Contact tracing: Alice is able to say, “I was in contact with Bill and Carol.” Then authorities can talk to Bill and Carol, and have them trigger their phones to see who they’ve been near. But because that’s slow, most plans would upload the lists of who’s been near who to a central server. Then the authorities can do a simple query to see who’s been near who.
Exposure notification:
Alice enters a code that she got with her positive test result in to the app. The app has been continually broadcasting rotating, random identifiers which it then uploads to the central service. The code she entered verifies to the central service that she has a legitimate positive result. Bob and Carol’s phones periodically check with the central server for the list of positive IDs. Their phones stored one of the IDs from Alice’s phone when they were near each other earlier. Once they get the latest list of infected IDs, their phones will alert them that they have been exposed and should be tested.
In CT, the central service has all the data, and you can trace contacts without the knowledge of the users. In EN, the service has a list of infected people, and everyone needs to check that list periodically.
Pretty sure there’s some subtlety with the IDs being a cryptographic sequence or something so there isn’t a gigantic list of IDs everybody is constantly pulling down, but this is the gist of it.
