Can you track who scans a QR code?

Can you track who scans a QR code?

No. You cannot identify the person who scans a QR code. A scan is an anonymous web request: it tells you that someone scanned, roughly where in the world they were, what kind of phone they held and when — never their name, number or email. Anything more than that came from a form they filled in afterwards, not from the code.

This is worth stating plainly because the phrasing on a lot of QR marketing pages is carefully ambiguous about it. “Know your audience.” “See who is scanning.” The technology under all of them is the same, and it does not know who anyone is.

What a scan does tell you

Every one of these is real, useful, and available from a dynamic code:

• How many scans, and when — by hour, which is usually the surprise.
• Country, and coarse region. County or state level. Not a street.
• Device and platform. Whether it was a phone, and whether the camera was Android or iOS. That split decides how you design a landing page more than any other single fact.
• Where a click came from, when it came from a link rather than a print — the referring site, hostname only.
• Scan versus tap. A camera scan of printed material is a different act from a tap on a link in a message, and the two should never sit in one number.
• Whether it was a person at all. See the bots below.

What it cannot tell you, whatever the tool claims

• Who. No name, no number, no email, no account.
• Where exactly. Location comes from network geography, not GPS. It is right about the country and often wrong about the town.
• Repeat visitors over months. See below — this is the one most tools quietly get wrong.
• What they did next, unless your own site’s analytics picks them up after the redirect.

A fifth of your scans are not people

Chat applications fetch every link that gets pasted into them, to build the little preview card. WhatsApp, Slack, iMessage, Telegram, X and search crawlers all do it, usually within a second and always before a human clicks. Counted as scans, these inflate a total by three to five times, and they arrive in a burst that looks exactly like a successful campaign.

The fix is not clever, it is just work: classify the request by its user agent and record it as a bot rather than a person. Klip separates them by default and never folds them into the click total, because a number that is five times too big does not make the campaign look good — it makes the next decision wrong.

Why “unique visitors” on a QR code is usually fiction

To tell one scanner from two you need something stable about the device, and the obvious candidate is the IP address. Storing one is storing personal data, in Kenya under the Data Protection Act and in Europe under the GDPR, so most tools hash it — and then keep using the same hash for months, which means they have built a persistent identifier and called it anonymous.

Klip hashes the address with a secret that is replaced every day and never written down. Two consequences follow. The same person scanning on Monday and Thursday produces two unrelated values, so we cannot follow anyone across time even if we wanted to. And what we report is therefore same-day repeat scans, which is a true statement, rather than “unique visitors”, which would not be.

There is a second honesty problem underneath this one. Analytics systems sample under load, and while a total can be corrected for sampling, a count of distinct things cannot. When our window has been sampled we return no distinct number at all instead of a corrected guess. A wrong number that looks plausible is worse than a gap.

How to track QR code scans, in practice

1. Use a dynamic code. The code points at a short link you own, and the short link redirects. That hop is where counting happens. Astatic code cannot be tracked at all, because nothing you control is ever touched.
2. Give each placement its own code. One for the poster, one for the table tent, one for the flyer. One code across five placements answers no question you actually have.
3. Add UTM parameters to the destination so the same visit is attributable inside Google Analytics, and the print channel stops arriving as “direct”.
4. Mark the scan itself. Klip appends ?s=q to the payload it encodes, which is how scan and tap stay separable rather than being guessed at from the user agent.
5. Read hour-of-day before anything else. It is the cut that most often changes what a business does next, and almost nobody looks at it.

Where the legal line sits

Counting scans in aggregate is ordinary analytics. It becomes a compliance question the moment something stored can be tied back to a person — an IP address usually can be, which is why the safest architecture is one that never keeps it. A redirect sets no cookie, so the scan itself raises no consent banner; what you do on the landing page afterwards is a separate question with its own answer.

If you are choosing a provider, the question worth asking is not “what can you track” but “what do you store, and for how long”. Ours is written down in theprivacy policy, including the two things we cannot do and why.