Apple and Google Team Up on a Contact-Tracing API

Today brought one of those announcements that makes you sit up: Apple and Google, two companies that normally compete on everything from mobile OS defaults to app store rules, said they’re jointly building technology to support COVID-19 contact tracing across both platforms.

The core problem they’re solving is a real one. If public health agencies want to build apps that alert people when they’ve been near someone who later tests positive, those apps need to work regardless of whether a phone is running iOS or Android. Without cooperation from the platform owners, you’d end up with fragmented, unreliable apps that miss a huge chunk of interactions simply because Bluetooth background behavior differs between operating systems. Apple and Google building a shared API removes that fragmentation problem at the source.

How it’s supposed to work

The system, which the two companies are calling “exposure notification,” relies on Bluetooth Low Energy rather than GPS or cell-tower data. Phones will broadcast randomized, anonymous identifiers that rotate frequently, and other nearby phones log those identifiers. If a person is later diagnosed, their recent identifiers can be marked as positive, and other phones that logged a matching identifier get a notification of possible exposure.

Notably, no location data is part of this design, at least based on what’s been described today. That’s a deliberate choice, presumably to blunt the obvious surveillance and privacy objections that any contact-tracing scheme was always going to invite. Anonymous, rotating Bluetooth tokens are a much harder thing to weaponize for tracking someone’s movements than raw GPS logs.

Access to the API is being restricted to public health authorities rather than opened up to any developer who wants to build a tracing app. That’s a sensible guardrail — it keeps a flood of low-quality or predatory apps from launching under the “contact tracing” banner and abusing Bluetooth permissions for unrelated data collection.

Why this matters right now

We’re several weeks into widespread lockdowns in much of the world, and one of the recurring conversations among epidemiologists has been how to reopen without triggering a second wave. Manual contact tracing doesn’t scale to the case volumes many countries are dealing with. An app-based system, done well, could let health authorities identify exposure risk faster than phone interviews ever could.

The plan reportedly involves two phases: an API in May that health authorities can build apps on top of, followed later by deeper OS-level support that would let this functionality work even without installing a separate app. That second phase is the more ambitious piece, and I’ll believe it when I see it shipped.

There are obvious open questions. How do you prevent false positives from, say, two phones near each other through a wall? How do health authorities verify a positive test result without creating a new attack vector for pranksters flooding the system with fake reports? And will people actually opt in, given a well-earned suspicion of Bluetooth tracking apps in general? None of this is solved yet — today’s announcement is a technical foundation, not a finished product. But getting Apple and Google to agree on anything jointly is rare enough that it’s worth noting.