Ready to go out on the town before summer ends? In parts of the U.S., you might have to carry your COVID-19 vaccine card or a digital copy to get into restaurants, bars, nightclubs and outdoor music festivals. After resisting the divisive concept of vaccine passports through most of the pandemic, a fast-growing number of private venues and some local officials are now requiring proof of immunization in public settings to reduce the spread of the highly transmissible delta variant of the coronavirus — and to assuage wary customers. It’s unlikely the U.S. will adopt a national mandate like the one in France, which on Monday began requiring people to show a QR code proving they have a special virus pass before they can enjoy restaurants and cafes or travel across the country. Read: COVID vaccines to be required for military under new US plan But enough venues are starting to ask for digital passes to worry some privacy advocates, who fear the trend could habituate consumers to constant tracking. ___ WHO’S ASKING FOR VACCINE PASSPORTS? New York City set the tone last week when Mayor Bill de Blasio announced that the city will soon require proof of COVID-19 vaccination for anyone who wants to dine indoors at a restaurant, see a performance or go to the gym. But a growing number of private venues, from Broadway theaters to music clubs in Minneapolis and Milwaukee, have established their own similar rules for patrons. “I’m a firm believer in the right for people to choose whether or not they get the vaccine,” said Tami Montgomery, owner of Dru’s Bar in Memphis, Tennessee, which will start asking for paper vaccine cards along with photo identification on Thursday. “But it’s my business and I have to make decisions based on what will protect my staff, business and customers.” Organizers of the Lollapalooza music festival in Chicago said on its opening day in late July that more than 90% of some 100,000 attendees presented proof of a vaccination, while most of the rest showed they’d recently had a negative COVID-19 test. Hundreds of others were turned away for lack of paperwork. Only in a handful of states — Texas and Florida are the biggest — are private businesses prohibited from requiring proof of vaccination. HOW DO THEY WORK? In some places, venues are simply asking you to bring your vaccination card — the same piece of paper you get from health providers and the Centers for Disease Control and Prevention. Taking a picture of that card at home and then showing the image to the bouncer at the club can also work. New York City offers a streamlined way of showing a photo through its NYC COVID Safe App, in which people can store images of their vaccine cards and then display them in the app when needed. Other places are encouraging people to register their credentials using a scannable digital pass like New York’s statewide Excelsior Pass or similar systems adopted by California, Hawaii and Louisiana and private companies like Walmart and the airport security app Clear. Some of the state-sponsored digital passes verify a person’s vaccine credentials through a state or local immunization registry. Read: Canada begins allowing vaccinated US citizens to visit again Such passes are designed for convenience and to prevent fraud. But that’s also where the biggest privacy concerns emerge, said Adam Schwartz, senior staff attorney at the Electronic Frontier Foundation. ___ WHAT’S WRONG WITH QR CODES? The barcode known as a QR code was originally designed to help track products in a factory. These days, it’s increasingly being used to track people’s devices. “Those systems are a giant leap towards tracking people’s location,” Schwartz said. “There’s a very real risk of mission creep once there are scanners at doors and people are showing their scannable token to pass through.” But the coalition that helped create the Smart Health Card framework used by New York, California and the Canadian province of Quebec say they’ve already set privacy safeguards to guard against misuse of health data. So long as a venue is using a VCI-compliant scanner, there shouldn’t be anything to worry about, said Dr. Brian Anderson, chief digital health physician at MITRE and co-lead of the Vaccination Credential Initiative, which counts Apple, Microsoft and the Mayo Clinic among its members. “That app won’t store an individual’s data beyond the time that the QR code is scanned,” he said. ___ WHY NOT STICK WITH PAPER? Proponents of digital passports say they’re more convenient for already-overwhelmed restaurants and other venues because workers don’t have to peer at everyone’s vaccine cards before letting them in. Lines move faster, and the digital scan reassures those who don’t want to risk damaging or losing their paper cards. It’s also easy to fake a paper card or a photo of one. The startup CrowdPass, which generates QR codes so vaccinated people can attend events, said it helped get about 15,000 people swiftly admitted into the recent Newport Folk and Newport Jazz festivals in Rhode Island. The events required attendees to digitally upload proof of full vaccination or a recent negative test. Demand was slow at first, said Duncan Abdelnour, the startup’s co-founder and president. “But since the delta variant has sprung, we’ve had a huge uptick.” Among its clients are couples planning weddings and organizers of other small events. Abdelnour said the biggest spike in calls came after New York City’s announcement. Read: Saudi Arabia opens Umrah pilgrimage to vaccinated worshipers from abroad It’s a crowded market that includes apps made by Clear and Walmart, many of which have now signed onto the VCI’s privacy standards and code of conduct. But for Schwartz, of the EFF, the best advice for venues that need to see proof of vaccination is to stick to asking for the CDC card or a photo of it. The process of making vaccination checks should end when the pandemic does, Schwartz said. “Some of the companies that are in this space have a track record of being in the business of monetizing data,” he added. “I’m not going to name names, but they’re the last people that should be involved in developing scanners for proof of vaccination.”

