Apple in May 2020 introduced an Exposure Notification System, which was designed to let public health authorities and governments worldwide help people figure out if they've been exposed to COVID-19, and if so, what steps to take next to minimize the spread of the virus.

As the pandemic has waned, various governmental agencies have been gradually shutting down their Exposure Notification systems. With the expiration of the COVID-19 national state of emergency in the United States on May 11, 2023, the system is no longer functional in most of the over 30 states that had adopted the system.

Exposure Notifications W People and Text

Exposure Notification Explained

Exposure Notification started out as contact tracing, an Apple-Google initiative that was announced in early April 2020 to limit the spread of COVID-19.

Apple and Google created an API that is designed to allow iPhones and Android smartphones to interface with one another for contact tracing purposes, so if and when you happen to be nearby someone who is later diagnosed with COVID-19, you can get a notification and take the appropriate steps to self isolate and get medical help if necessary.

Determining whether you've come into contact with someone relies on your iPhone, which, using the exposure notification API, interacts with other iPhones and Android smartphones over Bluetooth whenever you're around someone else who also owns a smartphone, exchanging anonymous identifiers.

Apple and Google developed the underlying APIs and Bluetooth functionality, but they did not develop the apps that use those APIs. Instead, the technology was incorporated into apps designed by public health authorities worldwide, which can use the tracking information to send notifications on exposure and follow up with recommended next steps. Apple and Google also implemented an "Express" feature that allows Exposure Notifications to work in partnership with health authorities, but without an Exposure Notification app.

The APIs were created with privacy and security in mind, and app usage is opt-in rather than mandatory.

How Exposure Notification Works

Almost everyone has a smartphone, which makes them ideal for determining who you've come in contact with. Exposure notification has a self-explanatory name, and in a nutshell, the feature was designed to send you a notification if you've been in proximity to a person who is diagnosed with COVID-19.

Here's a detailed, step-by-step walkthrough on how it works:

  1. Two people, Ryan and Eric, are both at the same grocery store shopping for food on a Tuesday afternoon. Eric has an ‌iPhone‌ and Ryan has an Android phone, both with a health app that uses the exposure tracking API or the Express Exposure Notification feature.
  2. There's a long wait, so Eric and Ryan are standing in the checkout line together for approximately 10 minutes. During this time, each of their phones is transmitting entirely anonymous identifier beacons, and picking up the identifier beacons transmitted by the other person. Their phones know they've been in contact and store that information on the device itself, transmitting it nowhere else.
  3. A week later, Ryan comes down with COVID-19 symptoms, sees a doctor, and is diagnosed with COVID-19. He opens up his Android phone, verifies his diagnosis using documentation from a healthcare provider, and taps a button that uploads his identifier beacon to a centralized cloud server.
  4. Later that day, Eric's ‌iPhone‌ downloads a list of all recent beacons from people that have contracted COVID-19. Eric then receives a notification that he was in contact with someone that has COVID-19 because of his interaction with Ryan at the grocery store.
  5. Eric does not know it was Ryan who has COVID-19 because no personally identifiable information was collected, but the system knows Eric was exposed to COVID-19 for 10 minutes on Tuesday, and that he was standing close to the person who exposed him based on the Bluetooth signal strength between their two phones, allowing the app to provide the appropriate information.
  6. Eric follows the steps from his local public health authority on what to do after COVID-19 exposure.
  7. If Eric later comes down with COVID-19, he follows the same steps listed above to alert people he's been in contact with, allowing everyone to better monitor for potential exposure.

Apple and Google also created a handy graphic that explains the process, which we've included below:

apple google contact tracing slide

apple google contract tracing

What You Need to Do to Use Exposure Notification

Using Exposure Notification in supported countries on a device running the latest version of iOS requires opening up the Settings app, selecting the "Exposure Notifications" section, and then tapping on "Turn on Exposure Notifications."

exposurenotificationsios14
From here, your ‌iPhone‌ will let you know if an Exposure Notification app is available in your state, country, or region, providing details on how to download it. You'll also be informed if you can use Exposure Notifications without an app through the Express feature, or Exposure Notifications are unavailable in your area at this time.

