The Spanish government continues to stumble over QR codes

BarcelonaTwo new official requirements scheduled for January 1, 2026, have generated controversy: Verifactu, the Tax Agency's verifiable invoicing protocol that generates QR codes, and the connected V16 beacons that the DGT (Spanish Directorate General of Traffic) wants to impose on drivers. Despite being technically very different, they have in common that they have reignited citizens' suspicions about a supposed desire by governments to monitor the actions and movements of the population.

Verifactu has been formally postponed until 2027, while the V16 beacons maintain their implementation date but with the promise of "flexibility" in fines during the first few months. This distrust is not unfounded: the Spanish administration has been failing for years with any digital initiative, from mobile applications to tracking systems.

Verifactu: the code that cannot be erased

Verifactu was created to eradicate double-entry accounting software that allows some business owners to maintain a digital slush fund at the touch of a button. The idea is inspired by the philosophy of the blog chain (blockchain): the chaining of records.

When a plumber or a shop issues an invoice, the software will generate a unique digital fingerprint (onehash) which contains information from the previous invoice. If the business owner tries to delete invoice number 10, the chain will break at number 11, and the Tax Agency will automatically receive an alert. Goodbye to relative accounting.

The visible new feature is a QR code that must be printed on every cash register receipt. The Tax Agency's fantasy is to turn every citizen into a tax inspector: by scanning the QR code with your mobile phone, you can check if the bar has declared that amount. A kind of gamification of tax inspection.

Businesses and the self-employed can choose between two options. With the first, the free software Verifactu sends the data instantly to the Tax Agency. The second keeps everything on-premises but requires an electronic signature. Some sources estimate that a typical SME will have to invest between €1,000 and €6,000 to adapt to it.

But this revolution will have to wait. Faced with the risk of technical collapse and pressure from employers' associations like PIMEC, the mandatory implementation has been postponed until January 2027 for companies and July for the self-employed. It turns out that adapting millions of POS terminals and management software was more complex than publishing it in the Official State Gazette (BOE), and only 8% had implemented the system by the end of November. Half of Catalan business owners didn't even know when it would come into effect. Pedro Sánchez openly admitted it: Juntos por el Cambio had demanded the postponement in exchange for their parliamentary support.

The pattern of failed government QR codes

The Spanish government has a knack for failing with anything involving QR codes and mobile apps. RadarCOVID, the pandemic contact tracing app, achieved a penetration rate of only 13-17% in Spain, compared to 38% in Ireland. Only 2% of infections were reported through the app, even though the protocol created jointly by Google and Apple guaranteed anonymity. Nearly four million euros were wasted. The failure wasn't technological, but organizational: overwhelmed doctors couldn't provide the necessary codes to activate notifications. More recently, the mobile ID app MiDNI had a promising start with 400,000 downloads in 24 hours, but actual adoption is minimal. The app allows users to display only their photo and age without revealing their address, but what good is it if nobody accepts it? In an informal poll among my followers on X, only 13% had installed it, and none of them—not even me—had had the chance to use it in real-world situations.

The million-dollar orange lamp business

While the Treasury keeps an eye on the coffers, the DGT (Spanish Directorate General of Traffic) is keeping an eye on the roads. The connected V16 beacon will replace emergency triangles with an unassailable argument: getting out of the car to place the triangles is extremely dangerous. The appeal of the new device isn't that it emits light, but that it's connected. The new beacons have an integrated eSIM card that connects to Vodafone or Telefónica's narrowband NB-IoT 4G/5G networks or MasOrange's LTE-M networks. When the device is turned on, it sends the vehicle's GPS coordinates to the DGT's 3.0 cloud every 100 seconds to warn other drivers. The suspicious aspect is the business model: 30 million vehicles required to purchase a device costing around 50 euros represent 1.5 billion euros, of which the State keeps 300 million in VAT. On the other hand, this new market is an unexpected goldmine for telephone operators, who will be inundated with millions of 12-year contracts. In fact, thanks to the V16, Telefónica has begun to threaten Vodafone's comfortable lead in the Spanish connected device market. Furthermore, the beacon's usefulness is relative: it alerts the DGT (Spanish Directorate General of Traffic), but it doesn't call emergency services, your insurance company, or a tow truck. As Pere Navarro, Director General of Traffic, admits, "you still have to call your phone company." As an interesting side note, the pioneering company in the sector was founded by two former Civil Guard officers who now manufacture 18,000 beacons a day in Zaragoza. The icing on the cake is the apparent fragility of the whole system. It's not just that we'll have to remember to change the battery in our beacon: the websiteBroadbandhas revealed that data from connected V16s is transmitted to an internet domain,comobility30.eswhich belongs neither to the DGT (Spanish Directorate General of Traffic) nor the Ministry of the Interior, but to an unknown private individual. Road safety depends on someone's credit card not expiring so they can renew their vehicle registration.

The irony of data disclosure

Like most states, Spain is scrambling to deploy control networks—fiscal with Verifactu, physical with V16s—but ends up shooting itself in the foot: rushed deployments that require postponement, domains registered by private individuals, batteries that will degrade, systems that don't alert tow trucks. Of course, we must also highlight the hypocrisy of citizens, who are outraged by these state initiatives, yet do so from a phone on which, blithely and without reading any terms of service, they freely give away their minute-by-minute location, their purchase history, their bank transactions, and even their heart rate to Google. The data transmitted by a V16 is anonymous: coordinates and battery level. No link to license plate or driver. In contrast, this entertaining free game accesses permanent location, address book, and contacts. Google and Meta know our movements, purchases, and political opinions with an accuracy that would be the envy of any totalitarian state. But since they give us cat memes and TikToks that are so funny, we find it acceptable.

Digital giants suck up, process, and monetize infinitely more personal data than the Tax Agency or the DGT (Spanish Traffic Authority) could ever dream of. The difference is efficiency. We know Google has us all on file. On the other hand, seeing the delay of Verifactu and the private domain of the beacons, we are left with an ironic consolation: even if the State wants to monitor us, it is very likely that the day it tries, its server will crash or its digital certificate will expire. The digital incompetence of the administration is, for now, the best guarantee of our privacy.