A Brief History of Exposure Notification During the COVID-19 Pandemic in the United States, 2020-2021.

The swift global spread of COVID-19 prompted public health authorities to explore digital technologies to aid in contact tracing for infection control. Exposure notification, a mobile device-based technology that notifies individuals of potential exposure to COVID-19 without requiring personally identifiable information, has been broadly favored because of its relative ease of use, scalability, and protection of personal privacy. Although several exposure notification protocols were developed, a partnership between Google and Apple led to the development of the most widely implemented exposure notification protocol in the world, including in the United States. In this article, we first describe the development of the Google Apple Exposure Notification (GAEN) protocol, noting the value of the discourse among software developers and public health authorities concerning the protocol's design and features. We track states' deployment of GAEN mobile applications (apps) and population-level adoption rates, finding the nationwide rollout of GAEN apps to be more fragmented than anticipated. We then discuss how the limited data collected from these apps make assessments of their effectiveness challenging. Finally, we consider the importance of the federal government playing a greater role in GAEN's early development, emphasize the power of public-private partnerships, and highlight the overriding importance of public messaging over technological details.

Following the World Health Organization’s declaration of the COVID-19 pandemic in March 2020, many countries pursued nonpharmaceutical public health interventions, including travel restrictions, face mask mandates, and social distancing, to mitigate the spread of COVID-19. Contact tracing is a mitigation strategy that aims to disrupt disease transmission chains through the identification—traditionally through interviews—of an infected individual’s close contacts to enable subsequent quarantine and testing of those determined to be at risk of infection.[1] In the United States, most jurisdictions expanded conventional contact tracing activities for other communicable diseases to include COVID-19; some jurisdictions also simultaneously explored how to supplement this resource-intensive activity with digital contact tracing, developing what came to be called “exposure notification.” Despite the widely used labeling of exposure notification as a method of contact tracing, it is important to distinguish between the two. Contact tracing involves the naming of known contacts to public health authorities; exposure notification alerts people to potential exposure events without requiring any personally identifiable information.

Google Apple Exposure Notification (GAEN), an application programming interface (API) jointly developed by the eponymous companies, became the predominant exposure notification protocol in the United States. An API is a type of software interface with defined functions that allows an application (app) developer to build smartphone apps and other software.[2] GAEN allows Google Android and Apple iOS devices to interact with each other via Bluetooth to measure the approximate distance and duration of proximity between 2 devices. In this article, we describe the development and deployment of GAEN and discuss implications for the COVID-19 pandemic and future public health needs. To our knowledge, this is the first review of the development of exposure notification in the peer-reviewed literature.

Definitions

Exposure Notification Protocol Features

GAEN allows smartphones to interact with each other via Bluetooth to record exposure events, defined as 2 devices within an approximate distance from each other (eg, 6 feet) for a specific duration (eg, >15 minutes). Exposure events are recorded with the exchange of anonymous and cryptographically generated random numbers, or “keys,” stored locally on mobile phones. If an individual later receives a positive test result for COVID-19, a public health authority issues a verification code to that individual. Upon entering the verification code in the GAEN app, the individual’s keys are uploaded to a key server. Every mobile phone running GAEN checks these key servers regularly. If a retrieved key matches a key exchanged within a recent infectiousness window (the period during which the confirmed positive case would have been infectious), the owner of the mobile phone is automatically notified that the person may have been exposed to SARS-CoV-2. Use of GAEN is completely opt-in, and consent is required at each step of the app’s download and operation. People who receive a positive test result share their keys by choice. To maximize privacy, no location information is stored, and the keys are completely anonymous.[3,4]

Bluetooth Versus GPS

One early debate concerned whether to use Bluetooth or a global positioning system (GPS) to determine the distance between people. The Massachusetts Institute of Technology’s PathCheck Foundation released the first exposure notification protocol in the United States that used GPS, known as SafePaths.[5] However, standard GPS is unreliable in determining the exact position of a person within a few feet, and substantial mobile phone battery power is required to obtain more accurate GPS information. Moreover, Bluetooth allows for greater privacy than GPS data: whereas Bluetooth records only device proximity, GPS data may capture specific location information that can be sensitive for individuals.[6,7] As the conversation among developers and public health authorities shifted from recording the location of a contact to the proximity between contacts, recognition and acceptance of Bluetooth-based exposure notification protocols increased and GPS-based initiatives decreased.

