That kind of thing is for someone with governing experience to solve. I suppose revoking them every now and then would be good, and maybe for ease of minting new unique codes they could loosely be tied to location. I'm not too worried about that, as your IP could be used in a similar way and the services shouldn't be reading the codes themselves regularly anyway