Exposure Notification is a feature that's off by default, and actually using the API requires you to toggle on the feature and in some cases, download an app from a verified health authority. Many countries are developing country and state-specific apps that users can download.

Without explicitly opting in to use the Exposure Notifications feature, the Exposure Notification API on the ‌iPhone‌ doesn't do anything. Once you've downloaded an app and consented to using it, or consented to using the Express option, the Exposure Notification feature will become active on your smartphone.

Cross-Platform App Communication

Apple and Google have both worked to create APIs for exposure notifications that work together so ‌iPhone‌ and Android smartphones can interface with one another and you'll receive notifications if exposure happens even if the person you've been in contact with has an Android smartphone.

On iOS, Exposure Notification works on devices running iOS 13 and later, including iOS 14, iOS 15, and iOS 16.

Exposure Notification Opt-In

Exposure Notifications on the ‌iPhone‌ are off by default and must be toggled on. Using the feature requires users to consent to signing up for the exposure notification system, which is part of the sign up process. Exposure Notifications can be toggled on using the "Exposure Notifications" section in the Settings app.

If you do, at some point, get COVID-19, there's a separate consent process for anonymously alerting people that you've been in contact with. The feature needs express consent to inform others of the diagnosis, and nothing happens automatically.

Disabling Exposure Notification

You can disable Exposure Notifications entirely by opening up the Settings app and tapping "Turn off Exposure Notifications." If you've downloaded an Exposure Notification app, you can also delete the app to disable Exposure Notifications. Since Exposure Notifications is off by default, if you've never used it, you don't need to do anything to disable it.

Exposure Notification Verification

When a person is diagnosed with COVID-19, before an alert is sent out to the people they've been in contact with, the apps that are using Apple and Google's exposure notification APIs require verification that a person has tested positive for the disease.

This prevents people from using the system maliciously to trick others into believing exposure has happened when it has not.

As an example, a person who tests positive for COVID-19 might receive a QR code with their test results, which could be scanned into an exposure notification app for verification purposes. The verification process varies by region, according to Apple.

How Exposure Notifications Work

As explained above, with a health app that uses the exposure notification API installed or the Express system activated with express consent, your smartphone exchanges anonymous identifiers with each person you come in contact with that also has an app that uses the API.

Your phone keeps a list of these identifiers on it, and this list remains on your device -- it is not uploaded anywhere. The exception is if you're diagnosed with COVID-19 and then follow the steps to send out notifications to the smartphones that have been in contact with yours.

In this situation, the list of random identifiers that your ‌iPhone‌ has been assigned over the course of the previous 14 days is sent to a centralized server. Other people's iPhones check this server and download that list, checking it against the identifiers stored on their own iPhones. If there's a match, they receive a notification about exposure with more information about the steps to take next.

Matches are made on device rather than on a server in a central location, which preserves privacy while also making sure people know about possible exposure.

For a more simple explanation, here's a step-by-step walkthrough on how it works:

  1. Ryan and Eric interact at the grocery store. During this interaction, Ryan's Android phone has a random identifier number, 12486, which is unique to Ryan's phone (and which changes every 15 minutes).
  2. Eric's ‌iPhone‌ records Ryan's random identifier number, 12486, and sends Ryan his own random identifier, 34875. Both Ryan and Eric are in contact with a dozen people at the grocery store, so their smartphones download random identifiers from all of these phones.
  3. Ryan contracts COVID-19, confirms his diagnosis in the app, and consents to upload all of the identifiers his phone has used for the last two weeks (including 12486) to a central server accessible by Eric's COVID-19 app. At this point, Ryan's identifier is shared with a central database, but these random identifier numbers are not associated with any personal information and don't include location data.
  4. Eric's phone downloads the list of identifiers of people who have been diagnosed with COVID-19, which includes Ryan's identifier, 12486, and compares it against the list of identifiers that have been stored based on Eric's interactions.
  5. A match is made, so Eric receives a notification that he has been in contact with someone who has COVID-19 and he receives info on what steps to take next.

Public health authorities will have access to information that includes the amount of time that Eric and Ryan's phone were in contact and the distance between them, as determined by Bluetooth signal strength, which can be used to estimate distance.

