Buyer beware! Businesses may be out to collect your personal data
You walk into a café and the barista invites you to scan the QR code to order. Since you are in a hurry, that certainly seems quick and convenient.
But after scanning the code, you are asked for your WeChat account, avatar and phone number. You either don't think twice and click "allow," or you think twice and choose "deny," which automatically terminates the order.
This is a scene that consumers can encounter every day at restaurants, bars, cafes or milk tea outlets. Many people don't give it a second thought, but perhaps they should.
"If you click 'allow,' troubles may follow," said Jennifer Liang, a white-collar worker who often dines out. "Sometimes you will automatically find yourself in some WeChat official accounts that keep pushing ads, or sometimes you may find yourself in a chatting group filled with ads."
Many consumers, especially seniors, may not realize what they are getting into.
"My husband and I are not good at using a smart phone," said 69-year-old Yuan Weijian. "When waiters or waitresses ask us to order by scanning the code, we usually just click 'agree,' 'agree,' and 'agree,' and we don't realize what's happened until we start to be deluged by promotional ads."
Last week Shanghai cyber security authorities and market supervisors collared the SimplyThai, Shake Shack and Starbucks chains related to excessive collection of user information.
The three brands were accused of illegally collecting personal consumer information by their failure to provide an option for consumers to refuse to provide data such as names, birthdays, addresses, ID card numbers and even bank accounts.
The three brands later issued separate statements pledging to do better. Options to provide personal info have been added to their digital ordering services. And customers are also being informed about how any information collected will be used.
The three chains have added "informed consent" sections when new users scan in the code.
At Starbucks for example, the consent includes the company's privacy policy on collection and use of consumer data. If consumers choose not to provide the data, they may place orders at the counter. The service of pre-ordering and picking up orders at the counter isn't available.
The problem of luring consumers into advertising traps isn't confined to the three brands.
Earlier this year, the Shanghai Consumers Council undertook a secret investigation of 29 shops in the city. It found that most milk tea outlets, like ALittle Tea, collected personal data when providing online ordering services.
The investigation found that ordering a cup of milk tea might extract up to 87 pieces of personal information, such as cell phone numbers and location.
The council's survey also said it found that a majority of consumers were unhappy about this collection of data.
"My concern is whether these businesses can protect our data well as promised in their privacy policies," said Liang. "Otherwise, the data could be sold on or leaked."
The problem is not limited to catering services.
Local Internet security authorities warn consumers that personal data may be collected in seven other realms beyond dining: parking lots, education and training for children, real estate services, charger rental, general markets, automobile dealerships and online financial services.
"We have launched a campaign to make the public more aware of this issue," said Kong Yan, an official with Cyberspace Administration of Shanghai.
Liu Chunquan, a lawyer who specializes in intellectual property, told Shanghai Daily that businesses are allowed to collect personal data if consumers consent, but it is against the law to coerce consumers into providing such info."
The Personal Information Protection Law says it's illegal to cancel or refuse service to consumers who refuse to provide information, Liu said.
"For example, some WeChat account information, such as avatars, is not necessary for ordering dishes," Liu said, adding that the law is a bit sketchy in what penalties offenders might face.
In fact, it's hard to find businesses that have been fined for illegally collecting information or refusing service.
The last reported case occurred in early 2021, when a restaurant chain called Wangrongcheng was fined 50,000 yuan (US$6,964) by Putuo District market supervisors for collecting consumer cell phone numbers.
Authorities said that the restaurant collected 5,893 pieces of information through its management software but didn't take any steps to ensure the security of the data.
The leaking of personal data remains a serious threat to personal privacy.
Police have warned that most telecommunication fraud cases nowadays are related to personal data leaks. It is often reported that criminals are caught for trading in data that people disclose to technology companies and other service providers.
The latest case involved a gang of 66 in Hunan Province. Its members asked people to provide names, cell phone numbers and ID card numbers when helping them activate social security cards, then used the information fraudulently.
Kong said people need to remember one basic principle in protecting their privacy: "Don't provide information unless it's absolutely necessary."
Consumers can call the city's government hotline 12345 to report illegal personal data collection. Various language services, including English, French and Japanese, are available.
In Case You Missed It...
Sep 5, 2026
