Â鶹´«Ã½

Sci-Tech

    • 'Convenience comes at a price': Experts urge caution on QR codes

    Share
    TORONTO -

    With the rise in popularity of QR codes at restaurants and other businesses during the pandemic, privacy and cyber security experts are urging Canadians to be cautious in their use of the technology.

    While the technology has been around since the early 90s, “quick response†or “QR†codes have experienced a rapid resurgence during the pandemic. The unique black-and-white squares – which serve as a kind of bar code – replaced physical menus at restaurants and other paper forms during the early push to provide touchless service and avoid further spread of COVID-19.

    Instead of handling a menu or filling out a check-in document, customers could use their smartphones to quickly scan a QR code, which would take them to a digital menu or online contact tracing form, for example.

    And although the science on COVID-19 has been updated to show the disease is not as easily spread by contaminated surfaces as it was first thought, businesses have continued to make use of QR codes for their convenience and other advantages. Some of those perks include cost savings in not printing menus, the ease of editing a menu online, and the ability to collect information on their customers’ preferences to cater to them.

    But are there any potential downsides to this QR code technology that’s being embraced so widely?

    INCREASED TRACKING

    While directing diners to a digital menu using a QR code may seem innocuous, privacy experts expressed their concerns about what personal data is being collected and how it could be used when a customer visits a particular website.

    For example, a customer might be taken to the restaurant’s website or a third-party service provider that uses cookies to track visitors’ behaviours. If the diner orders directly off the digital menu, the restaurant or service provider might be able to store those preferences and other information, such as the time of the visit, to target their ads or upsell the customer with personalized offers and incentives.

    Brenda McPhail, the director of the privacy, technology and surveillance program at the Canadian Civil Liberties Association (CCLA), said QR codes are not always problematic, but it can be difficult to tell when they are.

    “We don't know whether all the code is doing is taking us to a website to show us a restaurant menu, or whether the code also has information built into it that will allow whoever created the code to keep track of what we ordered,†she told CTVNews.ca during a telephone interview on Monday.

    McPhail cautioned that every time another layer of technology is added to an everyday activity in a “surveillance capitalist economy,†there is the risk of increased tracking of consumers’ daily habits.

    “We are increasingly surrounded by technologies that appear to do one thing to help us that we choose, and that beneath the surface, do another thing, which is collect information about us, and how we use that technology, and where we use it, in order to collect more and more detailed information about us for advertising purposes,†she said.

    Ritesh Kotak, a Toronto-based cyber security expert, explained that every time a consumer scans a QR code, some metadata, such as the type of device they’re using, their location, IP address, the date and time, and any other information they input in a COVID-19 contact tracing form, for example, may be collected.

    “To the average person they may be like, ‘Well, whatever, you got an IP address, you know that I'm on an iPhone or an Android. OK, great.’ The problem becomes… if that data starts getting aggregated with different sources,†he said.

    Kotak said many restaurants are using third-party apps for their QR code technology, which means a single company may be able to collect data on individual customers from multiple establishments.

    “When you start aggregating that stuff, you start getting a really fulsome picture on an individual and that is when it becomes scary,†he said.

    A LACK OF CONSENT

    Sharon Polsky, the president of the non-profit Privacy and Access Council of Canada, said one of her major concerns with the use of QR codes is that Canadians aren’t always being asked for their consent to have their information collected, stored, and used for advertising or promotional purposes.

    Even if they are presented with an option to provide their consent, they typically have no other choice but to accept what it says if they want to proceed with the service.

    “It’s an all-or-nothing proposition. Either you consent or you don't use our service or product,†Polsky said. “The consent model right now is absolutely coercive, we have no alternative. So that’s something that needs to be changed.â€

    McPhail agreed that businesses should request customers’ consent to track their data when they first scan the QR code.

    “If it was a consent-based as opposed to something that happened in the background and in secret, then that changes the consumer equation, people have a choice,†she said.

    “We have privacy laws that require that personal information collected about us by a commercial entity should be consent based. So it’s not just a nice thing to ask for consent. It's actually legally required.â€

    Unfortunately, because the widespread adoption of QR codes is still relatively new, in Canada at least, McPhail said businesses aren’t necessarily aware of these laws or how they should be asking for consent when they’re using third-party apps.

