New UI samples show Apple, Google’s exposure notification system - Android

Apple and Google’s samples focus on informing users about what the apps do and tie into the built-in permissions dialogues in iOS and Android. For example, the onboarding process clearly indicates what the health app will do before surfacing an operating system prompt asking for permission to enable certain settings.

Another important thing to note is that the samples require a verification code before users can upload a positive test result. Apple and Google suggest that public health authorities could provide unique verification codes with tests that would allow users to upload their recent contacts through the API and alert others who potentially came into contact with the infected individual. This could be one way to prevent people from gaming the system and uploading fake positive tests.

Developers must adhere to policies in order to use the exposure notification APIs

Further, both Apple and Google independently released policies developers will need to follow to distribute apps in the App Store and Google Play Store using the exposure notification API. Company representatives said the goal of these policies is to increase the effectiveness of apps that use the API.

The policy details several requirements for developers. To start, it asks that all apps using the API must be created by or for a government public health authority. Further, those apps can only be used for COVID-19 response efforts.

Additionally, the apps must require user consent before they can access the exposure notification API, as well as before sharing a positive test result and the ‘diagnosis keys’ with public health authorities.

The policy also requires that apps collect the minimum amount of data necessary and that the apps can only use that data for COVID-19 response efforts. All other uses of the data are not permitted.

Apple and Google will also prohibit these apps from asking permission to access location services.

Finally, the policy restricts the use of the API to one app per country. Apple and Google say this is to promote high user adoption and avoid fragmentation. However, both companies are prepared to help public health authorities in countries that opt for a regional or state approach.

These new updates come after Apple and Google began delivering betas with the new API to developers. The companies still plan for a mid-May launch.