Why exposure notification apps rose or fell on the back office

The week

On April 10, 2020, Apple and Google announced a joint effort to enable Bluetooth-based contact tracing on iOS and Android. It would come first through application programming interfaces for apps built by public health authorities, and later through capability built into the operating systems. The design used rotating random identifiers exchanged between nearby phones, with exposure matching done on the device and no central collection of location data or identities. During the week of April 13, governments and public health agencies around the world were weighing whether to use the framework or build their own centralized apps. The companies released the interface to public health authorities on May 20, 2020.

For state and local health agencies, the Apple and Google framework arrived as a technical offer with a policy attached. Building on it meant accepting a decentralized design in which agencies never saw who had been near whom. Building against it meant fighting operating system limits on background Bluetooth. Most US agencies that built apps accepted the framework, which settled the protocol and the privacy model. Three back-office systems remained in their hands. They were the verification step that let a positive case send alerts, the public health response an alert set in motion, and the adoption effort that determined how many phones took part. Those three, far more than the protocol, decided whether an app helped.

The verification step

To prevent false alarms, a user could only notify contacts after a positive test was verified. The agency issued a one-time code, and the user entered it in the app. That sounds simple. In practice it required a link between laboratory results and the people who issued codes. Some agencies sent codes by text message as soon as a positive result reached the state system. Others relied on case investigators to read codes out during interview calls, days later.

Timing was everything. An exposure alert is useful only while the contact can still avoid infecting others. Every day between a test result and a code reduced the value of the notification. Where laboratory reporting was slow, used fax, or lacked phone numbers, codes arrived late or never. The metrics that mattered were time from result to code, the share of positive cases offered a code, and the share who used it. Few agencies published them, and some did not track them at all.

The verification step also carried privacy weight. The code system was the one point where the decentralized design touched identified health data. Agencies had to keep it minimal: no storage of who received alerts, short code expiry, and clear separation from case records.

Staffing the step was a workforce decision as much as a technical one. Where codes depended on investigators, every investigator needed training, a script and access to the code portal. When case volumes surged, interviews were triaged and code issuance slipped first, because it looked optional next to clinical questions. Agencies that automated issuance protected the step from exactly that pressure. Those that could not automate it needed a rule that every positive case reached by phone was offered a code, with compliance checked weekly.

The public health response

An alert told a resident they might have been exposed. What happened next depended on decisions the agency made. Should the resident quarantine, test or call a hotline? Where could they get a test quickly? Would a contact tracer reach out? Alerts with vague advice and no route to testing produced anxiety without action, and undermined trust in both the app and the agency.

The app also had to fit alongside human contact tracing, which remained the main response. Messages from the two programs needed to agree. Call centers needed scripts for residents who had received an alert and wanted advice. Testing sites needed to accept people who arrived because of a notification. Each of these was an operational commitment owned by a different team, and each had to be ready before launch.

Residents who live near state lines raised another question. A person exposed in a neighboring state might receive an alert based on that state’s settings and advice. Agencies needed to agree which guidance an alert carried, and their hotlines needed to handle callers from elsewhere without turning them away. Small inconsistencies of this kind were exactly what eroded confidence in the system.

The adoption effort

Exposure notification works only if both people in an encounter have it switched on. Adoption is therefore the critical variable, and it depends on trust, ease of setup and perceived benefit. The privacy design helped with trust, but trust also depended on the agency’s own credibility and communication. Residents without compatible smartphones were excluded entirely, which raised equity concerns for communities facing some of the highest exposure risks.

Agencies rarely run consumer products that rely on voluntary mass use. Marketing, translation, accessibility and user support needed budgets and named owners, just as the technology did. Partnerships with employers, universities and community organizations could reach groups that general advertising missed. Measurement also needed care. Download counts overstate participation, because they include phones where notifications were later switched off. Active-user estimates, where the platform made them available, were the better guide.

The three systems connect. Fast verification and a clear response make the app worth using, and higher use makes each alert more likely to reach the right people. Agencies that funded all three, with metrics for each, got more from the same protocol than agencies that funded the app alone. The skills involved, defining a data purpose, wiring a citizen-facing tool to slow back-office systems, and earning voluntary participation, recur in almost every digital public service.

With hindsight

US states launched apps on the framework from the summer of 2020, and in September 2020 Apple and Google added a simpler option that let states offer notifications without building a full app. Adoption varied widely and was generally modest. Research on effectiveness produced mixed results, with some studies suggesting meaningful benefit where adoption was high. Most US state systems had been switched off by 2023.

The privacy design largely held up. The main flaw reported, in 2021, was in Android’s implementation, which wrote some exposure data to system logs that preinstalled apps could read; Google said it was fixing it. The harder problems were verification delays, unclear follow-up and uneven adoption, all rooted in overstretched public health systems. The public health data modernization investments that followed the pandemic were in part a response to the weaknesses this period exposed.