QR Codes Are Here to Stay. So Is the Tracking They Allow

Exactly. This is sensationalism. QR is merely a barcode capable of encoding rich data. It would be trivial, as you noted, to simply decode the QR code and use an alternate method of browsing. Furthermore, in the USA the ADA protects alternative methods of ordering, so you won’t starve to death because of “QR tracking”.

As long as unscrupulous businesses (not the restaurants in this case) abuse personal privacy, a market will exist that protects it.

Except an ordinary human can't decode a QR code, so you will only know after the fact.

This is definitely already a thing. There were reports of that happening here in Japan when the QR code payment system PayPay took off a few years ago. People would paste their own QR code ontop of the store one

In 2011 I remember reading about “QR phishing”, where a transparency is overlaid on a QR code to completely change the data while barely modifying the representation.

http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/

In the current state of play you might be right.

I think many of the same rules apply to anti-phishing. A lot of it is about education: making sure that patrons know what a legitimate QR code domain is going to be in advance so they can check it, providing some reporting system for suspect ones (this probably just means telling a member of staff so they can scrape it off and tell the police).

There are some additional advantages afforded to us in the real world like, if the need arise, they could be made hard to forge by including custom holograms, embossed patterns and the like.

Although at the moment it seems not many places are taking advantage of these kinds of practices yet, probably because a high profile breach has yet to happen around it.

The Gell-Mann Amnesia effect is how.

Michael Crichton explains:

“Briefly stated, the Gell-Mann Amnesia effect is as follows. You open the newspaper to an article on some subject you know well. In Murray's case, physics. In mine, show business. You read the article and see the journalist has absolutely no understanding of either the facts or the issues. Often, the article is so wrong it actually presents the story backward—reversing cause and effect. I call these the "wet streets cause rain" stories. Paper's full of them. In any case, you read with exasperation or amusement the multiple errors in a story, and then turn the page to national or international affairs, and read as if the rest of the newspaper was somehow more accurate about Palestine than the baloney you just read. You turn the page, and forget what you know.”

In most cases a QR code is just opening a URL, and if the URL seems sketch, don't put your credit card in.

If I said go to amazon.cz/menu and asked you to put in your credit card, it really is no different.

Most places I've been to in the past year at least here in London (UK) didn't allow ordering at the bar due to restrictions around queues. Many also didn't allow paying with cash.

Honestly, this isn't really that effective a tracking system, retailers already use beacons that can track every phone that comes into an area, due to the nature of of the way mobile devices look for wifi signal, and in some extreme cases cell towers, a phones in a retail space can be tracked easily, and without consent, knowledge, or interaction of the consumer. These devices can also restrict the range of their signal, and multiple can be used in a location, to track what parts of the stores you are in, and be used at a register location to associate mobile devices to transactions.

This has been happening for years, and is used widely across the industry, more than a decade ago I worked with one of these systems to be able to associate face from a camera system with this system to add a facial identify to the data.

QR codes are seriously nothing compared to that, and the user has to actively interact with them.