Vaccine passports being developed to verify COVID-19 immunization status and allow inoculated people to more freely travel, shop and dine have become the latest flash point in America’s perpetual political wars, with Republicans portraying them as a heavy-handed intrusion into personal freedom and private health choices. They currently exist in only one state — a limited government partnership in New York with a private company — but that hasn’t stopped GOP lawmakers in a handful of states from rushing out legislative proposals to ban their use. The argument over whether passports are a sensible response to the pandemic or governmental overreach echoes the bitter disputes over the past year about masks, shutdown orders and even the vaccines themselves. Vaccine passports are typically an app with a code that verifies whether someone has been vaccinated or recently tested negative for COVID-19. They are in use in Israel and under development in parts of Europe, seen as a way to safely help rebuild the pandemic- devastated travel industry. They are intended to allow businesses to more safely open up as the vaccine drive gains momentum, and they mirror measures already in place for schools and overseas travel that require proof of immunization against various diseases. Also read: The Latest: Pfizer: Vaccine effective up to 6 months later But lawmakers around the country are already taking a stand against the idea. GOP senators in Pennsylvania are drawing up legislation that would prohibit vaccine passports, also known as health certificates or travel passes, from being used to bar people from routine activities. “We have constitutional rights and health privacy laws for a reason,” said Pennsylvania House Majority Leader Kerry Benninghoff, a Republican. “They should not cease to exist in a time of crisis. These passports may start with COVID-19, but where will they end?” Benninghoff said this week his concern was “using taxpayer money to generate a system that will now be, possibly, in the hands of mega-tech organizations who’ve already had problems with getting hacked and security issues.” A Democratic colleague, Rep. Chris Rabb of Philadelphia, sees value in vaccine passports if they are implemented carefully. “There’s a role for using technology and other means to confirm people’s statuses,” Rabb said. “But we do have concerns around privacy, surveillance and inequitable access.” Republican legislators in other states have also been drafting proposals to ban or limit them. A bill introduced in the Arkansas Legislature on Wednesday would prevent government officials from requiring vaccine passports for any reason, and would ban their use as a condition of “entry, travel, education, employment or services.” Also read: Pfizer says its COVID-19 vaccine protects younger teens The sponsor, Republican state Sen. Trent Garner, called vaccine passports “just another example of the Biden administration using COVID-19 to put regulations or restrictions on everyday Americans.” President Joe Biden’s administration has largely taken a hands-off approach on vaccine passports. At a news conference this week, Andy Slavitt, acting administrator of the Centers for Medicare and Medicaid Services, said he considered them a project for the private sector, not the government. He said the government is considering federal guidelines to steer the process surrounding vaccine passports. Among its concerns: Not everyone who would need a passport has a smartphone; passports should be free and in multiple languages; and private health information must be protected. “There will be organizations that want to use these. There will be organizations that don’t want to use these,” said Dr. Brian Anderson of Mitre, which operates federally funded research centers and is part of a coalition working to develop standards for vaccine certifications to make their use easier across vendors. Also read: Pfizer COVID-19 vaccine works well in big ‘real world’ test Anderson noted the Vaccination Credential Initiative is not making recommendations on how — or even if — organizations choose to use the certifications. In Montana, GOP lawmakers this week voted along party lines to advance a pair of bills that would ban discrimination based on vaccine status or possession of an immunity passport, and to prohibit using vaccine status or passports to obtain certain benefits and services. And a freshman Republican state lawmaker in Ohio spoke out about the concept, saying more restrictions or mandates are not the answer to every COVID-19 problem. “Ohioans are encouraged to take the COVID-19 vaccine for the health and well-being of themselves and others,” Rep. Al Cutrona said. “However, a vaccine should not be mandated or required by our government for our people to integrate back to a sense of normalcy.” Republican Florida Gov. Ron DeSantis on Friday issued an executive order that said no governmental entity can issue a vaccine passport, and businesses in that state can’t require them. He said he expected the Legislature to pass a similar law. His order said requiring “so-called COVID-19 vaccine passports for taking part in everyday life — such as attending a sporting event, patronizing a restaurant, or going to a movie theater — would create two classes of citizens.” U.S. Rep. Marjorie Taylor Greene, R-Georgia, a newly elected member who has embraced and promoted a range of far-right political positions, told her supporters on Facebook earlier this week that “something called a vaccine passport” was a form of “corporate communism” and part of a Democratic effort to control people’s lives. And a GOP lawmaker in Louisiana has teed up a bill to keep the state from including any vaccination information on the Louisiana driver’s license or to make issuance of a driver’s license subject to vaccine status. In New York, a government-sponsored vaccine passport called the Excelsior Pass is being introduced. A smartphone app, it shows whether someone has been vaccinated or recently tested negative for COVID-19. Democratic Gov. Andrew Cuomo touted the idea as letting an event venue usher, for example, use their own smartphone to scan a concertgoer’s code. New York officials have not released specific details about how the app will work, access someone’s vaccination or testing status or protect a user’s name, date of birth or the location where their code was scanned. The app’s privacy policy says data will be “maintained in a secure manner” and won’t be used for sales or marketing purposes or shared with a third party. But some privacy experts say the public needs more specifics to ensure its information is protected. Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project at the Urban Justice Center, a New York–based civil rights and privacy group, warned the Excelsior Pass creates a new layer of surveillance without sufficient details about how it collects data or protects privacy. “We basically only have screenshots of the user interface and not much more,” Cahn said of Excelsior Pass.