Google blocks the UK’s NHS COVID-19 app update over privacy concerns

Google’s contact tracing API has prohibited location tracking since its inception.

What you need to know

• The UK’s update to the NHS COVID-19 app was rejected by both Apple and Google today.
• This is because the update would have requested location data from users.
• This move would have counter to the policies of both technology companies.

Google and Apple have both blocked an update to the UK’s NHS COVID-19 app today over privacy concerns (via BBC). The update, if it rolled out, would have allowed users to share details of all their recently visited locations to the government, This was part of the UK’s strategy to keep track of contacts and prevent outbreaks as it lifted some COVID-19 restrictions on April 12.

However, the update was blocked by the Play Store and Apple’s App Store. This is because both Google and Apple restrict sharing of location data either via the contact tracing APIs to the companies themselves, or to public health agencies. The update itself would have broken that rule, and it remains unclear as to why the government would have tried to push the update through knowing that. The BBC reports that staff were ordered to obfuscate the reason behind the delay, throwing more questions into the already stacked pile.

An NHS spokesperson said:

The deployment of the functionality of the NHS Covid-19 app to enable users to upload their venue history has been delayed.

This does not impact the functionality of the app and we remain in discussions with our partners to provide beneficial updates to the app which protect the public

The limitations on the contract tracing API were established well in advance as part of the strategy to encourage uptake. If users were to use an app that recorded their comings and goings, at least ensuring that the data was more or less private would help in assuaging concerns of the most privacy concerned.

As Android Central explained back in 2020:

Apple and Google’s technology uses “anonymous identifier beacons” which change frequently, these are sent between devices via Bluetooth. This short-range, local technology means that whilst your interactions with other devices are being tracked (but held locally), your movement is not being monitored by GPS.

An update to the NHS app will still be coming, but it remains unclear whether this issue would be resolved or an alternate approach taken.