Privacy Experts Warn: QR Codes Are Tracking You

As customers returned to restaurants and retail spaces, they were met with an abundance of new rules, procedures, and technology to ensure a smooth transition. After months of lockdown, contactless experiences became the norm as safety precautions kept customers cautious of newly reopened spaces.

At the forefront of these contactless features were QR codes; giving customers a safer way to read menus, navigate new policies, and independently checkout at registers. While it may have seemed like a novelty at first, QR codes have quickly become a part of restaurant culture and retailers like CVS, Nike, and Foot Locker have included them as a standard checkout option in stores across the country.

Writer Clive Thompson shares an interesting perspective on the technology, noting that it began as an advertising tool that was scarcely used and ultimately deemed unnecessary. He states, “QR codes seemed like the go-to parlor trick of Silicon Valley: Creating an app that is tech for tech’s sake, and that addresses no actual human need felt by any actual humans.” However, this all changed with the pandemic. The touchless technology actually proved to be incredibly useful for customers avoiding human contact, and it simultaneously became more accessible once Apple and Android devices integrated QR scanning into their camera features.

While it certainly has become more convenient, critics are warning users about the impact this technology will have on customers. What many may not initially realize, is that accessing these codes allows companies to store digital information and track personal data with every accompanying link. According to the New York Times, the use of these codes has enabled businesses to integrate tools for tracking and targeted analytics, taking what seems like a modern way to browse a menu and turning it into an opportunity to track your behavior and purchasing preferences.

This is particularly troubling to some as it positions a traditionally in-person, private experience into an advertising opportunity. And, its use is growing quickly, with half of all full-service restaurants including QR code menus since the start of the pandemic.

Although some QR reading services note that they do not sell information like customers’ names, phone numbers, and payment information to third parties, at the end of the day it is still being collected — which according to David Choffnes, Executive Director of the Cybersecurity and Privacy Institute at Northeastern, may be more invasive than the typical consumer realizes. For example, he shares, a restaurant can use this information to design a menu that encourages more sales and tailor offerings based on your previous purchases. In a more extreme example, an insurance company could track your fast food intake and increase your rates accordingly. He even notes that police can purchase access to data collected by companies and use it as evidence in court. While these seem far off, this kind of activity is not unusual in the digital age, and the increasing presence of this technology indicates an opportunity for further tracking.

What’s most concerning to critics, beyond the fact that this technology is actually tracking users, is the fact that it does not actually appear to be collecting anything. Without a visible privacy agreement or a popup banner, customers do not always recognize the repercussions of using the simple tool. While some people may feel totally comfortable sharing this kind of information, it is still nice to know what you’re getting into. Choffnes notes they are designed in a way to get you to scan and move on, missing any description of what the QR code is actually doing and therefore creating a blindspot for users.

To improve the transparency surrounding QR codes, Choffnes suggests that companies find a better way to disclose what is happening to give consumers more control over the interaction. With transparency becoming a key indicator of consumer trust, companies should definitely work to create more clarity for customers using the technology. And, at the very least, prompt customers to question the technologies they are choosing to engage with on a regular basis. In the meantime, if this kind of tracking seems unreasonable or invasive, customers should simply avoid using them.