Can You Track Who Scanned a QR Code?

A dynamic redirect can record the time of a request, technical device information, referrer where available and an approximate network-based location. Platforms may group repeated activity into visitors or sessions.

The exact fields depend on the service, privacy settings and browser. Treat technical data as an estimate rather than a complete customer profile.

Not from the scan alone. QR technology decodes information; it does not transmit the person’s contact record to the destination.

A name becomes available only when the visitor provides it, signs into a known account, uses a personalised link or enters an identified workflow.

No ordinary web redirect receives the scanner’s phone number. A WhatsApp link can start a conversation in which the user’s WhatsApp identity becomes visible according to that service’s behaviour, but that happens after the user chooses to proceed.

Do not claim that a QR silently captures a phone number. That would be misleading and may create privacy concerns.

Usually not. IP-based location is approximate and may indicate a city or region rather than the physical scan point. Mobile networks, VPNs and privacy relays can reduce accuracy.

Exact device location generally requires browser permission. A responsible campaign should request it only when necessary and explain why.

One person may scan multiple times. A scanner app may retry. A user may open the same code from different devices. Therefore, total scans are an activity count, not a customer count.

Unique-visitor estimates reduce duplication but are still imperfect because privacy controls and network changes affect identification.

A static code has no built-in event system. It can point to a webpage that uses analytics, so visits after page load may be measured. However, that does not record the redirect event and may miss failed loads or destinations without analytics.

A dynamic code records the redirect before sending the visitor onward, making placement-level measurement easier.

Connect the scan to a voluntary next step. Use a form, booking, coupon claim, referral code, logged-in page or conversation. State what data is collected and use it for the described purpose.

For personalised campaigns, create individual links only when recipients expect that level of measurement.

Start with unique visitors, repeat activity, placement, time trend and destination action. Device and broad location are supporting context.

The most useful question is not “Who was this anonymous scanner?” It is “Which placement attracted the right action, and what can we improve?”

Provide a privacy notice on the destination, minimise retained data and avoid presenting approximate signals as personal facts. If the campaign collects sensitive or regulated information, obtain appropriate legal guidance.

Analytics should make campaigns more understandable without turning a simple scan into unexpected surveillance.

You can track scan behaviour, not automatically identify the human. Identity appears only through a clear subsequent interaction. Design the measurement around useful actions and consent rather than trying to extract more personal data from the scan itself.