    SECURITY RISKS

    In addition to privacy concerns, Kotak said there are also potential cyber security risks with the use of QR codes. He said the technology could be vulnerable to cyber attacks in which someone embeds malicious malware into the QR code to extract data from the mobile device used to scan it or they embed a different URL that takes the scanner to a phishing site to get them to disclose information.

    “We have seen this where the URL actually gets redirected to another site that is actually collecting information,†he said.

    McPhail added that there are known scams in which people paste a sticker with their own QR code on it over top of a legitimate code in order to redirect an unsuspecting user to their website.

    “It gets more dangerous if the code takes you to a site that's not just about looking at a menu, but maybe also paying for your purchase because at that point, of course, then there's the risk that your banking information or financial information will get scooped or that you'll simply be paying scammers instead of the restaurant,†she said.

    Kotak said that while QR code technology is certainly convenient, there could be a price to pay for that convenience, especially if it’s not implemented properly with the right safeguards.

    “If the recent increase in cyber-related frauds and crime is any indication of where we're headed, it is all the more important to think about these things and patch up vulnerabilities before they become mainstream, before they get exploited, and our data gets weaponized against ourselves.â€

    EQUITY CONCERNS

    McPhail noted that restaurants or other businesses that require customers to scan a QR code with a smartphone for service might be discriminating against those who don’t own a device containing that technology.

    “While most of us do, many of us do, one thing we learned during the rollout of the COVID alert exposure notification app… was that there's a small, but significant proportion of the population that don't have that phone,†she said. “If you don't have a phone, you should still be able to order in a restaurant.â€

    According to the (ACLU), older populations, low-income individuals, the unhoused, and those with disabilities are less likely to be able to afford a smartphone than other groups.

    “When restaurants make owning a smartphone and being able to scan a QR code the default for being served a meal, that also has significant implications for equity,†the group states on its website. “These are some of our most vulnerable communities.â€

    McPhail said the easiest way to solve this disparity is to provide paper menus or contact tracing forms for those who don’t own a smartphone.

    “What we know about the way that COVID transfers is that it's probably perfectly safe to look at a paper menu for a few minutes to decide what you want,†she said.

    HOW TO PROTECT YOURSELF

    The simplest way for customers to protect themselves from the potential risks of scanning a QR code, according to the privacy and cyber security experts who spoke to Â鶹´«Ã½, is to avoid using it altogether and to request a paper copy of the menu or to provide their contact tracing information on paper.

    “I think it's important for people to understand that the convenience comes at a price, and that they're allowed to ask for a paper menu, they're allowed to present a paper immunization record,†Polsky said.

    Another option is for diners to navigate to the digital menu through their browser instead of using the QR code; however, McPhail said there might still be cookies on the restaurant’s website, but at least visitors know it’s the right website and they can turn off cookies in their browser if they’re concerned.

    The ACLU recommends that consumers treat QR codes like a link in an unknown email. The organization also said they can use software that allows them to inspect the QR code or the action it will take before it’s passed to their browser or any other app.

    Kotak suggested that diners look out for QR codes that look like they have been pasted over top of another one. He said they can also ask the host or manager of the restaurant if the link to their website on the QR code is the correct one because it’s the responsibility of the restaurant or business to ensure it hasn’t been manipulated.

    “Think before you click. Think before you provide information,†he said.

    “Don’t arbitrarily just snap a photo. You take out your phone, get the link, and start giving away your personal information. That is your data. And if it gets out in the wild, getting it back and remedying it is extremely difficult and in some cases, almost impossible.†

    CTVNews.ca Top Stories

    A team of tornado experts is heading to Fergus, Ont. after a storm ripped through the area Sunday night.

    Why brain aging can vary dramatically between people

    Researchers are uncovering deeper insights into how the human brain ages and what factors may be tied to healthier cognitive aging, including exercising, avoiding tobacco, speaking a second language or even playing a musical instrument.

    Canada

    • A team of tornado experts is heading to Fergus, Ont. after a storm ripped through the area Sunday night.

    • Two nephews of the beloved Harry R. Hamilton share stories about his life and legacy.

    • The federal government is urging both sides in the British Columbia port dispute to return to the table after mediated talks broke off on Saturday, the first of three scheduled days.

    • The union representing some 1,200 dockworkers at the Port of Montreal has overwhelmingly rejected a deal with their employers association.

