Once Americans get accustomed to scanning a QR code every time they enter a building, there is no limit to the surveillance and nudges that can be built on top of it.

There would be a record of where you went and who you were with any time you went out to a bar. Right now you have to show ID to drink, which some people think is equivalent to showing proof of vaccination. But the police can’t call up the bar and ask for a list of everyone who was on the premises last night. Under a vaccine passport regime, providing such a list would be as easy as pointing and clicking. Australian police have already used data from QR code check-ins in criminal investigations. This suggests they get some level of surveillance out of it beyond what they had before, even with cell phone location tracking and other digital footprints.

It would be very easy for apps like CLEAR Health Pass to build social credit systems on top of vaccine passports, rewarding certain behaviors and penalizing others—all the more so because they are private companies. Politicians from the Biden White House down have been eager to delegate vaccine passport apps to the private sector, possibly with an eye to insulating themselves from legal challenges. Imagine today’s debates about whether Twitter and Facebook are free to penalize any user they like or whether they have obligations as the new virtual public sphere, but about the actual public sphere. That’s what will happen when every storefront is plugged into the CLEAR or VaxYes ecosystem.