QR Codes Are Here to Stay. So Is the Tracking They Allow.

SAN FRANCISCO — When people enter Teeth, a bar in San Francisco’s Mission neighborhood, the bouncer gives them options. They can order food and drinks at the bar, he says, or they can order via a QR code.

Each table at Teeth has a card emblazoned with the code, a pixelated black-and-white square. Customers simply scan it with their phone camera to open a website for the online menu. Then they can input their credit card information to pay, all without touching a paper menu or interacting with a server.

A scene like this was a rarity 18 months ago, but not anymore. “In 13 years of bar ownership in San Francisco, I’ve never seen a sea change like this that brought the majority of customers into a new behavior so quickly,” said Ben Bleiman, Teeth’s owner.

QR codes — essentially a kind of bar code that allows transactions to be touchless — have emerged as a permanent tech fixture from the coronavirus pandemic. Restaurants have adopted them en masse, retailers including CVS and Foot Locker have added them to checkout registers, and marketers have splashed them all over retail packaging, direct mail, billboards and TV advertisements.

But the spread of the codes has also let businesses integrate more tools for tracking, targeting and analytics, raising red flags for privacy experts. That’s because QR codes can store digital information such as when, where and how often a scan occurs. They can also open an app or a website that then tracks people’s personal information or requires them to input it.

As a result, QR codes have allowed some restaurants to build a database of their customers’ order histories and contact information. At retail chains, people may soon be confronted by personalized offers and incentives marketed within QR code payment systems.

“People don’t understand that when you use a QR code, it inserts the entire apparatus of online tracking between you and your meal,” said Jay Stanley, a senior policy analyst at the American Civil Liberties Union. “Suddenly your offline activity of sitting down for a meal has become part of the online advertising empire.”

QR codes may be new to many American shoppers, but they have been popular internationally for years. Invented in 1994 to streamline car manufacturing at a Japanese company, QR codes became widely used in China in recent years after being integrated into the AliPay and WeChat Pay digital payment apps.

In the United States, the technology was hampered by clumsy marketing, a lack of consumer understanding and the hassle of needing a special app to scan the codes, said Scott Stratten, who wrote the 2013 business book “QR Codes Kill Kittens” with his wife, Alison Stratten.

That has changed for two reasons, Mr. Stratten said. In 2017, he said, Apple made it possible for the cameras in iPhones to recognize QR codes, spreading the technology more widely. Then came the “pandemic, and it’s amazing what a pandemic can make us do,” he said.

Half of all full-service restaurant operators in the United States have added QR code menus since the start of the pandemic, according to the National Restaurant Association. In May 2020, PayPal introduced QR code payments and has since added them at CVS, Nike, Foot Locker and around one million small businesses. Square, another digital payments firm, rolled out a QR code ordering system for restaurants and retailers in September.

Businesses don’t want to give up the benefits that QR codes have brought to their bottom line, said Sharat Potharaju, the chief executive of the digital marketing company MobStac. Deals and special offers can be bundled with QR code systems and are easy to get in front of people when they look at their phones, he said. Businesses also can gather data on consumer spending patterns through QR codes.

“With traditional media, like a billboard or TV, you can estimate how many people may have seen it, but you don’t know how people actually interacted with it,” said Sarah Cucchiara, a senior vice president at BrandMuscle, a marketing firm that introduced a QR code menu product last year. “With QR codes, we can get reporting on those scans.”

Cheqout and Mr. Yum, two start-ups that sell technology for creating QR code menus at restaurants, also said the codes had brought advantages to businesses.

Restaurants that use QR code menus can save 30 percent to 50 percent on labor costs by reducing or eliminating the need for servers to take orders and collect payments, said Tom Sharon, a co-founder of Cheqout.

Digital menus also make it easier to persuade people to spend more with offers to add fries or substitute more expensive spirits in a cocktail, with photographs of menu items to make them more appealing, said Kim Teo, a Mr. Yum co-founder. Orders placed through the QR code menu also let Mr. Yum inform restaurants what items are selling, so they can add a menu section with the most popular items or highlight dishes they want to sell.

These increased digital abilities are what worry privacy experts. Mr. Yum, for instance, uses cookies in the digital menu to track a customer’s purchase history and gives restaurants access to that information, tied to the customer’s phone number and credit cards. It is piloting software in Australia so restaurants can offer people a “recommended to you” section based on their previous orders, Ms. Teo said.

QR codes “are an important first step toward making your experience in physical space outside of your home feel just like being tracked by Google on your screen,” said Lucy Bernholz, the director of Stanford University’s Digital Civil Society Lab.

Ms. Teo said that each restaurant’s customer data was available only to that establishment and that Mr. Yum did not use the information to reach out to customers. It also does not sell the data to any third-party brokers, she said.

Cheqout collects only customers’ names, phone numbers and protected payment information, which it does not sell to third parties, Mr. Sharon said.

On a recent blustery evening at Teeth, customers shared mixed reviews of the QR code ordering system from Cheqout, which the bar had installed in August. Some said it was convenient, but added that they would prefer a traditional menu at a fine dining establishment.

“If you’re on a date and you’re whipping your phone out, it’s a distraction,” Daniela Sernich, 29, said.

Jonathan Brooner-Contreras, 26, said that QR code ordering was convenient but that he feared the technology would put him out of his job as a bartender at a different bar in the neighborhood.

“It’s like if a factory replaced all of its workers with robots,” he said. “People depend on those 40 hours.”

Regardless of customers’ feelings, Mr. Bleiman said Cheqout’s data showed that about half of Teeth’s orders — and as much as 65 percent during televised sports games — were coming through the QR code system.

“They may not like it,” he said in a text message. “But they’re doing it!”