Someone looked into the permissions quickly - https://paste.gg/p/anonymous/b7c95d3967514e78a652840b5b666d5...
<uses-permission android:name="android.permission.BLUETOOTH"/>
<uses-permission android:name="android.permission.BLUETOOTH_ADMIN"/>
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>
<uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE"/>
Which is to say, the granted permissions seems surprisingly restrained...
I'm currently on the 11th floor of a building. GPS accuracy in the vertical dimension is much worse than horizontal. A bluetooth beacon will tell you if I'm in the same room with someone else.
The contact tracing is 100% Bluetooth.
You post a beacon periodically, other people post beacons, everyone is listening for that UUID and records and instances of it. This is how the whole thing works.
GPS would be a privacy disaster, if it it did work for this. Random rotates beacons are a privacy issue if you don’t trust your phone mfg, which you should not, but as long as it’s an optional thing is O.K. in the way AppleGoogle are proposing.