QR Code Privacy: What Scan Data Shows and Hides

A QR code is a printed link, not a sensor

The square on your flyer does not watch anyone. It stores a short piece of text, almost always a web address. The camera reads the pattern, the phone opens the address, and that is the whole transaction. Everything a code owner can ever learn comes from that single web request, not from the paper and not from the phone.

This matters because the two most common beliefs about QR codes are both wrong. Customers often assume scanning hands over their identity. Owners often assume the code itself is counting people. Neither is true, and the gap between those two assumptions produces bad campaign decisions and awkward conversations at the counter.

What you can actually see

If your code points at a redirect service, which is what a dynamic code is, the service records each hop before forwarding the phone to the destination. A typical scan record holds:

Date and time, down to the second. The most reliable field you get, and usually the most useful one.
Approximate location, derived from the IP address. Normally city or region level, sometimes only the country.
Device and operating system: iOS or Android, the browser, occasionally a model family.
Phone language setting, a rough proxy for visitor origin in tourist areas.
Which code was scanned, but only if you generated a separate code per poster, table or box.
A weak new-versus-returning flag, based on a cookie that clears constantly.

That is the full list. Aggregated, it is genuinely useful. You can show that the 8 cm decal at eye level on the window, readable from a metre away, pulls nine times the scans of the A5 flyer inside. You can see that 40 percent of scans land between 18:00 and 20:00 and move your staffing. You can watch the codes in the guest rooms go quiet the week the coach tours stop.

What you cannot see, on any plan

Names, emails, phone numbers. Not unless the person types them into a form on the page you sent them to.
Exact position. IP geolocation on mobile networks routinely places a scanner in whatever city the carrier gateway sits in, which can be 200 km off. Treat city-level data as a hint, never as evidence of where someone stood.
Photos, contacts, messages. The camera decodes a printed pattern. It does not open a channel back to you.
Who someone is across visits. One person scanning your poster on Tuesday and again on Friday will usually appear as two separate visitors.
Whether a scan became a sale, unless you build that link yourself with a coupon code, a dedicated landing page or checkout tracking.
Anything at all from a static code that points straight at a page you do not control. A static code opening a Google Maps listing gives you nothing, ever.

That last point is the honest trade-off. Static codes are free and permanent, and they are also silent and unchangeable. Once 5,000 menus are printed, that URL is the URL forever; a wrong link means a reprint. Dynamic codes fix both problems, editable destination plus a scan log, but only while the plan behind them is active. If the subscription lapses, the redirect stops resolving and the printed square becomes dead ink. Price that risk into any print run you expect to outlive the campaign, such as codes on shipping labels that keep arriving in customer hands months later.

The real leak is what you put inside the code

Scan analytics are dull compared with the information owners encode voluntarily. A QR code can carry plain text, and plain text printed in a scannable square is public for the life of the paper.

vCard codes on printed CVs. These routinely embed a home address and a personal mobile number. Every recruiter, every desk it sits on, every phone photo of that page carries it. A code that opens a profile page you control is safer and lets you change the number later; see QR codes for resumes.
Wi-Fi codes. The password is stored as readable text. Fine for a guest network, wrong for the network your till runs on.
Prefilled email or SMS codes. These expose an inbox or number to anyone who photographs codes in public and decodes them in bulk.
Campaign parameters with internal names. A tag like utm_campaign=cheap-list-q3 appears in the visitor address bar. Name campaigns as if a customer will read them, because one will.

Where scanners deserve a heads-up

Nobody expects a privacy notice on a table tent. Context raises the bar, though. Anything touching money, health or membership should be transparent before the scan, not after.

Two habits cover most of it. First, print the destination domain in readable text beside the code, around 8 to 10 pt, something like Scan to give at example.org. An anonymous shortlink on a collection tin is exactly what a scam looks like, and careful people simply will not scan it. This is the single biggest conversion factor on donation codes. Second, make the landing page identify you within the first screen: organisation name, what happens next, and a link to your privacy policy if you collect anything.

If your page sets analytics cookies or a pixel, the usual consent rules apply exactly as they do for a visitor who typed the address. The QR code changes nothing legally. It is just a different way of arriving.

Checklist before you send artwork to print

Decode your own code with two phones and read the full destination. Confirm it is the address you meant, with no stray test parameter.
Check nothing personal is encoded directly: no home address, no private mobile, no operational password.
Give each placement its own code. One code for the window, one for the receipt, one for the flyer. Without that, your scan data is a single meaningless number.
Print the readable domain next to the square.
Decide who owns the account and who renews it. Codes outlive the person who made them.
Keep a one-page record: code name, destination, print date, where it lives.

Reading the numbers without fooling yourself

Scans are not people. A slow-loading page gets rescanned. Curious passers-by scan and bounce in two seconds. Staff test their own codes. So compare codes against each other rather than trusting any absolute figure, and always look at what happened after the scan, not just the count. A hundred scans with a four-second average on the page means the placement works and the page does not.

The same applies to a hub page holding several destinations, like a one-link profile. You will see which link people tapped, which is far more honest than raw scans, and still nothing about who tapped it.

Make yours

For a permanent link that never needs changing and that you do not need to measure, the free generator on the homepage makes a static code in a few seconds, with no account. When you need to edit the destination after printing, split codes by placement, or see when and where scans happen, dynamic codes are on the pricing page. Either way, the code itself tells you nothing about the person holding the phone.