The Differences Between Contact Tracing and Exposure Notification

Executive Summary

This rapid response briefing provides an overview of the differences between contact tracing and exposure notification and outlines the current options for these technologies. It summarizes the technical differences between the two approaches and reviews the security and privacy risks, adoptability, and feasibility of three technologies: GPS-based contact tracing, Bluetooth Low Energy (BLE) based contact tracing, and BLE-based exposure notification (the Apple/Google model).

Should the federal government implement or endorse a contact tracing or exposure notification technology, the briefing recommends Bluetooth-based exposure notification. Federal decision-making requires a careful balance between public health and safety, technological capacity, and privacy protection. COVID-19 apps require the collection of vast amounts of data, which can compromise personal privacy and increase security risks, as individuals may be more easily identified or have their personal information, particularly sensitive health information, exposed. Location data of any kind is highly sensitive and can never be fully anonymized; even de-identified location data can be used to re-identify individuals, often from only a few data points. In addition to securing privacy, strong data protection is an integral mechanism for ensuring public trust and adoptability. The capacity of any pandemic response technology should be rigorously weighed against its democratic impact and possible unforeseen misuses.