Centralized or decentralized

Additional Sources

There is very little information available to the public about how China's technology works.

India is the only democracy making its app mandatory for millions of people. 1/25/21: Court rules gov't can't share app data with other government departments and agencies: https://www.livelaw.in/top-stories/karnataka-high-court-restrains-centre-nic-from-sharing-response-data-of-persons-collected-through-aarogya-setu-168886

Ministry of Communication and Information Technology (Kominfo) and the Ministry of SOEs

The Indonesian app uses individuals' location data to cross reference telecommunications provider data.

Japan's app has been riddled with issues since it launched, and has been suspended at least twice.

The specific privacy and data policies for the Mexican app are currently quite thin and vague.

The app launched in April and has serious privacy concerns which sparked a letter demanding better protections from major organizations.

Vietnam is using a decentralized system but requires access to contacts and other media on mobile devices like photos.

Germany opted for the Google/Apple API after initially aiming to build a centralized system.

Turkey mandates people who test positive download the app and can then share data with police.

This app appears to no longer be in use.

Like the UK and Norway, France negotiated with Apple and Google but decided against using their standards.

The app launched on September 24 but continues to face criticism for being confusing and ineffective. Works with apps in Northern Ireland, Jersey, Republic of Ireland, Scotland, Gibraltar and Wales.

After China, Italy was the first Western nation devastated by covid-19. They launched thier app in early June.

Tawakkalna app pairs with Tabaud, the contact tracing app, and allows citizens to request "movement permits" for mobility around the city. As of mid-June, Tawakkalna and Tabaud have been made mandatory for government employees to enter Ministry buildings.

https://english.alarabiya.net/en/coronavirus/2020/05/20/All-you-wanted-to-know-about-the-Saudi-tracking-app-Tawakkalna; https://www.arabnews.com/node/1738016/media

While Tabaud uses the Google-Apple system, its privacy policy notes "external links" in the apps, which the app bears no privacy responsibility for. It's unclear what the "external links" are. Tabaud is also not open source.

Permissions allowed for data use are overly broad. Originally only available for Android, now also available for iPhone.

https://www.thestar.com.my/news/nation/2020/05/08/data-from-covid-19-app-mytrace-kept-on-phone-not-govt-servers-says-khairy; https://www.malaymail.com/news/what-you-think/2020/05/17/digital-surveillance-privacy-data-ecosystem-and-effectiveness-moonyati-yati/1867050

Ghana's app is focused on collecting users' location data.

Australian experts have criticized the government for a lack of transparency and non-responsiveness to privacy issues.

Tunisia's government says the app will remain voluntary so long as download rates are high.

https://www.bbc.com/news/world-middle-east-53052395; https://www.accessnow.org/to-safeguard-privacy-tunisia-must-be-transparent-on-tech-used-to-fight-covid-19/

eRouska is one part of the Czech government’s larger "smart quarantine" plan. The app relaunched in September to address issues with the first version.

https://ec.europa.eu/health/sites/health/files/ehealth/docs/covid-19_apps_annex_en.pdf; https://www.expats.cz/czech-news/article/czech-anti-covid-app-erouska-will-soon-connect-with-foreign-apps

The voluntary app alerts people who came within 2m of an infected person for at least 20min.

The app is mostly decentralized, but citizens can be fined for refusing install or register for the app.

Officials said the app is not sufficiently accurate because it is based only on GPS and voluntary information.

Austria was one of the first major European nations to align with the Google/Apple API.

Bluetooth, DP-3T, Google/Apple

Initially, the Swiss opted to use DP-3T instead of the Google/Apple API. Now it looks they will be using both.

Bulgaria launched their app in early April and began lifting movement restrictions in early May.

Thailand paired the proximity contact tracing app with a QR code check-in system, called Thai Chana

TraceTogether was the first major Bluetooth contact tracing app.

https://docs.google.com/document/d/16Kh4_Q_tmyRh0-v452wiul9oQAiTRj8AdZ5vcOJum9Y/edit#; https://www.asiaone.com/singapore/what-you-need-know-about-soon-be-compulsory-tracetogether-system

Finland's pilot app is no longer in use. The current app's privacy policy is well-documented.

This is the second app deployed in Norway. The first was discontinued after privacy concerns.

Unlike neighboring UK, Ireland opted to use the Google/Apple API from the outset. Northern Ireland's app works with apps in England, Jersey, Republic of Ireland, Scotland, and Wales.

Bluetooth, QR codes, Google/Apple

New Zealand's app is based on a check-in system using QR codes in public areas. App revamped early Dec. 2020 to include Bluetooth and Apple/Google tech.

A recent Amnesty International report highlighted Kuwait's app as one of the most invasive in the world.

The app is mandatory for all citizens and requires access to photos. It also had a major security breach upon launch.

North Macedonia

Android and iOS apps were launched in mid-April.

Northern Ireland's app works with apps in England, Jersey, Republic of Ireland, Scotland, and Wales.

Though 25% of the country has downloaded BeAware, there is little public information about the app. As of Jan 2021, users can also schedule vaccine appointments via the app.

Bytelogics, Cybernetica, Fujitsu Estonia, Guardtime, Icefire, Iglu, Mobi Lab, Mooncascade, Velvet

Bluetooth, DP-3T, Google/Apple

The Cypriot app was one of the earliest efforts to launch, all the way back in February.

