Ready to go out on the town before summer ends? In parts of the U.S., you might have to carry your COVID-19 vaccine card or a digital copy to get into restaurants, bars, nightclubs and outdoor music festivals.

After resisting the divisive concept of vaccine passports through most of the pandemic, a fast-growing number of private venues and some local officials are now requiring proof of immunization in public settings to reduce the spread of the highly transmissible delta variant of the coronavirus — and to assuage wary customers.

It’s unlikely the U.S. will adopt a national mandate like the one in France, which on Monday began requiring people to show a QR code proving they have a special virus pass before they can enjoy restaurants and cafes or travel across the country.

But enough venues are starting to ask for digital passes to worry some privacy advocates, who fear the trend could habituate consumers to constant tracking.

Who’s Asking for Vaccine Passports?

New York City set the tone last week when Mayor Bill de Blasio announced that the city will soon require proof of COVID-19 vaccination for anyone who wants to dine indoors at a restaurant, see a performance or go to the gym.

But a growing number of private venues, from Broadway theaters to music clubs in Minneapolis and Milwaukee, have established their own similar rules for patrons.

“I’m a firm believer in the right for people to choose whether or not they get the vaccine,” said Tami Montgomery, owner of Dru’s Bar in Memphis, Tennessee, which will start asking for paper vaccine cards along with photo identification on Thursday. “But it’s my business and I have to make decisions based on what will protect my staff, business and customers.”

Organizers of the Lollapalooza music festival in Chicago said on its opening day in late July that more than 90% of some 100,000 attendees presented proof of a vaccination, while most of the rest showed they’d recently had a negative COVID-19 test. Hundreds of others were turned away for lack of paperwork.

Only in a handful of states — Texas and Florida are the biggest — are private businesses prohibited from requiring proof of vaccination.

How Do They Work?

In some places, venues are simply asking you to bring your vaccination card — the same piece of paper you get from health providers and the Centers for Disease Control and Prevention. Taking a picture of that card at home and then showing the image to the bouncer at the club can also work.

New York City offers a streamlined way of showing a photo through its NYC COVID Safe App, in which people can store images of their vaccine cards and then display them in the app when needed.

Other places are encouraging people to register their credentials using a scannable digital pass like New York’s statewide Excelsior Pass or similar systems adopted by California, Hawaii and Louisiana and private companies like Walmart and the airport security app Clear. Some of the state-sponsored digital passes verify a person’s vaccine credentials through a state or local immunization registry.

Such passes are designed for convenience and to prevent fraud. But that’s also where the biggest privacy concerns emerge, said Adam Schwartz, senior staff attorney at the Electronic Frontier Foundation.

What’s Wrong With QR Codes?

The barcode known as a QR code was originally designed to help track products in a factory. These days, it’s increasingly being used to track people’s devices.

“Those systems are a giant leap towards tracking people’s location,” Schwartz said. “There’s a very real risk of mission creep once there are scanners at doors and people are showing their scannable token to pass through.”

But the coalition that helped create the Smart Health Card framework used by New York, California and the Canadian province of Quebec say they’ve already set privacy safeguards to guard against misuse of health data.

So long as a venue is using a VCI-compliant scanner, there shouldn’t be anything to worry about, said Dr. Brian Anderson, chief digital health physician at MITRE and co-lead of the Vaccination Credential Initiative, which counts Apple, Microsoft and the Mayo Clinic among its members. “That app won’t store an individual’s data beyond the time that the QR code is scanned,” he said.

Why Not Stick With Paper?

Proponents of digital passports say they’re more convenient for already-overwhelmed restaurants and other venues because workers don’t have to peer at everyone’s vaccine cards before letting them in. Lines move faster, and the digital scan reassures those who don’t want to risk damaging or losing their paper cards. It’s also easy to fake a paper card or a photo of one.

The startup CrowdPass, which generates QR codes so vaccinated people can attend events, said it helped get about 15,000 people swiftly admitted into the recent Newport Folk and Newport Jazz festivals in Rhode Island. The events required attendees to digitally upload proof of full vaccination or a recent negative test.

Demand was slow at first, said Duncan Abdelnour, the startup’s co-founder and president. “But since the delta variant has sprung, we’ve had a huge uptick.” Among its clients are couples planning weddings and organizers of other small events. Abdelnour said the biggest spike in calls came after New York City’s announcement.

It’s a crowded market that includes apps made by Clear and Walmart, many of which have now signed onto the VCI’s privacy standards and code of conduct.

But for Schwartz, of the EFF, the best advice for venues that need to see proof of vaccination is to stick to asking for the CDC card or a photo of it.

The process of making vaccination checks should end when the pandemic does, Schwartz said. “Some of the companies that are in this space have a track record of being in the business of monetizing data,” he added. “I’m not going to name names, but they’re the last people that should be involved in developing scanners for proof of vaccination.”