Rather than tracking individuals' precise movements and location, the new voluntary contact tracing network that the companies announced Friday would use Bluetooth technology to determine when iPhone and Android device users have come in close proximity with someone who has reported a positive COVID-19 test result and allow public health officials to directly notify those individuals of the potential exposure.
Similar initiatives that have been rolled out in recent weeks to enable more effective contact tracing — a tool that public health officials have said is key to containing the spread of the virus and determining when shuttered businesses and schools can safely reopen — have been met with concerns over how the data is being used and the potential for sweeping government surveillance. But Apple and Google emphasized Friday that user privacy and security were "central to the design" of the system produced by their rare collaboration.
"Privacy, transparency, and consent are of utmost importance in this effort, and we look forward to building this functionality in consultation with interested stakeholders," the companies said in their joint announcement, which was accompanied by the release of draft technical documentation and a promise that they would "openly publish information about our work for others to analyze."
Apple and Google said they plan to implement their system, which they're calling "Privacy-Preserving Contact Tracing," in two stages "while maintaining strong protections around user privacy."
The first step is set to commence in May, when the companies said they are planning to release application programming interfaces that will allow developers to build the apps necessary to run the program. These official apps, which will be available for download in Apple's App Store and Google Play, will enable users to communicate with public health authorities to voluntarily report positive results and be notified when they have come into close contact with an infected individual, according to the tech giants.
Apple and Google have said the system won't collect personally identifiable information or user location data, since the network relies on Bluetooth beaconing rather than location to detect proximity to other devices, and that those who elect to share their diagnosis won't have their identities shared with the tech giants or other users. Additionally, the list of people whom users have been in contact with will be stored remotely on their personal devices, users' unique proximity identifiers will change roughly every 15 minutes, and the data will only be used by public health authorities for contract tracing to manage the coronavirus pandemic, according to the companies.
For the second phase of the rollout, the companies will work "in the coming months" to expand the Bluetooth contact tracing platform by building this functionality into the underlying device platforms.
"This is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities," the companies said.
In responding to the news, American Civil Liberties Union surveillance and cybersecurity counsel Jennifer Granick gave credit to Apple and Google for pushing an approach "that appears to mitigate the worst privacy and centralization risks" but cautioned that "there is still room for improvement."
"We will remain vigilant moving forward to make sure any contract tracing app remains voluntary and decentralized, and used only for public health purposes and only for the duration of this pandemic," she said.
Granick added that no contact tracing app could be fully effective until there's widespread, free and quick testing and equitable access to health care, and until people could be assured that they can trust this technology.
"People will only trust these systems if they protect privacy, remain voluntary, and store data on an individual's device, not a centralized repository," Granick said.
The Electronic Privacy Information Center noted that while it has previously testified before Congress in support of "genuine privacy-enhancing techniques," which the group's President Marc Rotenberg has defined as technologies that "minimize or eliminate the collection of personally identifiable information." The group reiterated Friday that these techniques need to be "robust, scaleable and provable."
The tech giants said in their announcement Friday that they were inspired to embark on the unprecedented joint effort by the "spirit of collaboration" that has been embraced by governments, health authorities, software developers and others around the world to fight the spread of COVID-19, the respiratory disease caused by the novel coronavirus.
"All of us at Apple and Google believe there has never been a more important moment to work together to solve one of the world's most pressing problems," the companies said. "Through close cooperation and collaboration with developers, governments and public health providers, we hope to harness the power of technology to help countries around the world slow the spread of COVID-19 and accelerate the return of everyday life."
The number of coronavirus-linked deaths globally topped 100,000 on Friday as suspected cases rose past 1.6 million, according to data compiled by Johns Hopkins University. In the U.S., more than 18,000 deaths and nearly 500,000 cases have been reported.
The virus' rapid and persistent spread has prompted governments around the world to look into ways to use location data culled from smartphones to track people who have tested positive for the disease. The move has raised concerns about what governments will do with this data and if the information can be tied to specific individuals.
Separate from the effort announced Friday, Google recently revealed plans to start publishing so-called COVID-19 mobility reports showcasing how people are moving around amid the pandemic, prompting a pair of Democratic senators to press the tech giant in a Tuesday letter about what types of data it will be using for the reports and with whom it will share this information.
Lawmakers have also raised alarms about the potential for governments to use location data for surveillance purposes. As this scrutiny mounts, groups ranging from the ACLU to Public Knowledge have urged policymakers and companies to ensure that any personal data or other information used to fight, measure or track the pandemic be "necessary and proportionate" to both the pandemic response and the safety of the public.
--Editing by Haylee Pearl.
For a reprint of this article, please contact reprints@law360.com.