How the CDC Contact Tracing App Keeps Users Anonymous

In light of the recent COVID-19 outbreak in Taipei, many of you have probably seen posts or received messages from friends encouraging people to download and activate the contact tracing app developed by Taiwan’s Centers for Disease Control (you can find and download the app here: Apple / Google Play). While the app is still currently only available in Mandarin – at least one full English translation has been submitted to the government for review – there are some good resources out there that offer English instructions for downloading and activating the app for non-Mandarin readers. However, I have not yet seen much explanation in English about how the app works to notify people while also protecting users’ identities.

This post will explain:

1. How the app traces contacts

2. How the app keeps user data and identity anonymous

3. How positive COVID-19 tests are recorded

4. When users are notified of possible contact with someone who has tested positive

5. What to do if you receive notification of a possible contact on your app

After seeing some comments on recent posts helping non-Mandarin reading residents download and activate the contact tracing app, I realized some more information sharing in English is needed. What I’m offering here is all publicly available on the app in Mandarin (and hopefully soon in English). I am sharing this information in an effort to build confidence in the app among non-Mandarin speakers and promote use of the app to keep people safe and continue to keep COVID-19 under control in Taiwan. A critical mass of users can significantly improve contact tracing efforts and help contain the virus.

1. How the App Traces Contacts

The app uses encrypted Bluetooth signal data between devices, and each individual device stores its contact record. This keeps user identity from being exposed. This is important: the app works via Bluetooth transmission. You need to keep Bluetooth enabled at all times to ensure effective contact tracing.

2. How the App Keeps User Data and Identity Anonymous

Google and Apple have provided APIs on Android and iOS that allow the app to generate an anonymous device ID. This is why you never need to enter personal information, because “you” are represented by your device, and this random device ID is all the information that the CDC has about you. When your phone detects another app user’s phone via Bluetooth, the app relays the anonymous ID contact to the CDC. The CDC will keep this location and contact ID data for up to two weeks.

3. How Positive COVID-19 Tests Are Recorded

Contact tracing for the app relies on self-reporting of positive tests by app users. If you’re a healthy app user who contracts COVID-19 at some point, you can choose to share that information anonymously into the network via your app.

4. When Users Are Notified of Possible Contact with Someone Who Has Tested Positive