How QR Code Analytics Actually Work

The mechanic behind QR analytics

When someone scans a dynamic QR, their phone hits a short link on the QR service's server. The server logs the request, then issues an HTTP redirect to your destination. The scanner never notices — the whole redirect happens in under 100ms.

Because it's a server-side log, no JavaScript, cookies, or tracking pixels are needed. The scanner's browser never even loads a page on the QR service's domain — it just gets a 302 redirect.

What data is captured

That's genuinely the whole list. There's no way to link two scans of the same code to the same person, no way to see the scanner's identity, and no persistent tracking across QRs.

• •Timestamp (server clock, second-precision)
• •IP address (used to look up geo, then usually hashed or discarded)
• •Country, region, and city (from IP geolocation)
• •User agent string (parsed into device family, OS, and browser)
• •Referrer (usually empty for camera scans)

What you can't get (and why that's fine)

This is a feature. It means QR analytics are GDPR-friendly out of the box, don't require cookie banners, and aren't building a surveillance profile of your customers.

• •Names, emails, or phone numbers — the QR service has no way to see these.
• •Cross-QR identity — a person who scans two different QRs looks like two anonymous scanners.
• •Return visits — no cookies means no way to know a scanner came back.
• •Post-scan behavior — once the redirect happens, tracking hands off to your destination site's analytics (GA, Plausible, etc).

How to make analytics useful

Raw scan counts are the least interesting metric. What matters is comparison across time, placements, and campaigns.

Use different QRs per placement: one per flyer version, one per event booth, one per real-estate sign. Then compare their scan curves. The QR that outperformed isn't just 'a good QR' — it's the flyer, event, or listing that actually worked.

Metrics worth watching

• •Scan count over time — sudden drops often mean the QR got damaged or the campaign ended.
• •Geo distribution — matches your expected market? Wildly off-geo scans (a QR for a local business getting scans from another country) often mean bots or QR indexers.
• •Device breakdown — heavy iOS skew means iPhone users, heavy Android often means younger or lower-income demographics.
• •Time-of-day patterns — restaurant menus peak at meal times, retail QRs peak evenings/weekends, B2B QRs peak Tuesday–Thursday business hours.

Analytics + funnel = attribution

The most valuable move: pair scan analytics with a lightweight landing page. Every scan hits the same landing page, and the landing page tracks its own conversions (sign-ups, form submits, purchases). Now you have full-funnel data — scans, then conversions.

For maximum attribution, use UTM parameters on the destination URL. Each QR redirects to your site with a unique campaign tag, so Google Analytics or your CRM shows which QR drove which conversion.