CareFiji launched at the end of June and is modeled after the Singapore app TraceTogether.

Iceland decided not to use Bluetooth because it was too unreliable and instead uses location data

Gibralter's app launched on June 18th and over 25% of the population has downloaded it. Works with apps in Northern Ireland, Jersey, Republic of Ireland, Scotland, England and Wales.

Algeria's app was investigated by Amnesty International.

Bluetooth, Google/Apple, DP3T

Belgium's code is based on Germany's Corona-Warn app. It's open source and well-documented.

Canada's app has rolled out to 8 provinces and territories. Its website contains usage numbers and clear explanations of how it works.

In September, this app notified people they had been exposed when in fact they had not, due to a technical error.

South Africa tried several other contact tracing strategies before moving to this privacy-protecting option.

The app was built by Shohoz, an "online ride-sharing and ticketing platform." Months after its June release, the app had not proven to be very effective.

Maker/Deployer

Target Penetration

Voluntariness: Does the app require explicit permission from a user and can a person choose not to use it with no ill effects?

Use limitations: Are there strong use limitations against using data for purposes other than public health? E.g. Law enforcement or intelligence agencies, advertising entities

Data Destruction — Does the technology and policies ensure data is deleted when it’s no longer needed for public health purposes?

Minimization — Are policies in place to ensure only necessary info is collected? Is data sharing with outside entities prohibited?

Transparency — Is the government and tech transparent about what data is acquired, from where, how it’s used, and who has access to it?

Additional Sources

Additional Sources

University of Alabama Birmingham

Bluetooth, Google-Apple

Alabama's app now works with exposure notification apps from other states.

Covid Watch Arizona

Bluetooth, Google-Apple

as many as possible

Bluetooth, Google-Apple

Some iPhone users may be able to turn on notifications in their settings menu.

CO Exposure Notifications

Bluetooth, Google-Apple

Some iPhone users may be able to turn on notifications in their settings menu.

Bluetooth, Google-Apple

Some iPhone users may be able to turn on notifications in their settings menu.

Bluetooth, Google-Apple

Some iPhone users may be able to turn on notifications in their settings menu.

Bluetooth, Google-Apple

Bluetooth, Google-Apple

Guam's app launch was supported by a collaborative, public health marketing effort—although uptake by poorer residents remains difficult.

Bluetooth, Google-Apple

As of 1/20/21, Maui is requiring all travelers to download the app or quaratine for 10 days upon arrival.

Bluetooth, Google-Apple

Louisiana's app was launched 1/22/21, while the state was experiencing a third wave of cases.

as many as possible

Bluetooth, Google-Apple

Some iPhone users may be able to turn on notifications in their settings menu.

Bluetooth, Google-Apple

List of anonymous data may be shared with other entities and to aggregate statistical and scientific research. Asks for optional name and phone number.

Bluetooth, Google-Apple

Bluetooth, Google-Apple

Bluetooth, Google-Apple

Asks for optional demographic info.

Bluetooth, Google-Apple

as many as possible 18+

Bluetooth, Google-Apple

Asks for optional demographic info.

as many as possible

Bluetooth, Google-Apple

Care19 Diary (formerly called Care19) violated its own privacy policy in April. Care19 Diary users may consent to sharing location data with public health officials.

Bluetooth, Google-Apple API

North Dakota and Wyoming use the Google-Apple exposure notification app in addition to the Care19 Diary app, which focuses more on contact tracing.

Oregon Exposure Notifications*

Bluetooth, Google-Apple

Pilot program at Oregon State University; expected to expand to the state Jan 2021 pending pilot success. Some iPhone users may be able to turn on notifications in their settings menu.

Bluetooth, Google-Apple

Users can request a call back from a public health official through the app.

Bluetooth, Google-Apple

Users can request a phone call from public health officials if they're in close contact with someone who tests positive.

You may choose to share your location diary with the Department of Health for contact tracing purposes. The privacy policy is a little vague in terms of who the data may potentially be shared with.

South Carolina Safer Together*

Bluetooth, Google-Apple

Pilot program launched; statewide rollout could be Jan pending pilot results.

If you test positive for covid-19, the Department of Health will reach out to you, ask if you're using the app, and if so, request that you share your location data with the department. FourSquare and other partners "may have temporary access to aspects of your data for their specific data processing tasks."

Utah Exposure Notification

Bluetooth, Google-Apple

Bluetooth, Google-Apple

List of anonymous data may be shared with other entities and to aggregate statistical and scientific research.

Bluetooth, Google-Apple

The Washington app is available in 29 languages. Some iPhone users may be able to turn on notifications in their settings menu.

WI Exposure Notification

Bluetooth, Google-Apple

Bluetooth, Google-Apple

If a user enables enhanced diagnostics, data about the operation of the app will be sent to a third party to improve app performance. The privacy policy is thin.

Created by MIT Technology Review

Countries last Updated: 1/25/21 12:05pm ET

US States last Updated: 1/25/21 12:05pm ET

Sources include government or developer announcements, verifiable news sources, or published research.

Please reach out to CTT@technologyreview.com with any additional information or feedback

Yes, clearly answered publically

No, policly clearly does not meet the requirements or does not exist

We're actively trying to clarify; we've reached out to the deployer; no star