Centralized Versus Decentralized Protocols

A second early debate existed between centralized and decentralized exposure notification protocols. Centralized protocols use central servers to store and analyze all user interactions, whereas in decentralized protocols, such as GAEN, the process of matching anonymized keys to determine exposure risk occurs entirely on users’ mobile phones. Centralized protocols allow for more rigorous epidemiologic analyses, such as tracing second-order contacts and tracking super-spreader events; however, centralization can lead to privacy concerns and the potential for government abuse of citizen data. Although the concerns about privacy and abuse were debated in Europe during spring 2020, by the time exposure notification technology gained traction in the United States, the consensus had shifted toward a decentralized protocol.

Development of Exposure Notification

Before Google’s and Apple’s development of GAEN, numerous other efforts were underway to develop Bluetooth-based, decentralized exposure notification protocols. The GAEN system shares many features with the open-source Temporary Contact Numbers and Decentralized Privacy-Preserving Proximity tracing protocols. Google and Apple also developed open-source verification and key servers for countries to deploy with their custom apps.

During the COVID-19 pandemic in the United States, public health authorities who were early adopters of the technology were responsible for developing GAEN apps, determining the risk parameters that define exposure events and trigger exposure notifications, and ensuring integration of traditional and digital contact tracing so that infected people and their contacts were notified and advised of next steps (eg, testing, quarantine). With the release of Exposure Notification Express (ENX) in September 2020, the implementation process for public health authorities was simplified.[8,9] Rather than independently developing and maintaining their own custom apps, local public health authorities provide the risk parameters and public health messaging that they wish to send to users. On Google Android devices, Google automatically generates an app on behalf of the public health authority; people are then prompted to download it. On Apple iOS devices, ENX is integrated into the operating system, and then people simply choose whether to enable the function.[10]

Apple and Google have declared their intentions to disable exposure notification after the pandemic ends.[11]

Deployment by US Public Health Authorities

At the time of GAEN’s release, Apple and Google established stringent stipulations for its use.[12,13] Aside from restrictions on the type of data that can and cannot be collected from people and specifications for consent, only government entities—either public health authorities or developers approved by the government—can use the API.

European governments were the earliest adopters of GAEN after its release in May 2020.[14-16] In the United States, GAEN adoption progressed at a slower pace. In early August 2020, the University of Alabama at Birmingham launched the first GAEN app in the United States, GuideSafe, as a pilot program for anyone in the state with a .edu email address.[17] Two days later, Virginia released the first exposure notification–based app for statewide public use, COVIDWise.[18] By the end of summer 2020, 6 states had released apps, and other states followed in subsequent months.

A major reason for the slower development of GAEN apps in the United States compared with Europe was the technical burden relative to the resources available to state public health authorities. All states that deployed custom apps contracted with external teams to design and build the apps. Various implementations included open-source, custom, off-the-shelf proprietary software or custom apps built from scratch.[19] The differing implementations and lack of interoperability among states caused many states to initially decline or delay building an app. In addition, early adopter states were responsible for creating and operating their own key and verification servers, with no interoperability among states. This meant that if 2 people in proximity were using apps developed by different states, they would not be notified if the other person later received a positive test result for COVID-19.

In August 2020, the Association of Public Health Laboratories, with support from the Centers for Disease Control and Prevention, Google, and Microsoft, addressed the interoperability challenge by deploying a national key server for GAEN.[20] The national key server reduced the work required of state authorities and enabled people to be notified of exposures as they crossed state lines. In September 2020, the Association of Public Health Laboratories launched a nationwide multitenant verification server to reduce the technical burden on states.[21] While these servers have a shared infrastructure, the protocol is decentralized because data processing remains on individual devices. Within months of their release, these servers had been adopted by all states running GAEN. These servers, in combination with the release of ENX in September, accelerated the deployment of GAEN, with many states launching in fall 2020. By September 2021, 26 states and territories had released GAEN-based apps or ENX services (Figure).[22-46]

Figure.

