Restaurant patrons who’ve grown accustomed during the pandemic to whipping out their phones to access menus using QR codes should understand the implications for their personal data, say privacy and cyber-security experts.
That’s especially important given some restaurant owners are finding electronic menus efficient and cost effective, and that they may hold onto the practice even after COVID-19 is more contained.
It’s not the QR code itself that collects customer data, said Dustin Moores, a privacy lawyer with nNovation LLP in Ottawa.
“What the QR code does is it sort of acts as a web link to a web page. So when you scan a QR code on your phone, in all likelihood it is going to send you to either the restaurant’s website, or to the website of a service provider that’s being used by the restaurant,” he told Cost of Living producer Jennifer Keene.
“What’s happening is we’re replacing a very sort of innocuous object, a restaurant menu, with a website that comes with all the sort of tracking technologies that you see in modern e-commerce today.”
A marketing device
Bringing up an online menu on your phone doesn’t mean you’re handing data such as your birth date and banking details to bad actors on the internet.
The more immediate implication is that it gives your local pub, or the platform they use, new knowledge of your behaviours and preferences that it can use to better sell to you.
“If you’re a returning customer to to one of these restaurants that use the QR code technology, they might be able to say, ‘Hey, we know that Jennifer ordered the Caesar salad last time; let’s put it at the top of our menu this time because we know that she likes it,'” said Moores.
The restaurant could also use the information it has gathered to upsell customers, such as suggesting the customer add chicken to that salad, he said. Ot it could try to influence your choices by offering a discount on the dish you enjoyed last time.
Moore said it’s also likely that the QR code will take you to a website that uses third-party cookies that can be used to track your web browsing habits. “Let’s say it was a Hungarian restaurant that you visited. Well then other Hungarian restaurants in the area might start advertising to you all of a sudden,” he said.
An issue of consent
Moore said his biggest legal concern about the spike in use of QR code-enabled menus is consent.
“I think what might get lost on a lot of restaurant owners is that, like every other business in Canada, they’re subject to our privacy laws,” he said. “Whenever a business collects, uses or shares personal information in the course of commercial activities, they need to have people’s consent to do that.”
Cyber-security expert Yuan Stevens, policy lead for technology, cyber-security and democracy at Ryerson University’s Leadership Lab, said the security concerns related to QR codes remain “fairly hypothetical.”
“I have not yet found any cases in Canada of QR codes being used for stealing data or violating your privacy,” she said. “But I also think it is useful to keep in mind what concerns we should be aware of as technology becomes ubiquitous.”
Someone who wants to direct you to a malicious website could “fast track” that process using a QR code, said Stevens. “Phishing and scams are already happening. And QR codes would just be another conduit to that.”
She said some restaurants are using QR codes to gather contact tracing information as well as for menus.
With the drive to reduce contact with surfaces and each other, QR codes have increased in popularity during the pandemic, said Stevens, particularly in China, where their use increased six per cent between 2019 and 2020.
Stevens notes that last month a benevolent hacking group already alerted the public that it had been able to hack the Quebec government’s new vaccine passport system, which led to 300,000 QR codes being exposed. The developer resolved the issue within 24 hours, but it’s good to be aware that there are privacy and security tradeoffs that come with using technology, she said.
QR-code enabled vaccination verification systems are now in place in Manitoba and New Brunswick, and will be in Ontario as of Oct. 22.
Jenny Burthwright, owner of Jane Bond BBQ in Calgary, said her business introduced QR code menus in the fall of 2020 when they’d been “ripping through” paper menus while trying to keep COVID-safe.She plans to keep the higher-tech system in place post-pandemic.
“There’s a very obvious cost savings to it,” she said. “With the rising costs of everything, we considered that, and also environmentally just wanted to move away from that paper.
Restaurants are also finding it easier and faster to update an online menu than a printed one, said Olivier Bourbeau, a vice-president of Restaurants Canada, the industry association representing food-service employers.
Being able to quickly add or remove a menu item, or update the price of the dish, is particularly useful given the complexities of running a food-service business during this crisis, including rising food costs and supply-chain problems that delay delivery of ingredients.
Those advantages will likely mean many restaurants will keep the QR-code system in place, Bourbeau said.
