Apple, Google impose strict Covid-19 app data rules

Apple and Google released sample code enabling development of new Covid-19 (coronavirus) exposure notification tools, but noted apps using their contact tracing technology face a strict set of privacy rules.

Terms of service specify each company’s Exposure Notification APIs may only be used by developers working for, or on behalf of, a government health authority and must be applied exclusively to Covid-19 response efforts rather than other purposes, for example policing or quarantine enforcement.

Apps cannot request data revealing the device’s precise location, instead using anonymous Bluetooth identifiers to determine potential exposure to an infected individual, which are discarded after 30 days.

And the apps must be voluntary: people testing positive must give approval for the information to be shared. Developers must also minimise collection of personal data collection, blocking the sale, licensing or use for advertising.

Only one app using the API is permitted per country, unless otherwise approved.

The move comes less than a month after the pair announced they would work together to build a virus tracking system spanning their iOS and Android platforms.