us}}{{Cite web|title=Covid Watch Arizona - Apps on Google Play|url=https://play.google.com/store/apps/details?id=gov.azdhs.covidwatch.android&hl=en_US|access-date=2020-08-20|website=play.google.com|language=en}}

The U.S. Association of Public Health Laboratories (APHL) stated in July 2020 that it was working with Apple, Google, and Microsoft on a national reporting server for use with the protocol, which it stated would ease adoption and interoperability between states.{{Cite web|date=2020-07-17|title=Bringing COVID-19 exposure notification to the public health community|url=https://www.aphlblog.org/bringing-covid-19-exposure-notification-to-the-public-health-community/|access-date=2020-09-01|website=APHL Lab Blog|language=en-US}}

In August 2020, Google stated that at least 20 U.S. states had expressed interest in using the protocol. In Alabama, the Alabama Department of Public Health, University of Alabama at Birmingham, and the University of Alabama System deployed the "GuideSafe" app for university students returning to campus, which includes Exposure Notification features.{{Cite web|last=Walsh|first=Lauren|date=2020-08-03|title=COVID-19 testing, monitoring system GuideSafe launches|url=https://abc3340.com/news/local/covid-19-testing-monitoring-system-guidesafe-launches|access-date=2020-08-05|website=ABC 33/40}}{{Cite web|date=2020-08-03|title=Alabama launches contact tracing app based on Google-Apple API|url=https://statescoop.com/alabama-launches-contact-tracing-app-based-on-google-apple-api/|access-date=2020-08-06|website=StateScoop|language=en}} On August 5, the Virginia Department of Health released its "COVIDWise" app — making it the first U.S. state to release an Exposure Notification-based app for the general public.{{Cite web|title=Virginia Set To Release COVIDWISE App To Public This Week|url=https://vpm.org/news/articles/15373/virginia-set-to-release-covidwise-app-to-public-this-week|access-date=2020-08-05|website=VPM.org|date=2 August 2020 |language=en}}{{Cite web|last=Wetsman|first=Nicole|date=2020-08-05|title=Apple and Google's COVID-19 tracking system will make its full US debut in new Virginia app|url=https://www.theverge.com/2020/8/5/21355500/virginia-apple-google-contact-tracing-app-covid-alabama|access-date=2020-08-05|website=The Verge|language=en}}{{Cite news|title=Virginia Unveils App To Aid Contact Tracing|url=https://www.npr.org/sections/coronavirus-live-updates/2020/08/05/899414953/virginia-unveils-app-to-aid-contact-tracing|access-date=2020-08-06|website=NPR.org|language=en}} North Dakota and Wyoming released an EN app known as "Care19 Alert", developed by ProudCrowd and using the APHL server (the app is a spin-off from an existing location logging application it had developed, based on one it had developed primarily for use by students travelling to attend college football away games).{{Cite web|title=ND launches Care19 Alert app to help reduce spread of COVID-19|url=https://www.minotdailynews.com/news/local-news/2020/08/nd-launches-care19-alert-app-to-help-reduce-spread-of-covid-19/|access-date=2020-09-01|website=minotdailynews.com|language=en-US}}{{Cite news|date=2020-08-14|title=Three more U.S. states launching coronavirus exposure warning apps|language=en|work=Reuters|url=https://ca.reuters.com/article/technologyNews/idCAKCN2592WR-OCATC|archive-url=https://web.archive.org/web/20201204153429/https://ca.reuters.com/article/technologyNews/idCAKCN2592WR-OCATC|url-status=dead|archive-date=December 4, 2020|access-date=2020-09-01}}

