QR codes are popular again, but privacy concerns remain

When Sasha Steinberg reopened Cider House after a COVID-19 shutdown last year, she erased the pub's list of about 50 ciders from a wall chalkboard and stopped printing hundreds of menus, instead placing pixelated, black and white squares on tables.

When scanned with a smartphone, the QR (Quick Response) codes generate a COVID-19 screening questionnaire, and guests who report no symptoms can then click through to the west Toronto pub's menu.

"It's worked like a dream," said Steinberg. In some ways it's an improvement, she said, since it reduces the grunt work associated with constantly cleaning menus and updating the chalkboard.

"I don't think that in the future we will go back to our regular menu."

Scores of other businesses have made similar moves, finding the solution cost effective and easy to use, as QR technology can link to websites, forms or apps. It's fast and often, free.

Dating back to the 1990s, QR code technology was originally developed for the automotive industry before disappearing. Thanks to the pandemic, they are now making a comeback, though data security and privacy concerns have emerged.

Saskatchewan removed QR codes from vaccination records last week after a privacy breach involving at least 19 codes displaying the wrong person's health info.

Weeks earlier, there were reports in Quebec that QR codes had been stolen from vaccine passports belonging to legislature members.

Across the border, Florida attorney general Ashley Moody warned scammers can use the technology to reroute consumers to malicious websites.

"The risks are out there," said Imran Ahmad, a partner at Norton Rose Fulbright Canada LLP and co-head of the firm's data protection, privacy and cybersecurity practice.

"Hackers are always evolving. They're super sophisticated, they're going to find a way to reroute you to a site that may be malicious or a site that looks legit but actually has bad things happening in the background that are maybe unbeknownst to you."

He expects the implementation of vaccine passports in additional provinces and the introduction of such technology at more businesses to make privacy a hot topic.

QR codes didn't become ubiquitous for consumers until the mid-2000s, when smartphones became more commonly used, making users a target for marketers. But many smartphone users still didn't have internet or data and QR code reading technology wasn't as sophisticated as it is today.

The technology languished until pandemic measures created a perfect niche for its use. Suddenly, people wanted to avoid handling objects such as menus, pens, forms or shared devices.

"I hardly used a QR code before the pandemic and now, not only am I using them, but I know how to use them very well," said Sylvain Charlebois, director of the Agrifoods Analytics Lab at Dalhousie University in Halifax.

A recent survey he conducted estimated three in five Canadians had used QR codes at a restaurant or grocery store in the previous month.

That means about 40% of the country is not using QR codes, though Charlebois said that percentage is much lower among millennials and gen Z.

He believes QR code usage will increase further because retailers and food businesses are increasingly seeing the wealth of data it can provide and its ease of use.

"You never know that you actually need something until you actually see it or use it well," he said.

However, he warns that companies and consumers should be careful because anyone can generate a QR code, raising cybersecurity concerns because some may use them to dupe or scam others.

"People are scanning everything and implying that things are safe, but if (QR codes) are going to get used more often, we're going to have to start thinking about authenticity," he said.

Ahmad recommends businesses seeking a QR code service look for white papers verifying the provider's privacy policies, and inquire with other companies already using its products about their experience.

If consumers scan a code and it delivers malicious content or they have concerns after inputting information, he recommends they reach out to the Canadian Anti-Fraud Centre or a credit monitoring firm that can investigate abnormal activity in financial accounts.