Based on this information, the Exposure Notifications System can deliver location-specific, tailored notifications to Eric, perhaps letting him know his exposure level and potential danger based on those factors. The system will know the day he was exposed, how long the exposure lasted, and the Bluetooth signal strength of that contact. No other personal information is shared.

Each public health authority is able to define what constitutes an exposure event and the number of exposure events an individual has had, plus it allows apps to factor transmission risk of positive cases into their definitions of an exposure event, all of which will impact how and when exposed users are contacted.

App Demonstrations

Apple and Google provided samples on how apps will work to give users an idea of what to expect before making a download. In iOS 13.5, new menu was added under Settings > Health > COVID-19 Exposure Logging to let users know which public health authority app they're using along with a list of exposure checks, which can be deleted.

covid 19 exposure app settings
When a user is potentially exposed to COVID-19, the app will provide a push notification letting them know about the incident. All exposure events for the last 14 days are listed in the app, and details include whether a diagnosis was verified and when you were near the person who later became sick.

covid 19 app positive exposure

When Data is Shared

For the most part, the exposure notification system runs on your device. Identifiers are collected and matched entirely on your smartphone and are not shared with a central system. There are two exceptions to this:

  1. When a user is diagnosed with COVID-19 and chooses to report that positive diagnosis to the contact tracing system, the most recent identifier beacons (from the last 14 days) are added to the positive diagnosis list shared by a public health authority to allow others who came in contact with that identifier to be alerted.
  2. When a user is notified through their smartphone that they've come into contact with an individual who has tested positive for COVID-19, the day the contact occurred, how long it lasted, and the Bluetooth signal strength of that contact is shared.

Exposure Notification Privacy Details

First and foremost, full privacy details on exposure notification are available on Apple's website, but we'll cover some important frequently asked questions about privacy below.

  • No identifying info - Your name, Apple ID, and other information are never shared in or associated with apps that use the exposure tracking API.
  • No location data - The system does not collect, use, or share location data. Exposure notification isn't for tracking where people are, but for determining whether a person has been around another person.
  • Random identifiers - Your ‌iPhone‌ is assigned a random, rotating identifier (a string of numbers) that is transmitted using Bluetooth to other nearby devices. Identifiers change every 10 to 20 minutes.
  • On-device operation - Identifiers that your phone comes into contact with, or phones that come into contact with your identifier, are stored on device and are not uploaded anywhere without consent.
  • Consent-based sharing - If you do test positive for COVID-19, the people you have been in contact do not receive an alert without express permission.
  • On-device identifier matching - If you contract COVID-19 and consent to share that information, your identifier list from the last two weeks is uploaded to a central server that other devices can check to identify a match on their iPhones.
  • Opt-in - Exposure notification is entirely opt-in. You do not need to use the feature, and it does not work unless you download an app that uses the API. It also does not work if you turn off the Exposure Notifications option in the Settings app.
  • Data sharing with Apple/Google - Apple and Google do not receive identifying information about the users, location data, or any other devices the user has been in proximity of.
  • Data monetization - Apple and Google will not monetize the exposure notification project.
  • Verified health apps only - Apple's APIs are only able to be used by public health authorities around the world. Apps must meet specific criteria around privacy, security, and data control. Apps can access a list of beacons provided by users confirmed as positive for COVID-19 who have opted in to sharing them, but no personally identifiable information is included.
  • Disabling exposure notification - Apple and Google can disabled the exposure notification system on a regional basis when it is no longer needed.

Restrictions for Apps

Apps need to follow a number of restrictions to be approved to use the Exposure Notification API. Only one app per country is allowed, in order to make sure there's no fragmentation and to promote high user adoption.

The exception is if a country has opted for a regional or state approach, which Apple and Google support. The following restrictions must also be followed:

  • Apps must be created by or for a government public health authority and they can only be used for COVID-19 response efforts.
  • Apps must require users to consent before the app can use the API.
  • Apps must require users to consent before sharing a positive test result with the public health authority.
  • Apps should only collect the minimum amount of data necessary and can only use that data for COVID-19 response efforts. All other uses of user data, including targeting advertising, is not permitted.
  • Apps are prohibited from seeking permission to access Location Services.