Maryland, Nevada, Virginia, and Washington, D.C. have announced plans to use EN Express. In September, Delaware, New Jersey, New York, and Pennsylvania all adopted "COVID Alert" apps developed by NearForm, which are based on its COVID Tracker Ireland app.{{Cite web|last=Goodin-Smith|first=Ellie Rushing, Oona|title=Contact tracing app tells Pennsylvanians if they've been exposed to coronavirus|url=https://www.inquirer.com/health/coronavirus/contact-tracing-app-pennsylvania-coronavirus-cases-20200923.html|access-date=2020-10-07|website=Philadelphia Inquirer|date=23 September 2020 |language=en-US}}{{Cite web|last=Gorey|first=Colm|date=2020-10-02|title=NearForm contact-tracing apps launched in New York and New Jersey|url=https://www.siliconrepublic.com/enterprise/new-york-new-jersey-contact-tracing-apps-nearform|access-date=2020-10-07|website=Silicon Republic|language=en}} Later that month, the Norwegian Institute of Public Health announced that it would lead development of an Exposure Notification-based app for the country, which replaces a centralized app that had ceased operations in June 2020 after the Norwegian Data Protection Authority ruled that it violated privacy laws.{{Cite web|title=NIPH starts work on a new solution for digital contact tracing|url=https://www.fhi.no/en/news/2020/niph-starts-work-on-a-new-solution-for-digital-contact-tracing/|access-date=2020-11-17|website=Norwegian Institute of Public Health|language=en|archive-url=https://web.archive.org/web/20210301004351/https://www.fhi.no/en/news/2020/niph-starts-work-on-a-new-solution-for-digital-contact-tracing/|archive-date=2021-03-01|url-status=dead}}{{Cite news|date=2020-10-21|title=Uden konkurrence: Netcompany vinder ordren på en ny norsk smittestop-app|url=https://www.computerworld.dk/art/253847/uden-konkurrence-netcompany-vinder-ordren-paa-en-ny-norsk-smittestop-app|access-date=2020-11-17|website=Computerworld|language=da}}

In Nov 2020, Bermuda launched the Wehealth Bermuda app developed by Wehealth, a Public Benefit Corporation, which was based on the Covid Watch app released in Arizona.{{Cite web|date=2020-11-24|title=The WeHealth Bermuda App Is Now Live|url=https://www.wehealth.org/news/wehealth-bermuda-app-is-now-live|access-date=2023-03-08|website=Wehealth News|language=en-US}}{{Cite web |date=2020-11-24 |title=Wehealth Bermuda on the Play Store |url=https://play.google.com/store/apps/details?id=org.wehealth.exposure |access-date=2023-03-08 |website=Google Play Store |language=en-US}}{{Cite web |date=2020-11-24 |title=Wehealth Bermuda on the App Store |url=https://apps.apple.com/us/app/wehealth-bermuda/id1535781209 |access-date=2023-03-08 |website=Apple App Store |language=en-US}}

Some countries, such as France, have pursued centralized approaches to digital contact tracing, in order to maintain records of personal information that can be used to assist in investigating cases.{{Cite news|last=Kelion|first=Leo|date=2020-05-20|title=Apple and Google's Covid-19 'watershed moment'|language=en-GB|work=BBC News|url=https://www.bbc.com/news/technology-52740131|access-date=2020-05-21}} The French government asked Apple in April 2020 to allow apps to perform Bluetooth operations in the background, which would allow the government to create its own system independent of Exposure Notification.{{Cite news|last=Fouquet|first=Helene|date=20 April 2020|title=France Says Apple Bluetooth Policy Is Blocking Virus Tracker|url=https://www.bloomberg.com/news/articles/2020-04-20/france-says-apple-s-bluetooth-policy-is-blocking-virus-tracker|access-date=27 April 2020|newspaper=Bloomberg.com}}

