How the CDC Contact Tracing App Keeps Users Anonymous
Updated: Jan 2, 2022
In light of the recent COVID-19 outbreak in Taipei, many of you have probably seen posts or received messages from friends encouraging people to download and activate the contact tracing app developed by Taiwan’s Centers for Disease Control (you can find and download the app here: Apple / Google Play). While the app is still currently only available in Mandarin – at least one full English translation has been submitted to the government for review – there are some good resources out there that offer English instructions for downloading and activating the app for non-Mandarin readers. However, I have not yet seen much explanation in English about how the app works to notify people while also protecting users’ identities.
This post will explain:
How the app traces contacts
How the app keeps user data and identity anonymous
How positive COVID-19 tests are recorded
When users are notified of possible contact with someone who has tested positive
What to do if you receive notification of a possible contact on your app
After seeing some comments on recent posts helping non-Mandarin reading residents download and activate the contact tracing app, I realized some more information sharing in English is needed. What I’m offering here is all publicly available on the app in Mandarin (and hopefully soon in English). I am sharing this information in an effort to build confidence in the app among non-Mandarin speakers and promote use of the app to keep people safe and continue to keep COVID-19 under control in Taiwan. A critical mass of users can significantly improve contact tracing efforts and help contain the virus.
1. How the App Traces Contacts
The app uses encrypted Bluetooth signal data between devices, and each individual device stores its contact record. This keeps user identity from being exposed. This is important: the app works via Bluetooth transmission. You need to keep Bluetooth enabled at all times to ensure effective contact tracing.
2. How the App Keeps User Data and Identity Anonymous
Google and Apple have provided APIs on Android and iOS that allow the app to generate an anonymous device ID. This is why you never need to enter personal information, because “you” are represented by your device, and this random device ID is all the information that the CDC has about you. When your phone detects another app user’s phone via Bluetooth, the app relays the anonymous ID contact to the CDC. The CDC will keep this location and contact ID data for up to two weeks.
3. How Positive COVID-19 Tests Are Recorded
Contact tracing for the app relies on self-reporting of positive tests by app users. If you’re a healthy app user who contracts COVID-19 at some point, you can choose to share that information anonymously into the network via your app.
4. When Users Are Notified of Possible Contact with Someone Who Has Tested Positive
An example notification from the app to tell a user that they may have been in contact with a person who reported a positive test.
Since your app reports all the devices you’ve been in contact with and where the contact (may have) happened over a two-week period, if an owner of one of the devices you were in proximity to anonymously self-reports a positive test on their app, you will get an alert. So the app sends alerts to notify people retroactively when users (anonymously) self-report a positive test on their app.
5. What to do if you receive notification of a possible contact on your app
If you receive a notification that you have been in proximity to someone who reported a positive test, you should immediately check in with the Health Bureau office in your city or call the 1922 hotline for instructions.