Tracking QR code scans: what the analytics actually tell you

What a scan event actually contains

When a dynamic code is scanned, the phone requests your short link before being redirected. That request is what gets recorded, and it carries a predictable set of information: a timestamp, the device type, the operating system and browser, the country and often the city derived from the IP address, and a referrer when the scan arrived via a link rather than a camera.

It does not carry an identity. There is no name, no email, no account — just the shape of a request. Responsible implementations hash the IP address rather than storing it, which satisfies privacy obligations under GDPR-style regimes and costs you nothing analytically, because a raw IP tells you nothing you can act on that the derived city does not.

This is also the boundary of what any QR provider can honestly offer. Any product claiming to identify individual scanners from the code alone is either using a separate tracking mechanism on the destination page or overselling.

• Timestamp — the backbone of every time-series chart.
• Device, OS and browser — from the user agent string.
• Approximate location — derived from IP, accurate to city at best.
• Referrer — present when the short link was clicked rather than scanned.
• Code identity — which specific placement was used, if you set up one code per placement.

Three ways scan data misleads people

First, scans are not people. A curious guest scanning a poster twice produces two scans. Someone showing a colleague produces a third. Without a session identifier on the destination page you cannot deduplicate, so any statement of the form 'we reached 4,000 people' is unsupportable.

Second, bots inflate totals. When a short link is shared in a messaging app, the app fetches it to build a preview card, and that fetch looks a lot like a scan. Security scanners and crawlers do the same. Filtering obvious bot user agents removes most of it; the residue is another reason to prefer relative comparisons.

Third, absence of scans is ambiguous. Zero scans on a poster could mean nobody saw it, nobody understood it, the code was too small for the viewing distance, or the placement was blocked by a display unit two days after installation. Scan data tells you that something did not work, never why — the diagnosis requires going and looking.

The four breakdowns worth reporting

Most dashboards drown clients in charts. Four views answer nearly every question a marketing manager actually asks, and everything else is decoration.

• Scans over time — did the campaign peak on launch day and collapse, or build steadily? A single spike usually means PR or staff enthusiasm rather than sustained placement value.
• Device and OS split — a heavy iOS skew changes whether Apple Wallet passes, Apple Pay and iOS-specific deep links are worth building.
• Geography — proves whether physical distribution reached the cities and neighbourhoods that were paid for, and often exposes a logistics failure nobody would otherwise have found.
• Per-code comparison — the only honest way to test creative, placement, wording or offer, because everything else in the environment is held roughly constant.

Setting up so the data is worth reading

Almost all analytical value comes from decisions made before printing. Create one dynamic code per placement, not per campaign, and name them descriptively — 'Poster, Camden station, north exit' beats 'QR 14'. Group codes by campaign so you can still see a total when you need one.

Add UTM parameters to the destination behind the code, not to the encoded URL itself. Keeping the encoded link short preserves a low-density pattern that prints reliably, while the redirect can append whatever tracking parameters your web analytics expects. This is one of the underrated advantages of dynamic codes: the tracking complexity lives on the server, not in the ink.

Finally, decide the reporting period before the campaign starts. Print has a long tail — codes on packaging keep producing scans for months — so a report cut at two weeks systematically undervalues the channel.

Closing the loop: from scans to conversions

Scan-to-conversion is the number that ends arguments. Send each code to a destination you can measure — a booking page, a product page, a form — and compare the scans against the completed action. That ratio, tracked per placement, turns a printed asset into a channel with a cost per acquisition you can compare against paid media.

A code with 4,000 scans and no conversions is not a failure of the code; it is proof that the placement earns attention and the offer behind it does not. That is a far more actionable finding than a headline scan count, and it is the kind of insight that keeps a client commissioning print.