QR codes and tracking: what is actually logged

The code itself tracks nothing

A QR code is printed text. It has no sensor, no beacon, no way to phone home, the pattern on the poster cannot know it was scanned. All tracking happens after the decode, on the network path the payload sends you down. Which means the honest answer to "do QR codes track you?" is: it depends entirely on what is encoded, and you can read that yourself before opening: our scanner shows a code's raw contents in your browser without following them.

There are two separate moments where data can be collected: when the code is created, and each time it is scanned. They involve different parties.

At creation: what the generator sees

A server-side generator receives your payload in order to render it (URLs, WiFi passwords, contact cards and payment identifiers included), and whether that is logged is a policy you cannot audit. Client-side generation is the structural fix: UseQR encodes in your browser, no payload ever reaches a server, and so there is nothing to log. What each class of provider can observe has its own page.

At scan: who sees what, by architecture

Architecture	Example payload	Who learns of the scan	What they can log
Static, direct	https://yoursite.example/menu	Only the destination site	A normal page visit: IP address, user agent, timestamp, indistinguishable from a typed visit
Static via shortener	https://bit.ly/abc123	The shortener, then the destination	The shortener logs IP, user agent (device and OS), timestamp and rough IP-based geography, and often exposes click counts
Dynamic QR	https://provider.example/r/xyz	The QR platform, then the destination	Same fields as a shortener (IP, device type, time, coarse location) kept per code as "scan analytics", plus the ability to change the destination later
Tracked static	https://yoursite.example/?utm_source=poster	Only the destination site	The visit plus the UTM tags you chose: campaign-level, not personal

Three honest observations fall out of the table:

• "Scan analytics" is server logging. Dynamic platforms count scans by routing every scan through themselves; the analytics dashboard is a friendlier view of an access log. What that means for scanners is explored in dynamic QR codes and privacy.
• Rough is rough. IP-based geolocation resolves to a city or region on a good day, not a household. No standard scan reveals your name, phone number or precise GPS position, a claim to the contrary is a myth, covered in what a QR code can and cannot do.
• The destination always sees a visit. Even the most private architecture ends with a normal web request to the site you open, subject to that site's ordinary cookies and analytics, the same as clicking any link.

Choosing your exposure

As a scanner: read the preview banner. A direct domain means one party learns of your visit; a shortener or QR-platform domain means an intermediary logs the scan first. Neither is dangerous; only one is observed twice.

As a creator: if you do not need per-scan analytics, a static direct code is the private-by-construction choice, no intermediary, nothing to expire, and with UTM tags you still get campaign-level counts in your own analytics without any third party logging your visitors. If you genuinely need scan-level dashboards or editable destinations, a dynamic provider is the honest tool for that job: pick one whose retention policy you have actually read.

FAQ

Do QR codes track your location?

Not precisely. An intermediary or destination server sees your IP address, which resolves to a rough city-level area. A QR scan cannot access GPS: a website you open can request precise location, and your phone will ask you explicitly.

Can someone see if I scanned their QR code?

If the code points through a shortener or dynamic QR platform, the owner sees that a scan occurred, with timestamp, device type and rough IP geography, but not your identity. A direct static code shows the owner only an ordinary anonymous website visit.

Do QR codes collect personal data by themselves?

No. The printed code is inert and learns nothing. Data collection happens on the servers the encoded URL passes through, and on the destination page, exactly as it would if you clicked the same link in a browser.

Does UseQR log my QR codes or scans?

No. Static codes are generated entirely in your browser, so the payload never reaches a server at creation. Scans of a direct static code go straight to your destination: UseQR is not in the path and sees nothing.