Apps That Use the Exposure Notification API

So far, Switzerland, Latvia, Italy, Germany, Poland, Saudi Arabia, Ireland, Croatia, Denmark, Netherlands, Scotland, Canada, Japan, England, Wales, Belgium, New Zealand, and Norway have all launched Exposure Notification apps or use Apple's Exposure Notification express feature.

In the United States, Virginia, North Dakota, Arizona, Delaware, Nevada, Alabama, Colorado, Wyoming, North Carolina, Pennsylvania, Michigan, Maryland, New York, New Jersey, Minnesota, Washington, Connecticut, Nevada, the District of Columbia, California, and Utah launched Exposure Notification apps or took advantage of Apple's "Express" feature that allows for notifications without an app.

‌iPhone‌ users can have more than one Exposure Notification app installed, but only one can be active at a time. Options to control which app is functional can be found in Privacy > Health > COVID-19 Exposure Logging.

Exposure Notifications Express

Introduced as part of iOS 13.7, Exposure Notifications Express is the operating-system level second-generation version of the Exposure Notification API, allowing states, countries, and regions to take advantage of the Exposure Notification System without having to build an entire app.

exposurenotificationexpress
Exposure Notifications Express can be thought of as Exposure Notifications without an app, but using the feature still requires oversight by a public health authority in a given area.

Basically, public health authorities that want to use Exposure Notifications Express can instead provide Apple and Google with information about how to reach the public health authority, guidance for residents, and recommendations on potential actions.

Public health authorities provide a name, logo, criteria for triggering an exposure notification, and the materials to be presented to users in case of exposure, with Apple and Google using this information to offer an Exposure Notifications System to customers on behalf of the public health authority.

Exposure Notifications Express programs from various areas are interoperable with one another and existing Exposure Notifications apps that have rolled out. Public health authorities can still choose to build their own custom apps instead of using Exposure Notifications Express.

Privacy continues to be a focus with the new feature. Even though an app is not necessarily required in an area where a public health authority has opted into Exposure Notifications Express, it still needs to be expressly enabled on an ‌iPhone‌ by opening up the Settings, navigating to the Exposure Notification section, and tapping "Turn on Exposure Notifications." Opting out at any time is possible.

Health Organization Partners

The API was developed with a number of health authorities, including the CDC, the Association of Public Health Laboratories, the Association of State and Territorial Health Officials, the Council of State and Territorial Epidemiologists, and the Public Health Informatics Institute of the Taskforce for Global Health.

More Information

Apple and Google both have dedicated websites with more information about exposure notification, and that should be your first stop if you want to know more about it and how it works.

Guide Feedback

Have a question about the exposure notification system, know of something we left out, or want to offer feedback? Send us an email here.

Related Articles

apple developer banner

Apple Says COVID 'Health Pass' Apps Are Limited to Developers Working With Public Health Authorities

Tuesday February 16, 2021 3:03 pm PST by
Apple today informed developers that "health pass" apps can only be submitted by developers that are working with recognized public health authorities. A "health pass" app is classified as an app that generates a pass that's used to enter buildings and access in-person services based on testing and vaccination records. Apple says that to make sure these apps are responsibly handling...
Exposure Notifications W People and Text

NHS COVID-19 Contact Tracing App Has Told 1.7 Million in England and Wales to Isolate Since September

Tuesday February 9, 2021 12:58 am PST by
NHS COVID-19, the contact tracing app created by the U.K. government, has alerted 1.7 million users to isolate following close contact with someone who goes on to test positive. That's according to an official GOV.UK press release from the Department of Heath and Social Care, which has been collating data about the app since it was launched in September 2020. Over 1.7 million app users...
californiaexposurenotifications1

California's Exposure Notification System Rolling Out on iPhone Thursday

Monday December 7, 2020 9:22 am PST by
Apple and Google's Exposure Notification system has been rolling out to many states and countries across the world, and starting this Thursday, California, the most populous state in the U.S., will get access to Exposure Notifications. California COVID Notify has been in testing at UC Berkeley and other UC campuses since earlier this year, but on Thursday, Exposure Notifications are set to...
115056693 error

iPhone 12 Upgrades Interfering With COVID-19 Contact-Tracing App Notifications, How to Fix