To mediate the risks associated with leaving a digital trail every time you order a brisket sandwich or a poke bowl, there are some precautions consumers can take, according to cyber-security expert Stevens.
The same principles that you’d apply to avoiding phishing and other online scams generally also apply to using QR codes, she said.
“Be careful of offers that seem too good to be true. Don’t give sensitive information over email or phone to untrusted sources. Be careful what you click on.”
Treat a QR code with the same care as an email attachment, and keep your eyes peeled for printed QR codes that look like they’ve been duplicated — one stuck on top of another, said Stevens.
- Profit-sharing, signing bonuses and health benefits. Food-service bosses try it all to lure workers back
It’s worth taking the time to check with your host or server to make sure the QR code you’re about to use is legit, she said.
“You want to be really careful that the QR code you’re scanning is actually the restaurant’s, otherwise you could be misled. And that’s when you’d be scammed.
By Brandie Weikle. Produced by Jennifer Keene.
Source: Scan QR-code menus with a side of caution, say privacy experts | CBC Radio
- “Micrography QR Codes”. IEEE Transactions on Visualization and Computer Graphics. 26 (9): 2834–2847. doi:10.1109/TVCG.2019.2896895. ISSN 1077-2626. PMID 30716038. S2CID 73433883.
- “2D Barcodes”. NHK World-Japan. 26 March 2020.
- “QR Code features”. Denso-Wave. Archived from the original on 29 January 2013. Retrieved 3 October 2011.
- “QR Code Essentials”. Denso ADC. 2011. Archived from the original on 12 May 2013. Retrieved 12 March 2013.
- “The Little-Known Story of the Birth of the QR Code”. 10 February 2020. Archived from the original on 4 March 2020.
- Borko Furht (2011). Handbook of Augmented Reality. Springer. p. 341. ISBN 9781461400646. Archived from the original on 21 December 2016.
- Joe Waters. “How to Use the Top QR Code Generators”. Dummies.com. Archived from the original on 11 September 2017. Retrieved 5 June 2017.
- “QR Code—About 2D Code”. Denso-Wave. Archived from the original on 5 June 2016. Retrieved 27 May 2016.
- “14m Americans scanned QR and bar codes with their mobiles in June 2011”. 16 August 2011. Archived from the original on 5 April 2016. Retrieved 27 May 2016.
- “U.S. and UK increase of QR code use 2020”. 6 July 2021. Retrieved 13 August 2021.
- “QR Code Standardization”. QR Code.com. Denso-Wave. Archived from the original on 10 May 2016. Retrieved 23 May 2016.
- “ISS QR Code|AIM Store: Historical Archive”. Aimglobal.org. Archived from the original on 8 August 2016. Retrieved 26 May 2016.
- “ISO/IEC 18004:2006 – Information technology – Automatic identification and data capture techniques – QR Code 2005 bar code symbology specification”. http://www.iso.org. Archived from the original on 8 March 2017. Retrieved 7 March 2017.
- “Synchronization with Native Applications”. NTT DoCoMo. Archived from the original on 6 August 2016. Retrieved 26 May 2016.
- Sean Owen (17 January 2014). “Barcode contents”. Archived from the original on 15 February 2016. Retrieved 26 May 2016.
- Rimma Kats (23 January 2012). “Starbucks promotes coffee blend via QR codes”. Archived from the original on 3 June 2016. Retrieved 26 May 2016.
- Jenny Lee (4 January 2012). “Tesco’s cool QR code advertising campaign”. Archived from the original on 3 June 2016. Retrieved 26 May 2016.
- “Getting Started with Infographics (deprecated)”. google-developers.appspot.com. 26 May 2015. Archived from the original on 29 June 2016. Retrieved 27 May 2016.
- “QR Code Readers for iPhone, Android, Blackberry and Windows Phone 7”. 7 December 2010. Archived from the original on 25 August 2011.
- “QR codes on China’s train tickets may leak personal information”. Want China Times. Archived from the original on 12 December 2013. Retrieved 16 March 2013.
- Novak, Asami (23 March 2008). “Japanese Gravestones Memorialize the Dead With QR Codes”. Wired. Archived from the original on 15 February 2013. Retrieved 8 May 2013.
- Skepticality (5 July 2011). “Paranormality”. Skepticality.com. Archived from the original on 3 July 2015. Retrieved 27 June 2015.
