Why tracking needs a redirect
A QR code is printed data, so it cannot report when it is scanned. Tracking happens when the phone opens a link that passes through a server that records the visit. That is why analytics are available for dynamic QR codes, which route every scan through a redirect, or for static codes whose link includes UTM parameters read by the website’s own analytics.
What is usually counted
A redirect server sees the request the phone makes when it opens the link. From that it can record when the scan happened and derive a few details from the request headers and IP address. Location from an IP address is approximate, often accurate to a city or region at best, and can be wrong for mobile networks and VPNs.
- Total scans and scans over time
- Unique scanners, estimated rather than exact
- Approximate location from the IP address
- Device type, operating system and browser
- Which printed code or campaign the scan came from
Privacy considerations
Scan data can include personal data such as IP addresses, which privacy laws like the GDPR may cover. Collecting only what is needed, keeping it for a limited time and explaining it in a privacy notice are sensible defaults. Counts are also estimates: bots, link previews and security scanners can create scans that no person made.