Sunday October 25, 2020 11:40 am PDT by
Some iPhone 12 and iPhone 12 Pro users in the UK have reported that their new devices are recieving an error message in the "NHS COVID-19" contact-tracing app, rendering it unusable (via BBC News). 'Unfortunately, You Can't Run This App' Similar errors and issues have been reported in other regions contact tracing apps that also use Apple's Exposure Notification API. The error appears to...
Exposure Notifications W People and Text

New York and New Jersey Launch Contact Tracing Apps With Exposure Notification API

Friday October 2, 2020 2:43 am PDT by
New York and New Jersey have launched COVID-19 contact tracing apps based on Apple and Google's Exposure Notification technology. In a press release on the New York State website, Governor Andrew M. Cuomo and New Jersey Governor Phil Murphy announced the release of COVID Alert NY and COVID Alert NJ for iPhone and Android users. Like other apps that take advantage of the Exposure...
Exposure Notifications W People and Text

'NHS COVID-19' Contact Tracing App With Exposure Notification API Launches in England and Wales

Wednesday September 23, 2020 1:36 pm PDT by
NHS COVID-19, a contact tracing app created by the UK government, is rolling out to residents of England and Wales as of today, with the app available from the iOS App Store. The app's debut comes a week and a half after the UK government said that it would launch on September 24, and a month and a half after the app became available to NHS Volunteer Responders, Isle of Wight residents, and...
nhs logo

England and Wales' Contact-Tracing App With Apple and Google API to Launch September 24

Friday September 11, 2020 6:56 am PDT by
An NHS COVID-19 contact-tracing app using the Apple and Google API is finally set to launch in England and Wales on September 24, the UK government has announced today (via BBC News). The app performs distance-based contact-tracing like similar apps released in other countries. It will also allow users to scan QR codes to register visits to hospitality venues to aid contact-tracing. UK...
Exposure Notifications W People and Text

North Dakota, Wyoming and Alabama Launching Exposure Notification Apps Soon

Thursday August 13, 2020 3:50 pm PDT by
North Dakota, Wyoming, and Alabama are all launching contact tracing apps that take advantage of Apple and Google's Exposure Notification API to cut down on the spread of the coronavirus, reports Reuters. North Dakota's app, Care19 Alert, is launching today, while Wyoming plans to launch an app on Friday. Alabama's app, which has been in testing with university students and staff, will...
exposure text feature centered 1

England's Exposure Notification App Entering Trials as Engineers Work Out Bugs

Wednesday August 12, 2020 10:10 am PDT by
England is developing a contact tracing app that uses Apple and Google's Exposure Notification API, and while there are still bugs to be worked out, it's set to be trialed in a few areas in the country starting tomorrow. According to the BBC, the app will be trialed on the Isle of Wight and in one other area with a volunteer group. The experiment is being launched quietly as there's no word...
virginia covid app

Virginia Releases COVID-19 Exposure App Based on Apple and Google API

Wednesday August 5, 2020 7:39 am PDT by
Virginia this week became the first U.S. state to release a COVID-19 exposure notification app using Apple's and Google's jointly developed API, as noted by Kyle Carmitchel on Twitter. The app is available now on the App Store. The COVIDWISE app allows you to be notified if someone you have been near later tests positive for COVID-19, so long as that other person confirms their positive test ...
Exposure Notifications W People and Text

Apple and Google Update Exposure Notification API, 20 U.S. States Expected to Release Apps Soon

Friday July 31, 2020 10:59 am PDT by
Google today announced that the Exposure Notification API that it designed in partnership with Apple has received some improvements to make it more useful to public health authorities. Most notably, the API supports interoperability between countries, and Bluetooth calibration has been improved. The full list of updates is below: When an exposure is detected, public health authorities...
canadaexposurenotification

Canada's 'COVID Alert' App Using Apple's Exposure Notification API Now Available

Friday July 31, 2020 9:36 am PDT by
Canada today released a new COVID-19 contact tracing app called COVID Alert, as noted by iPhone in Canada. COVID Alert takes advantage of Apple and Google's privacy-focused Exposure Notification API to alert people when they've come into contact with someone who has the coronavirus. As with all COVID-19 contact tracing apps, COVID Alert uses Bluetooth to exchange random, anonymized codes...
linuxfoundationcovid

