QR Code Tracking: How to Know Who Scanned

The QR code on the table tent at your favorite lunch spot gets scanned maybe forty times a week. Or four. Or zero. The restaurant has no idea, because the code points straight at a PDF menu and nobody's counting.

Same story with the poster in the elevator, the code on the trade show banner, the one printed on 50,000 product boxes. Companies spend real money getting QR codes in front of people, then skip the one step that would tell them whether it worked. In most setups we see, the print budget gets ten times the scrutiny of the tracking setup. Backwards.

The fix is not complicated. A QR code is a delivery mechanism for a URL, nothing more. Put a tracked short link inside it and every scan becomes a recorded click: when it happened, where, on what device. Print stops being a black hole and starts showing up in the same reports as your email and social campaigns. If you're new to how tracked links work in general, start with the complete link tracking guide and come back.

This page covers the QR-specific part. What scan data you actually get, what you don't, why a tracked code can be repointed after it's printed, and how to compare print against digital without fooling yourself.

A QR code is just a link you scan with a camera

Strip away the mystique. A QR code is a URL encoded as squares. Your phone's camera reads the squares, decodes the URL, opens it in a browser. That's the entire technology. There's no scan registry, no built-in analytics, no phone-home mechanism. The code is ink.

Which means everything depends on what URL you put in it.

Point the code straight at your homepage and you've printed a dumb link. Two problems, both permanent:

• You can't measure it. A scan looks identical to someone typing your address or clicking a bookmark. Homepage traffic goes up 3% in a month, and you'll never know whether that was the poster campaign or just a good newsletter. Direct traffic is where attribution goes to die.
• You can't change it either. The URL is baked into the pattern, so if the page moves, your only fix is a new code and a full reprint.

Now put a tracked short link inside the code instead. Same squares, same scan, except the phone hits your short link first, the short link records the visit, then a redirect forwards the person to the real destination. The whole hop takes tens of milliseconds and the person scanning never notices. If you want the mechanics of what happens in that moment, read how link redirects work.

That one hop through a server you control buys you both things the static code couldn't do. Every scan gets logged the instant it happens, because the request has to pass through the short link to get anywhere. And the destination lives in your dashboard, not in the ink, so you can repoint it whenever you want.

So never encode a final destination directly into a QR code. Create the tracked link first, encode that. It costs you thirty seconds at setup time. Skipping it costs you the entire campaign's data, forever, and there is no retrofitting it after the posters ship.

Scan data tells you plenty, but less than most vendors imply. That's next.

What scan tracking can and cannot tell you

Someone scans a code that carries a tracked link, and four things show up in your dashboard:

• When. Timestamp of every scan. Useful for spotting patterns you'd never guess at, like a table-tent code that spikes at lunch and dies by 2pm.
• How many. Total scans and unique visitors, so one enthusiast scanning five times doesn't look like five actual people.
• Where, roughly — country and city, derived from the IP address of the phone's connection. City-level, not street-level.
• What device. Phone model family, operating system, browser. Handy when you need to know whether your landing page has to work on a four-year-old Android, because in most print campaigns we see, it does.

That's the whole list. Now the part vendors mumble past.

You don't get the person. No name, no email, no phone number. A scan is anonymous until the visitor chooses to identify themselves on your page, by signing up or buying something. If a tool claims its QR codes tell you who scanned, either someone filled in a form downstream or the claim is nonsense.

You don't get exact location. IP geolocation says "Manchester", not "the poster outside the Deansgate station". If you need placement-level data, don't ask the analytics to do it. Print a different tracked link per placement. Ten posters, ten links, ten clean rows in your report. Takes five extra minutes and answers the question properly.

You don't get scans that never complete. Someone points a camera, sees the preview, and doesn't tap. That happens and no tool on earth counts it. You count visits, not glances.

Set expectations with your team accordingly. When a stakeholder asks "can we see who scanned the conference badge?", the honest answer is no. Give it early, because that beats promising a report you can't produce.

The upside of these limits is real, though. Because scan data is anonymous and aggregate, you're measuring a channel, not surveilling customers, and that's an easier conversation with your legal team and your audience alike.

So the data is coarse. It's also permanent, comparable, and yours, which brings us to the trick that makes printed codes genuinely safe to ship.

Print now, change later

The QR code on your poster doesn't contain your landing page. It contains a short link that redirects to your landing page. That gap between the two is the whole point.

Change the destination in your dashboard, and every printed code updates instantly. The 5,000 flyers already in circulation, the table tents at forty locations, the sticker on the back of the truck — all of them now send people somewhere new. Reprint nothing. Pay nothing. When we set up trackable QR codes, this is the feature teams don't appreciate until the first time they need it. Then they never shut up about it.

And you will need it.

Printed campaigns break in ways digital ones don't. Someone renames the landing page three months after the print run and the old URL dies. The promo ends, but the packaging sits on shelves for another year. Legal wants a disclaimer page in front of the offer, two weeks after the boxes shipped. Or the code was printed with a typo in the destination, which happens more than anyone admits.

With a static code pointing straight at a URL, every one of those is a reprint or a dead scan. With a redirect in the middle, it's a thirty-second edit.

This also changes how you plan campaigns. Point the code at a seasonal page in November, swap it to the evergreen version in January, same code. Run a menu QR that follows your menu page wherever the site team moves it. One printed asset, as many destinations as you need over its life.

Never print a QR code that encodes a raw destination URL. Always put the short link in the code, even when you're sure the destination will never change. You're never sure. Nobody who's shipped print twice is sure.

Comparing print to digital honestly

The point of putting a tracked link in a QR code isn't just counting scans. It's getting print into the same reports as everything else you run.

Do it with UTM parameters on the destination inside the short link. Set utm_medium=qr on every printed code, no exceptions. Then a source per placement and a campaign per push:

• utm_medium=qr, utm_source=menu, utm_campaign=spring-tasting
• utm_medium=qr, utm_source=packaging, utm_campaign=spring-tasting
• utm_medium=qr, utm_source=poster-station, utm_campaign=spring-tasting

Now the spring campaign shows up as one row in your analytics, split by where people scanned, sitting next to the email and paid rows. Filter by medium and you get every printed touchpoint in one view. Group by campaign and the poster budget competes directly with the newsletter for next quarter's money. That comparison is the entire payoff, and teams skip it constantly because "it's just a QR code."

Naming discipline matters more in print than anywhere else, and we've watched it go wrong repeatedly. A digital campaign with a botched UTM can be fixed the same afternoon. A printed one is out there for months, and if one designer typed QR, another typed qr-code, and a third typed qrcode, your medium report is now three rows pretending to be three channels. You can't fix the plates.

Agree on the exact strings before anything goes to the printer, write them down, and make everyone copy-paste instead of retyping. We keep a full scheme with a fixed vocabulary in our UTM naming conventions guide — steal it rather than inventing your own.

Do this and the old excuse dies. Print isn't "unmeasurable brand spend" anymore. It's a channel with numbers, and it either earns its budget in the same report as everything else or it doesn't.