    World

    Politics

    • Murray Sinclair’s family members say the late justice and senator has been laid to rest according to his wishes.

    • Prime Minister Justin Trudeau announced voters in Cloverdale—Langley City will pick their next member of Parliament on Dec. 16.

    Health

    Sci-Tech

    Entertainment

    Business

    Lifestyle

    Sports

    • Canada will be without captain Alphonso Davies for its upcoming CONCACAF Nations League quarterfinal against Suriname.

    • The Edmonton Oilers may have found the break they were looking for.

    Autos

    Local Spotlight

    For the second year in a row, the ‘Gift-a-Family’ campaign is hoping to make the holidays happier for children and families in need throughout Barrie.

    Some of the most prolific photographers behind CTV Skywatch Pics of the Day use the medium for fun, therapy, and connection.

    A young family from Codroy Valley, N.L., is happy to be on land and resting with their newborn daughter, Miley, after an overwhelming, yet exciting experience at sea.

    As Connor Nijsse prepared to remove some old drywall during his garage renovation, he feared the worst.

    A group of women in Chester, N.S., has been busy on the weekends making quilts – not for themselves, but for those in need.

    A Vancouver artist whose streetside singing led to a chance encounter with one of the world's biggest musicians is encouraging aspiring performers to try their hand at busking.

    Ten-thousand hand-knit poppies were taken from the Sanctuary Arts Centre and displayed on the fence surrounding the Dartmouth Cenotaph on Monday.

    A Vancouver man is saying goodbye to his nine-to-five and embarking on a road trip from the Canadian Arctic to Antarctica.

    • A suspect was arrested for allegedly brandishing a knife outside a Vancouver elementary school on Friday – just as the young students were heading home for the day.

    • The federal government is urging both sides in the British Columbia port dispute to return to the table after mediated talks broke off on Saturday, the first of three scheduled days.

    • Thousands of people gathered in downtown Vancouver Monday to observe the 100th Remembrance day ceremony at the Victory Square cenotaph, paying their respects to the Canadian soldiers who made the ultimate sacrifice for their country.

    • Several hundred people gathered outside the Ontario legislature in Toronto to honour veterans and remember those who died fighting for their country.

    • Toronto is expected to see an economic boost to the tune of nearly $300 million thanks to Taylor Swift’s upcoming Eras Tour, which will be making a stop in Canada’s largest city for a six-show run later this month.

    • A man believed to be in his 40s has been rushed to a trauma centre following a stabbing in downtown Toronto.

    • Calgarians will be observing Remembrance Day at a number of different ceremonies across the city, including at the Hangar Flight Museum.

    • July 2025 may seem like it’s in the distant future, but for the St. Luke playground committee time is ticking to fundraise the $340,000 they still need to build a new playground.

    • Getting out to the mountains is even easier with a new bus route from a growing Germany-based service.

    • Crowds gathered in Ottawa and eastern Ontario on Monday to honour the sacrifice of men and women in uniform who gave their lives in service of Canada.

    • The Fleet Street Pumping station is Ottawa's oldest water facility. Up to two-thirds of the city's water supply can move through it,

    • The company confirms it will open the new Chipotle at 5671 Hazeldean Road on Thursday, in the former location of Benny & Co.

    • A 36-year-old Montreal man who was out on bail after allegedly uttering death threats to a woman is now accused of murdering her on the South Shore.

    • Private Martine Roy was only 20 years old in 1984 when she was arrested, interrogated and dismissed from the Canadian Armed Forces for being what was then termed a "sexual deviant."

    • With fewer interments and rising maintenance fees, the money for Canada's largest military cemetery will run out in three to four years.

    • A member of Canadian Forces Base (CFB) Edmonton participated in the national Remembrance Day Ceremony in Ottawa on Monday.

    • Canada will be without captain Alphonso Davies for its upcoming CONCACAF Nations League quarterfinal against Suriname.

    • Thousands of Maritimers turned out in wet weather Monday to remember those who have served, and continue to serve, in Canada's armed forces for Remembrance Day.

    • A Cape Breton senior recalls her life in German-occupied France, and her mother’s death, during the Second World War.

    • Thousand of people gathered at the Menin Gate in the Ypres, Belgium for Monday’s Remembrance Day Ceremony.

    • Thousands gathered at the RBC Convention Centre on Monday to bear witness to a sombre and historic Remembrance Day ceremony.

