Today, Apple and Google have shared more information about their automatic exposure notification system, including sample user interface designs for potential apps and restrictions on the final use of the system.
The Apple and Google system, first launched on April 10, tracks potential cases of COVID-19 via Bluetooth low energy signals, enabling retroactive exposure notifications while using encrypted keys to protect the privacy of unexposed users. Companies have committed to end the system as soon as the public health crisis is over.
The new interface examples give an impression of how these notifications work in practice and how companies want to ensure proactive approval. They are intended for developers and show how certain warnings are displayed and when certain API calls should be made.
The companies also share a library of reference codes (an SDK for Android and an Xcode toolkit for iOS), which the team hopes will serve as a "start-up aid" for app development by public health authorities. Nevertheless, representatives made it clear that the code itself should never be sent as an application.
The companies declined to name certain public sector partners, but said they were proactively addressed by multiple governments because of their unique operating system-level access to Bluetooth systems in smartphones.
The companies also laid down six specific principles expected from public sector partners. In particular, the apps can only be used for COVID-19 response efforts, must not use location services, and require consent before accessing the API or sharing a positive diagnosis. They also do not allow any form of targeted advertising in the resulting apps. Existing apps that use targeted advertising or location services must deactivate these systems before they can access the API.
In a new twist, companies plan to restrict access to a single app per country to avoid fragmentation. However, the wording of the principle leaves the door open for countries like the United States where the response has been led by states.
"If a country has opted for a regional or governmental approach," the restriction says, "companies are ready to support these authorities."