# Dynamic QR codes and privacy: what every scan reveals

> Every scan of a dynamic QR code passes through the provider's redirect server, which can log the scanner's IP address, device type, timestamp and approximate location. A static code pointing directly at your site involves no intermediary. Dynamic codes are still right when you need editability or analytics: choose the provider deliberately.

Source: https://useqr.app/docs/security/dynamic-qr-codes-and-privacy · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Where the data comes from

A dynamic QR code does not encode your destination. It encodes a short redirect URL on the
provider's domain; the provider's server receives every scan as an HTTP request, looks up
the current destination, and forwards the visitor. That indirection is the whole product.
It is what makes [editing after print](/docs/basics/static-vs-dynamic-qr-codes) and scan
counting possible. It is also what makes every scan visible to a third party, and it adds a
network round trip (typically **100–300 ms**), before your page even starts loading.

## What the provider can log on every scan

| Field | Source | What it reveals |
|---|---|---|
| IP address | the request itself | approximate location, usually to city level, and the network operator |
| User agent | request header | device class, operating system and version |
| Timestamp | server clock | when, and, across scans, patterns of when and how often |
| Accept-Language | request header | the scanner's preferred language |
| Code identifier | the URL | which printed placement was scanned |

The scanner sees none of this happen. There is no banner, no permission prompt, the
redirect completes before the destination page, with its own cookie notices, ever loads.
A fuller breakdown is in [what is actually logged](/docs/security/qr-codes-and-tracking-what-is-logged).

## The retention and resale question

What is collected is usually documented. How long it is kept, and whether it is shared or
sold, often is not. Scan analytics are an asset (for a free dynamic tier they may be the
business model), and from outside you cannot audit retention, aggregation or onward
transfer. You are also exposed to the provider's lifespan: if it folds, your codes die with
it, a failure mode covered in
[what happens when a QR service shuts down](/vs/what-happens-when-a-qr-service-shuts-down).

## When dynamic is still the right choice

Honest answer: sometimes it is. If you need to change a destination after printing 50,000
boxes, or compare scan counts across 40 store locations, a redirect layer is the correct
tool, and [whether you need one at all](/vs/should-you-use-a-dynamic-qr-code) is worth ten
minutes of thought before you commit. UseQR does not offer dynamic codes; the honest
comparison of platforms that do is at
[best dynamic QR platforms](/vs/best-dynamic-qr-code-platforms).

## Choosing a provider deliberately

If you go dynamic, the privacy questions to ask before the first print run:

- Is there a **data processing agreement** you can sign?
- Is there a **stated retention period** for scan logs, with deletion on request?
- **Where is it hosted?** EU hosting simplifies GDPR analysis considerably: see
  [QR codes and GDPR](/docs/security/qr-codes-and-gdpr).
- Can you **export your data** and codes?
- Can you use a **custom domain you own**, so a future migration does not kill every
  printed code?

## The zero-intermediary option

A static code pointing straight at your own domain involves nobody else. The only server
that sees the visit is yours, under your own privacy policy, with your own retention rules.
You can still measure: add campaign parameters to the URL and read them in analytics you
already run, as described in [how to track QR scans](/docs/how-to/how-to-track-qr-code-scans).
You give up post-print editing; you gain a code whose privacy properties you fully control
and that can never be shut off by a third party.

## FAQ

### Do QR codes track you?

The code itself cannot: it is printed text. Tracking happens when the code points at a
redirect server that logs each request. A static code pointing directly at a destination
involves no intermediary, so only the destination site sees the visit.

### Can a dynamic QR code see my exact location?

No. The provider sees your IP address, which typically resolves to a city or region, not a
street address. Precise GPS location would require the destination page to ask for
permission, which you can decline.

### Is scanning a dynamic QR code anonymous?

Not fully. The provider records your IP address, device details and the time of the scan
before redirecting you. Whether that is ever linked to you depends on the provider's
retention and sharing practices, which you usually cannot verify.

### What data do dynamic QR providers collect?

Typically the IP address, user agent (device and OS), timestamp, language headers and which
code was scanned. Some derive city-level location and device statistics from these and
present them as an analytics dashboard.

## Try it

- https://useqr.app/url
- https://useqr.app/scan
- https://useqr.app/validate