Timeline of state/territory deployment of Google Apple Exposure Notification, a Bluetooth-based decentralized reporting protocol to facilitate digital contact tracing, during the COVID-19 pandemic, by month, United States, August 2020–April 2021. Deployment is defined as the release of a pilot or statewide system. Oregon and South Carolina deployed pilot applications (apps) and never launched statewide. Arizona’s exposure notification app became available statewide in January 2021 but was not announced as being out of the pilot phase as of January 2022. Data sources: state websites, press releases, and related news coverage.[22-46]

Adoption by the US Population

As of early May 2021, more than 36 million people in the United States had downloaded an exposure notification app or activated ENX on their devices.[22] Self-reported user uptake ranged widely, from 1.2% in Arizona to 45.7% in Hawaii.[22] Interestingly, the impact of ENX on user adoption is easily discernible. Within a day of the launch of CA Notify, California’s ENX service, 10% of the state’s population had activated it.[20] In Nevada, where for months just 5% of adults had downloaded the custom app released in August 2020, adoption jumped to 9% within 4 days after the release of the state’s ENX service.[21] All states that deployed ENX, either as a standalone solution or in conjunction with a custom app, had higher levels of adoption than any state that deployed a custom app alone.

Determining Effectiveness

GAEN collects limited data to maintain its claims of being a privacy-preserving system. This lack of data makes it challenging to determine the effectiveness of the apps (ie, the number of COVID-19 cases the apps have prevented). Even the additional data gathered via the Exposure Notifications Privacy-Preserving Analytics system launched in December 2020 are still insufficient to determine effectiveness.[47] No straightforward method exists to ascertain what proportion of people who receive a positive test result actually share their keys with the key server or to confirm how people notified of exposure comply with recommendations such as quarantine. Collection of these data might constitute human subjects research and require substantial investment from the already overburdened public health system. In addition, the assessment of effectiveness must consider the self-selectivity of app users, including underlying equity issues related to who has access to smartphones. Still, researchers have suggested the possibility of behavioral changes among notified people, even if they do not seek diagnostic evaluation, contributing indirectly to the app’s effectiveness.[48]

It is worth noting that user uptake is not a proxy for effectiveness, but higher use of the app in a population allows it to be more effective than lower use of the app. Both modeling and real-world analyses from around the world have suggested the impact of apps in curbing the spread of infection, even with low adoption. In the United Kingdom, every percentage-point increase in user uptake of its GAEN app was estimated to reduce infections by 2.3%.[49] A study from Washington State estimated that during the first 4 months of implementation, the app prevented 5500 COVID-19 cases, which equated to approximately 72 cases per 100 000 population.[50]

Public Health Implications

In examining the development and adoption of GAEN in the United States, we find several key concepts that inform future efforts at the intersection of public health intervention and technology beyond COVID-19. The first is the power of public–private partnerships. Although the deployment of new technologies in the public sector, compared with the private sector, typically occurs at a slower rate, novel partnerships among the public, private, and nonprofit sectors enabled GAEN to reach millions of people in a matter of months. Each sector’s expertise contributed to an effective collaboration.

Second, earlier federal efforts to develop exposure notification might have accelerated GAEN deployment and uptake. Had the federal government deployed an open-source app, national key server, and verification server, states might have used the same underlying nationwide exposure notification app with custom branding. Uncertainty about the extent of the federal government’s commitment to develop digital infrastructure for exposure notification led many states to defer their own deployment of GAEN. Ultimately, it was primarily collaboration between private and nonprofit organizations that encouraged state health departments to participate in GAEN.

Finally, as with all nonpharmaceutical interventions, a lack of effective communication with the public about the importance and functionality of GAEN was an impediment to its success. A large proportion of the US population appeared not to understand how a technology such as GAEN preserved individual privacy.[51] While many states managed to persuade more than one-third of their population to download GAEN within the first few months of launch, convincing app users who received a positive test result to report their results proved to be a second communications struggle.

This review focused primarily on the technical development and deployment of GAEN and related infrastructure in the United States. Although the implications of these findings beyond the COVID-19 pandemic are outside the scope of this review, the subject warrants future research. While exposure notification has demonstrated how new digital technologies can enhance public health measures, the issues identified here must be addressed if we are to realize the technology’s full potential.