Basics
How to track QR code scans
Knowing whether a printed code gets scanned turns a guess into a decision. Here are the two ways to measure scans, what the numbers mean and what they cannot tell you.
Updated · 6 min read
To track QR code scans, you need something that records each scan, because a standard static code sends phones straight to the destination and nothing in between counts them. There are two practical options: add UTM parameters to the link so your web analytics can identify visits from the code, or use a dynamic QR code, which passes every scan through a redirect that logs the time, approximate location and device.
Why can't a static QR code track scans?
Because nothing sits between the code and the destination to record the scan. A static QR code is data in a printed pattern. When a phone scans it, the phone reads the web address and opens it directly, and nobody is told the scan happened. The code has no memory and no connection.
That is also why static codes never expire and have no scan limit. The property that makes them durable makes them invisible to measurement. Anything you learn about a static code has to come from the place it sends people.
So there are two places to measure: at the destination, once the visitor arrives, or in the middle, with a redirect that sees every scan.
Option 1: UTM parameters and web analytics
UTM parameters are tags added to the end of a web address. Analytics tools, including Google Analytics, read them and group visits under the source, medium and campaign you choose. A tagged link for a flyer might look like this: https://example.com/offer?utm_source=flyer&utm_medium=qr&utm_campaign=spring-sale
- utm_source: where the visit came from, such as flyer, poster or packaging.
- utm_medium: the channel, such as qr or print.
- utm_campaign: the campaign name, such as spring-sale.
- utm_content: optional, to tell placements or versions apart, such as window or counter.
- utm_term: optional, and mainly used for paid search keywords.
The limits of UTM tracking
This approach is free and works with a static code. It has real limits, though:
- It only works on your own website. The destination must have your analytics installed. It cannot measure scans that lead to a social profile, an app store or a file hosted elsewhere.
- It counts visits, not scans. If a visitor declines analytics cookies, uses a blocker or leaves before the page loads, the visit may not be recorded.
- It makes the code denser. A longer link means more modules and smaller ones at the same size. Keep tags short. The print size guide explains why this matters.
- It is fixed. If you mistype a tag, every printed code carries the mistake.
Use lower case and keep naming consistent, because analytics tools treat Flyer and flyer as two different sources. Build the tagged link, open it in a browser to check it works, then paste it into the URL QR code generator.
Option 2: dynamic QR codes with scan analytics
A dynamic QR code encodes a short link run by a QR service. Each scan reaches the service first, which records it and then forwards the phone to your destination. Because the measurement happens in the redirect, it counts scans whatever the destination is: your website, a menu PDF, a booking page or a social profile.
Dynamic codes bring other benefits to a campaign. You can change the destination after printing, and the short link keeps the printed pattern simple. The trade-off is that the code depends on the provider keeping the redirect running, so check what happens to your codes if you stop paying. Our guide to static vs dynamic QR codes covers the difference in detail.
EndureQR's paid plans include dynamic codes with scan analytics by device, city and time of day. If you cancel, the codes keep redirecting to the last destination you set, so printed material never goes dead. Pro is $3.99 a month or $29 a year, and Lifetime is $79 once. See pricing for details.
You can also combine both methods. Point a dynamic code at a UTM-tagged address. The dynamic code counts every scan, the UTM tags show what visitors did on your site, and the printed pattern stays simple because it only holds the short link.
What can QR code scan analytics tell you?
Scan analytics show how many scans a code gets, when, roughly where and on what kind of device, but not who scanned it.
| Data point | Available? | Where it comes from |
|---|---|---|
| Number of scans | Yes | Each request to the redirect is logged |
| Date and time | Yes | Recorded when the scan reaches the server |
| Approximate city or region | Yes, roughly | Estimated from the connection's IP address |
| Device type and operating system | Yes | Read from the browser's user agent |
| Name, email or phone number | No | A phone does not send these when it scans |
| Exact location | No | Not available from a scan alone |
Location is the figure people misread most often. It is based on the IP address of the phone's connection, and mobile networks often route traffic through a hub in another town. VPNs and privacy relay services move it further still. Treat city data as a pattern across many scans, not a fact about any one person.
Scan counts need context too. Your own test scans are counted. One person may scan twice. A unique scan figure, where a service offers one, is an estimate. And a scan is not a sale. It shows interest, not what happened next, which is where UTM tags and your web analytics fill the gap.
To compare placements, give each one its own code. A poster, a flyer and a receipt sharing one code produce one combined total. Separate codes, or separate utm_content values, show which placement earns its space.
Privacy considerations
Scan analytics does not reveal who someone is, but it can still involve personal data. IP addresses can count as personal data under laws such as the UK and EU GDPR. Treat scan data with the same care as the rest of your analytics.
- Say what you collect. Mention QR code analytics in your privacy notice if you use it.
- Respect consent rules. Analytics cookies on your own website usually need consent in the UK and EU, so UTM-based tracking depends on your cookie banner.
- Do not try to identify people. Combining scan data with other records to single out individuals goes beyond what visitors expect.
- Collect what you will use. Counts by day, city and device are enough for most campaigns.
- Choose your provider with care. Check where scan data is stored and how long it is kept.
Which method should you use?
- A static code with UTM tags if the destination is your own website, the link will not change and visit numbers are enough. It costs nothing.
- A dynamic code if the destination is not your own site, if it might change, or if you want scan counts by time, city and device.
- A dynamic code pointing to a UTM-tagged link for campaigns where you want to follow the whole path from scan to sale.