- “Herdenkingsmunt met QR code volop in het nieuws!” [Commemorative QR code in the news!]. Koninklijke Nederlandse Munt (in Dutch). 21 June 2011. Archived from the original on 29 June 2016. Retrieved 27 May 2016.
- “New ₦100 Commemorative Centenary Celebration”. Archived from the original on 8 September 2015. Retrieved 10 September 2015.
- http://www.ETRetail.com. “With IndiaQR launch, retail payments to get digital edge – ET Retail”. ETRetail.com. Archived from the original on 15 February 2017. Retrieved 15 February 2017.
- “IndiaQR to debut on Feb 20”. The Times of India. Archived from the original on 16 February 2017. Retrieved 15 February 2017.
- Hein, Buster (21 September 2017). “How to scan QR codes with iOS 11’s Camera app”. Cult of Mac. Archived from the original on 5 January 2019. Retrieved 28 May 2019.
- Lacoma, Tyler (3 October 2018). “How to Scan a QR Code”. Digital Trends. Archived from the original on 22 April 2019. Retrieved 28 May 2019.
- “Tesco QR Code Virtual Store”. 14 April 2012. Archived from the original on 25 May 2016. Retrieved 26 May 2016.
- Sebastián Campanario (16 September 2011). “Marketing futurista: ya se puede comprar con la cámara del celular” [Futuristic marketing: it’s already possible to purchase with a cellphone’s camera] (in Spanish). Archived from the original on 23 September 2011.
- “Marketers scatter phone-friendly codes across ads”. 11 November 2010. Retrieved 26 May 2016.
- “Top 10 QR Code Store examples”. 14 April 2012. Archived from the original on 6 June 2016. Retrieved 26 May 2016.
- “SCVNGR Unveils QR Code Payment System”. Archived from the original on 8 December 2012.
- “MasterCard starts piloting QkR mobile payment app”. 26 January 2012. Archived from the original on 8 January 2014.
- Jacobs, Harrison. “One photo shows that China is already in a cashless future”. Business Insider. Retrieved 14 October 2019.
- Mozur, Paul (16 July 2017). “In Urban China, Cash Is Rapidly Becoming Obsolete”. The New York Times. ISSN 0362-4331. Retrieved 14 October 2019.
- “Paying With Your Mobile Wallet To Get Simpler With Interoperable QR Codes”. Moneycontrol. Retrieved 22 December 2020.
- “A Hangzhou Story: The Development of China’s Mobile Payment Revolution” (PDF).
- “Payment methods in China: How China became a mobile-first nation”. daxueconsulting.com. Retrieved 23 June 2020.
- “Standard – Formát pro sdílení platebních údajů v rámci tuzemského platebního styku v CZK prostřednictvím QR kódů” [Standard No. 26: Format for exchanging payment information for domestic payments in CZK using QR codes] (in Czech). Czech Banking Association. November 2012. Archived from the original on 3 June 2016. Retrieved 27 May 2016.
- “Formát pro sdílení platebních údajů v CZK – QR kódy” [Format for exchanging payment information in CZK – QR codes] (in Czech). the Czech Banking Association. August 2015. Retrieved 2020-02-17.
- “Google testing login authentication via QR codes”. Archived from the original on 15 June 2013.
- Management 2020 (https://modernrestaurantmanagement.com), Modern Restaurant (22 October 2020). “Restaurant QR Codes: 2020’s Comeback Story | Restaurant QR Codes: 2020’s Comeback Story | Modern Restaurant Management | The Business of Eating & Restaurant Management News”. Modern Restaurant Management. Retrieved 1 November 2020.
- Kastrenakes, Jacob (29 September 2020). “Square launches QR codes that let you order from your table at a restaurant”. Verge.com. VOX Media LLC. Retrieved 24 November 2020.
- Glass, Noah (7 October 2020). “How To Prepare For Table Service 2.0”. Forbes. Retrieved 24 November 2020.
- “Share your Wi-Fi SSID & Password using a QR Code”. 19 July 2015.
- “zxing documentation: barcode contents”. GitHub. zxing.
- “モノウォッチは生まれ変わります”. Archived from the original on 13 November 2015. Retrieved 10 September 2015.Michael Keferl (20 March 2008). “QR code graves give a “Memorial Window“