    • One Manitoba veteran is on a mission to commemorate and honour those who served our country, and not just on Remembrance Day.

    • Winnipeg police have identified two men involved in a stabbing incident earlier this week.

    • There will be two ceremonies taking place in Regina for Remembrance Day, hosted by the Royal Canadian Legion.

    • Fire crews reported that no one was hurt after flames broke out in a home on Robinson Street in central Regina.

    • Regina author Valerie Crowther is celebrating the release of her book ‘War Letters: Linking Lives in the Second World War.’

    • Saskatchewan RCMP are searching for a suspect after a man was seriously injured in a farm-related incident in Montreal Lake.

    • It was a somber day at Mosaic Stadium as members of the Saskatchewan Roughriders officially cleaned out their stalls and closed the book on the 2024 season.

    • The Regina Rams claimed the Hardy Cup after a hard fought battle against the Saskatoon Huskies 19-14 on Saturday in the first all Saskatchewan U-Sports western conference final since 2002.

    • Emergency crews responded to the scene on Road 68/Highway 2 east of Thamesford around 7 p.m.

    • The events will start at 10:15 a.m. with a parade that forms up in front of the Delta London Armories, marches east on Dundas Street and turns north onto Waterloo Street to Dufferin Avenue, the west to the Cenotaph.

    • A team of tornado experts is heading to Fergus, Ont. after a storm ripped through the area Sunday night.

    • A Barrie man is at the centre of an alleged $2.2 million stolen used car scheme.

    • The 75th anniversary of the Barrie Santa Claus Parade will feature floats, live entertainment, and new attractions, including Santa’s Fireside Gathering.

    • Environment Canada issued a weather alert for Barrie, Collingwood and surrounding areas, alerting residents about the wicked winds that are expected to pick up to 80 kilometres per hour in the afternoon hours.

    • Representatives of the Windsor Veterans Memorial Services Committee, military representatives, wreath bearers, government officials, and members of the public will attend the Cenotaph at City Hall Square for the outdoor service.

    • Windsor Paralympic champion, Danielle Campo, has been crowned the number one Inspirational Speaker of the Year for 2024 at the Inspirational Speaking Finals.

    • One person has been arrested after Chatham-Kent Police Service (CKPS) received multiple complaints about an alleged drunk driver.

    • Environment Canada says heavy rain and winds could cause power outages on Vancouver Island as an "intense" storm system is set to hit the B.C. coast Sunday.

    • Six deer were struck by vehicles in six different locations in a six-hour period on B.C. highways on Saturday, according to the transportation ministry.

    • The union for locked-out port workers in British Columbia says the BC Maritime Employers Association cut off talks in less than an hour Saturday, refusing to budge on a final offer that the union has so far rejected.

    • The emergency department at South Okanagan General Hospital in Oliver, B.C., will be closed for 31 hours this weekend, the second such closure in a week and the third since the start of November.

    • Police in Kamloops, B.C., are reminding parents and guardians to check their children's Halloween candy after receiving a report of a mother finding a razor blade in one of her daughter's treats.

    • More than two years after Alannah Brown and Douglas Barker were found dead north of Penticton, police are asking for help identifying a vehicle they believe was associated with the crime.

    • The Southern Alberta Recreation Association is officially announcing the Town of Taber as next year’s host for the Southern Alberta Summer Games.

    • The Lethbridge Hurricanes broke open a close game with three goals in the first two minutes of the third period as they defeated the Warriors 7-3 in a game played Friday night in Moose Jaw.

    • There might not a lot snow just yet, but many southern Albertans are still itching to get outdoors.

    • It was just days before the COVID-19 pandemic shut the world down when the Shaft Bottom Boys of Sudbury broke a world record for 'Deepest Concert Underground.' Now, more than four years later, a Timmins band is looking to take the title.

    • Police say that a 16-year-old was attacked with a sword Nov. 3 in Cobalt, Ont., in a case of intimate partner violence.

    • Police have arrested a 15-year-old in connection with a break-in and $50,000 in damage done to the Centennial Arena in Elliot Lake in September.

    N.L.

    Shopping Trends

    The Shopping Trends team is independent of the journalists at Â鶹´«Ã½. We may earn a commission when you use our links to shop. Read about us.

    Stay Connected
    Follow Â鶹´«Ã½