> Asking Google or Apple means asking a foreign corporation, likely through legal means and definitely targeted to individuals, not population-wide.

Which would be a local telco.

Not really. My telco sees encrypted traffic only.

We are talking about check-ins and location tracking. Your telco knows where you are.

No, we're talking about actual user data. My position is only very small part of the whole story. While my telco can triangulate me, that's not as useful (precise) as you'd think, especially in vertically built-up areas and/or behind walls.

No. Original point:

> QR codes aren't effective at all as a surveillance mechanism. Why the hell does the government need to monitor which venues you visit based on QR code check-ins? They literally just ask Apple, Google, or any other big tech company about your phones geolocation and IP log history to monitor your whereabouts.

This is about locating a user based on QR code scanned at a venue. All I’m saying: no need to ask Apple or Google. Your telco already knows you have been at a location at the time of the venue.

My telco is most definitely not able to determine which particular restaurant, shop or highrise apartment I visited (I know because I have direct experience with requesting this data from telcos via courts and how precise it actually is).

Telcos can calculate approximately where I was (with accuracy worse than raw unaided GPS - so ±10m at least, and unpredictably wrong if I'm behind a wall or in a vertically built-up area) at a particular point in time - but they don't know the exact timestamp to look for.

The QR verification app doesn't ping back to a server, though. You can literally check. It's open source.

Not true. I just spent half an hour googling and otherwise looking for the source code, and it's not published anywhere (Czech version - apps named "čTečka" and "Tečka").

Sorry for the reality check: said states make requests all the time to Google and Apple and also receive the requested data, and we have apparently no issue with this. Instead we use an imaginary feature no scanner outside China has (phoning home) and complain about that.

That's alright - because that request goes through courts. When the state owns the server being requested, they just read the logs without having to consult a judge.

"Things are already bad, therefore it's okay if they get worse!"