Which China QR codes should first-time visitors be ready for?

Scope first: these six rules bind operators in Beijing, and the national anchor is the personal information law they cite

The document sets out six compliance guidelines “供全市提供扫码消费服务的经营者遵照执行” — for scan-to-consume operators across the municipality, meaning Beijing. So the guidelines themselves are a Beijing standard, not a national one. What is national is the law they invoke: the Personal Information Protection Law, whose Article 6 requires collection to be limited to the minimum scope needed for the stated purpose and prohibits excessive collection.

Where in the source: Opening publication sentence and the 六条合规指引 preamble; PIPL Article 6 as quoted in the document

You cannot be forced to hand over personal information unrelated to the service

Guideline 4 states that an operator providing scan-to-consume services must comply with the law and obtain the consumer's consent, and may not in any form or for any reason force a consumer to consent to collection of personal information unrelated to the service being provided. That is the sourced core of this page's point that a code flow can ask for more than the transaction needs — and that saying no is a position the rules already take.

Where in the source: Guideline 4, including “不得以任何形式和理由强迫消费者同意经营者收集与其提供服务无关的个人信息”, cited to PIPL Article 6

The regulator's own named cases are the exact friction this page describes

Case 4: scanning to order at a tea shop prompted the user to register with a phone number, and kept prompting by pop-up after the consumer clearly refused, seriously disrupting use — found under Article 3(2) of the Methods for Identifying Unlawful Collection and Use of Personal Information by Apps. Case 6: a chain tea shop's scan-to-invoice service compelled a phone number and told refusing users to complete their information or get no invoice — found to be compelled provision of unnecessary personal information. Case 5 names 姓名、出生日期、性别 as fields unrelated to the function provided. If a code flow does this to you, the regulator has already written down that it is a violation.

Where in the source: Cases 4, 6 and 5, with the identification-method article each is decided under

The code in front of you may not be the ordering code at all

Guideline 1 requires the scan-to-consume QR code to be kept distinct from a membership-service QR code, with a conspicuous notice of what the code actually does; consumers may not be forced or induced into following the operator's official account, and any marketing push must offer an unsubscribe or refusal option. The regulator's cases behind it: a parking-payment code that was really the mall's official-account code, and a supermarket invoice flow that forced an account follow, decided under PIPL Articles 5 and 6. This is the sourced reason to read what a code says before scanning it.

Where in the source: Guideline 1 with Cases 1 and 2

A privacy notice has to appear before collection, must not be pre-ticked, and the account must be closable

Guideline 2: a scan-to-consume mini-program must show its privacy policy by pop-up or another conspicuous means before collecting personal information, and may not pre-tick consent or offer consent as the only option (cited to PIPL Article 17). Guideline 6: the operator must provide account deletion, without bundled deletion or unreasonable proof requirements (cited to Article 6(1) of the app identification methods). Guideline 5 points at the separate-consent requirement in PIPL Article 23. So the mini-program account a code makes you create is one you are entitled to read the terms of, and to close.

Where in the source: Guidelines 2, 5 and 6 with the articles the document cites for each