QR Code Tracking: What Data You Can Actually Measure (And What You Can't)

What gets measured on scan

When a dynamic QR code is scanned, the following sequence runs:

1. The scanner reads the embedded short URL (e.g. qrt.ch/abc)
2. The phone calls this URL over the internet
3. The QRTool backend logs the call — anonymously
4. The backend responds with a 301 redirect to the configured target URL
5. The phone's browser opens the target URL

Step 3 is the actual tracking step. What's captured there is limited — and exactly this limitation is what makes nFADP-compliant marketing possible.

What data is captured

For every scan of a QRTool code, the following data points are anonymously recorded:

• Timestamp: date and time (second-precision)
• Approximate region: country and city (derived from IP range, no exact address)
• Device type: smartphone, tablet, or desktop
• Operating system: iOS, Android, Windows, macOS, Linux
• Browser: Chrome, Safari, Firefox, etc. (simplified, without version number)

What data is NOT captured

Equally important is what is not captured:

• No person identification: no name, no email, no customer ID
• No GPS position: only rough region from IP range, not the exact location
• No phone number: also no phone model as identifier
• No cross-tracking: scans on different codes by the same person are not connected
• No full IP address: the IP is hashed or discarded immediately after geolocation lookup

This is not coincidental — it's the direct implementation of nFADP principles of data minimization and purpose limitation.

Concrete metrics you receive

With a QRTool account, you see per QR code:

• Total scans since creation
• Daily trend as a line graph
• Geographic distribution as a heatmap at country/city level
• Device types as percentage breakdown
• Top scan times (hours, weekdays)
• Trends vs. previous week

For marketing analytics, these data are usually fully sufficient. They show whether the campaign works — even if you don't know who scanned individually.

What you can measure about the target URL

So far it's only about the scan itself. Once the user lands on the target webpage, your own tracking system takes over. If you have Google Analytics, Plausible, or Microsoft Clarity installed there, you see:

• Which page was visited
• How long the user stayed
• What actions they took (click, order, unsubscribe)
• Conversion rate from scan to desired action

Important: you collect these data yourself on your website — the QR code provider doesn't see them. That gives you full control and transparency.

Tips for useful analytics

1. Use UTM parameters in the target URL

That way you track in your web analytics tool which QR code campaign brought the traffic:

https://qrtool.ch/?utm_source=qr&utm_medium=poster&utm_campaign=cityfest2026

2. Use different QR codes per touchpoint

If you print a poster and a flyer with the same code, you can't distinguish later where the scan came from. Better two separate codes — one per touchpoint.

3. Define a target conversion

What should the user do after the scan? Newsletter signup? Reservation? Purchase? That conversion is measured by your web analytics tool, not the QR code. But it's the real success metric.

4. Don't compare absolute scan counts

500 scans on a flyer with 5,000 prints = 10% scan rate. 500 scans on a poster in the station with 50,000 contacts = 1% scan rate. Absolute numbers say little — the ratio to reach is decisive.

Frequently asked questions

Do I see which person scanned?

No. There are no personal data in the scan statistics. You see the aggregation of all scans, not individual people.

What if the same person scans multiple times?

Multiple scans are counted as separate scans. There's no cookie detection or cross-device tracking.

How long is scan data stored?

QRTool stores anonymized scan data as long as the subscription is active. On cancellation, data is deleted within 30 days.

Do I need a cookie banner for scan tracking?

No, as long as no personal data is captured. Anonymous scan tracking without IP storage and without cookies is allowed under nFADP without explicit consent — on the target website, the usual cookie rules of your own analytics tool apply.

Can I export the scan data?

Yes — all scan data can be exported as CSV for your own analytics in Excel or Power BI.

Verdict

QR code tracking provides exactly the data you need for serious campaign analytics: when was it scanned, where roughly, with what, how often. What you don't get — and shouldn't get — is personal data. Anyone who understands this can honestly measure with dynamic QR codes without compromising customer privacy.