On August 9, the Canadian province of Alberta announced plans to migrate to the EN-based COVID Alert from its BlueTrace-based ABTraceTogether app.{{Cite web|title=Alberta to adopt national COVID-19 tracing app|url=https://edmontonjournal.com/news/politics/alberta-to-adopt-national-covid-19-tracing-app|access-date=2020-08-09|website=Edmonton Journal|language=en-CA}}{{Cite web|title=Alberta's contact-tracing app only works on iOS when phone is unlocked, app running in foreground|url=https://globalnews.ca/news/6898691/ab-trace-together-contact-app-alberta-covid-ios/|access-date=2020-08-09|website=Global News|language=en-US}} This did not occur, and on November 6 Premier of Alberta Jason Kenney announced that the province would not do so, arguing that ABTraceTogether was "from our view, simply a better and more effective public health tool", and that they would be required to phase out ABTraceTogether if they did switch.{{Cite web|last=Franklin|first=Michael|date=2020-11-06|title=Alberta will not adopt national COVID-19 Alert app: Kenney|url=https://calgary.ctvnews.ca/alberta-will-not-adopt-national-covid-19-alert-app-kenney-1.5178790|access-date=2020-11-17|website=CTV News Calgary|language=en}} British Columbia has also declined to adopt COVID Alert, with provincial health officer Bonnie Henry stating that COVID Alert was too "non-specific".

Australia's officials have stated its COVIDSafe, which is based on Singapore's BlueTrace, will not be shifting from manual intervention.{{Cite web|last=Grubb|first=Ben|date=2020-06-28|title='There's no way we're shifting': Australia rules out Apple-Google coronavirus tracing method|url=https://www.smh.com.au/technology/there-s-no-way-we-re-shifting-australia-rules-out-apple-google-coronavirus-tracing-method-20200629-p5573s.html|access-date=2020-09-23|website=The Sydney Morning Herald|language=en}}{{Cite web|title=Apple/Google privacy preserving COVID-19 contact tracing. · Issue #10 · AU-COVIDSafe/mobile-ios|url=https://github.com/AU-COVIDSafe/mobile-ios/issues/10|access-date=2020-09-23|website=GitHub|language=en}}

In the United States, states such as California and Massachusetts declined to use the technology, opting for manual contact tracing.{{Cite magazine |title=Health Officials Say 'No Thanks' to Contact-Tracing Tech |url=https://www.wired.com/story/health-officials-no-thanks-contact-tracing-tech/ |last1=Volgelstein |first1=Fred |last2=Knight |first2=Will |date=2020-05-08 |magazine=Wired |language=en |access-date=2020-05-10}} California later reversed course and adopted the system in December 2020.

Chinese vendor Huawei (which cannot include Google software on its current Android products due to U.S. sanctions) added a OS-level DP-3T API known as "Contact Shield" to its Huawei Mobile Services stack in June 2020, which the company states is intended to be interoperable with Exposure Notification.{{Cite web|date=2020-06-08|title=Huawei releases its "Contact Shield" API for COVID-19 contact tracing|url=https://www.xda-developers.com/huawei-hms-core-contact-shield-api-covid-19-contact-tracing/|access-date=2020-10-07|website=xda-developers|language=en-US}}

{{notelist}}

{{Reflist}}

• [https://www.google.com/covid19/exposurenotifications/ Official website] (Google)
• [https://developer.apple.com/exposure-notification/ Official website] (Apple)
• [https://www.apple.com/newsroom/2020/04/apple-and-google-partner-on-covid-19-contact-tracing-technology/ Announcement] (Apple)
• [https://blog.google/documents/57/Overview_of_COVID-19_Contact_Tracing_Using_BLE.pdf Overview presentation] (Google)
• [https://www.apple.com/covid19/contacttracing/ Technical specifications] (Apple)
• [https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf Exposure Notification: Frequently Asked Questions] {{Webarchive|url=https://web.archive.org/web/20200426210251/https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf |date=2020-04-26 }} (Apple/Google)

{{Apple}}

{{Google LLC}}

Category:Apple Inc. software

Category:Digital contact tracing protocols with decentralized reporting

Category:Digital contact tracing protocols

Category:Google software

Category:Mobile applications

Category:Scientific and technical responses to the COVID-19 pandemic

Category:Software associated with the COVID-19 pandemic