Linux Foundation Launches COVID-19 Project to Help Health Authorities Make Apps With Apple's API

Monday July 20, 2020 4:40 pm PDT by
The Linux Foundation today announced the launch of a new Linux Foundation Public Health Initiative (LFPH) (via TechRepublic) that uses open source technologies including Apple and Google's Exposure Notification API to help public health authorities combat COVID-19. The LFPH includes Cisco, doc.ai, Geometer, IBM, NearForm, Tencent, and VMWare, and is launching with two exposure notification...
irelandexposurenotification

Ireland Launches COVID-19 App That Uses Apple/Google Exposure Notification API

Monday July 6, 2020 4:56 pm PDT by
Ireland today released "COVID Tracker Ireland," a COVID-19 contact tracing app that takes advantage of Apple and Google's Exposure Notification API. The app, which is opt in, says that users will be alerted if they come in close contact with someone who has tested positive for coronavirus. Those exposed will be able to track their symptoms, get advice on what to do, and choose to anonymously ...
covid exposure example app

Canada to Launch Nationwide COVID-19 Contact Tracing App Based on Apple/Google Technology

Thursday June 18, 2020 11:11 am PDT by
Canadian Prime Minister Justin Trudeau today announced that Canada plans to launch a nationwide COVID-19 contract tracing app based on Apple's and Google's Exposure Notification API, as noted by iPhone in Canada. Trudeau said the app is slated for release in early July, with testing set to begin in Ontario soon. COVID Shield, a reference for public health authorities to build their own apps ...
exposure text feature centered 1

UK's Contact Tracing App Will Reportedly Use Apple/Google Solution After All

Thursday June 18, 2020 5:49 am PDT by
In what appears to be a reversal of course, the BBC today reported that the United Kingdom's National Health Service will adopt Apple's and Google's Exposure Notification API for its COVID-19 contact tracing app after all. Other countries that have committed to using the API include Italy, Latvia, Switzerland, Germany, Poland, and Saudi Arabia, among others. Apple released the API as part ...
saudi arabia covid app

More Countries Implement Apple/Google API in Contact Tracing Apps, Including Germany, Poland, and Saudi Arabia

Tuesday June 16, 2020 6:48 am PDT by
Germany, Poland, and Saudi Arabia are among the latest countries to implement Apple's and Google's jointly developed Exposure Notification API in their respective COVID-19 contact tracing apps, available on the App Store. Apple released the Exposure Notification API as part of iOS 13.5 last month. At the time, Apple said that 22 countries had requested and received access to the API, with...
Exposure Notifications W People and Text

New York Attorney General Asks Apple and Google to Vet Third-Party Contact Tracing Apps

Tuesday June 16, 2020 2:06 am PDT by
Apple and Google have been asked by New York's Attorney General to do more to prevent sensitive health data from being collected by third-party contact tracing apps. According to Business Insider, AG Letitia James sent letters to both companies and urged them to impose tighter restrictions on the apps if they are to be available in their app stores, following concerns that some of the apps...
exposurenotificationapiitaly

Italy and Latvia Launch Apps That Use Apple's Exposure Notification API

Monday June 1, 2020 12:38 pm PDT by
European countries have begun to roll out COVID-19 contact tracing apps that take advantage of the Exposure Notification API designed by Apple and Google, with Italy and Latvia both launching new apps over the course of the last few days. As noted by MacStories' Federico Vittici, Italy today released Immuni, a privacy-focused contact tracing app that's designed to alert users if they've been ...
Exposure Notifications W People and Text

First App Using Apple and Google's Exposure Notification API Launches in Switzerland

Tuesday May 26, 2020 3:02 pm PDT by
The first app that takes advantage of the Exposure Notification API developed by Apple and Google has launched in Switzerland, according to a report from the BBC. A team of app developers working on contact tracing app called SwissCovid have rolled out the app in a beta capacity for members of the Swiss army, hospital workers, and civil servants. After the app is tested and approved by MPs,...