Apple and Google Flip the Switch on Exposure Notification

The Exposure Notification API that Apple and Google announced back in April is now actually available to public health agencies. As of today, health authorities can start building apps on top of it, and the underlying framework is baked into iOS and Android at the operating system level rather than living as a bolt-on app.

The pitch here has always been about privacy-by-design. Instead of tracking where you’ve been via GPS, the system uses Bluetooth to log anonymous, rotating identifiers exchanged between nearby phones. If someone later reports a positive diagnosis through a participating health app, anyone whose phone swapped identifiers with theirs during the relevant window gets a notification. No location history, no central database of everyone’s movements — at least that’s the design goal, and it’s a meaningfully different approach than the location-based contact tracing some other countries have rolled out.

Putting this at the OS level instead of requiring a standalone app matters more than it might sound. Bluetooth-based background scanning is brutal on battery life and reliability when it’s implemented purely in userland — apps get throttled, killed, or restricted by the OS in ways that make constant background scanning spotty at best. By building the exposure logging into the platform itself, Apple and Google sidestep a lot of that friction. It’s a rare case of the two companies, normally fierce competitors, agreeing on a shared technical spec and shipping matching implementations on both platforms simultaneously.

Who’s actually using it

Interest so far comes from a mix of U.S. states and roughly 22 countries that have expressed intent to build on the API. Notably, this is opt-in infrastructure — Apple and Google aren’t shipping a contact-tracing app themselves. They’re providing the plumbing; individual health agencies still have to build the actual apps, decide how notifications are worded, and handle the public health workflow around a positive result. That division of labor is deliberate, presumably to keep the tech companies out of the business of dictating public health policy while still controlling the privacy and security guarantees of the underlying protocol.

Whether this actually helps flatten any curves is a separate question from whether the engineering works. Adoption is going to be the real bottleneck — a notification system is only useful if enough of the population has it running and enough people who test positive actually use a compatible app to report it. Given how fragmented state-level and country-level responses have already been, getting meaningful penetration seems like a genuinely hard coordination problem, tech aside.

Still, from a pure systems design standpoint, this is a solid answer to “how do you do proximity tracing without turning it into a surveillance tool.” Worth watching which agencies actually ship apps on top of it in the coming weeks, and whether the privacy guarantees hold up once real-world usage starts stress-testing them.