# QR codes and tracking: what is actually logged

> It depends on the architecture. A static code pointing straight at a site reveals only a normal page visit to that site. A shortened or dynamic code adds an intermediary that logs IP address, device type, timestamp and rough location. A client-side generator like UseQR sees nothing at all.

Source: https://useqr.app/docs/security/qr-codes-and-tracking-what-is-logged · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## The code itself tracks nothing

A QR code is printed text. It has no sensor, no beacon, no way to phone home, the
pattern on the poster cannot know it was scanned. All tracking happens *after* the
decode, on the network path the payload sends you down. Which means the honest answer to
"do QR codes track you?" is: **it depends entirely on what is encoded**, and you can read
that yourself before opening: our [scanner](/scan) shows a code's raw contents in your
browser without following them.

There are two separate moments where data can be collected: when the code is **created**,
and each time it is **scanned**. They involve different parties.

## At creation: what the generator sees

A server-side generator receives your [payload](/glossary/payload) in order to render it
(URLs, WiFi passwords, contact cards and payment identifiers included), and whether that
is logged is a policy you cannot audit.
[Client-side generation](/docs/security/client-side-vs-server-side-qr-generation) is the
structural fix: UseQR encodes in your browser, no payload ever reaches a server, and so
there is nothing to log. What each class of provider can observe has
[its own page](/docs/security/what-your-qr-provider-can-see).

## At scan: who sees what, by architecture

| Architecture | Example payload | Who learns of the scan | What they can log |
|---|---|---|---|
| Static, direct | `https://yoursite.example/menu` | Only the destination site | A normal page visit: IP address, user agent, timestamp, indistinguishable from a typed visit |
| Static via [shortener](/glossary/short-url) | `https://bit.ly/abc123` | The shortener, then the destination | The shortener logs IP, user agent (device and OS), timestamp and rough IP-based geography, and often exposes click counts |
| [Dynamic QR](/glossary/dynamic-qr-code) | `https://provider.example/r/xyz` | The QR platform, then the destination | Same fields as a shortener (IP, device type, time, coarse location) kept per code as "scan analytics", plus the ability to change the destination later |
| Tracked static | `https://yoursite.example/?utm_source=poster` | Only the destination site | The visit plus the [UTM tags](/glossary/utm-parameter) you chose: campaign-level, not personal |

Three honest observations fall out of the table:

- **"Scan analytics" is server logging.** Dynamic platforms count scans by routing every
  scan through themselves; the analytics dashboard is a friendlier view of an access log.
  What that means for scanners is explored in
  [dynamic QR codes and privacy](/docs/security/dynamic-qr-codes-and-privacy).
- **Rough is rough.** IP-based geolocation resolves to a city or region on a good day,
  not a household. No standard scan reveals your name, phone number or precise GPS
  position, a claim to the contrary is a myth, covered in
  [what a QR code can and cannot do](/docs/security/what-a-qr-code-can-and-cannot-do-to-your-phone).
- **The destination always sees a visit.** Even the most private architecture ends with
  a normal web request to the site you open, subject to that site's ordinary cookies and
  analytics, the same as clicking any link.

## Choosing your exposure

**As a scanner:** read the preview banner. A direct domain means one party learns of
your visit; a shortener or QR-platform domain means an intermediary logs the scan first.
Neither is dangerous; only one is observed twice.

**As a creator:** if you do not need per-scan analytics, a static direct code is the
private-by-construction choice, no intermediary, nothing to expire, and with UTM tags
you still get campaign-level counts in your own analytics without any third party
logging your visitors. If you genuinely need scan-level dashboards or editable
destinations, a dynamic provider is the honest tool for that job: pick one whose
retention policy you have actually read.

## FAQ

### Do QR codes track your location?
Not precisely. An intermediary or destination server sees your IP address, which resolves to a rough city-level area. A QR scan cannot access GPS: a website you open can request precise location, and your phone will ask you explicitly.

### Can someone see if I scanned their QR code?
If the code points through a shortener or dynamic QR platform, the owner sees that a scan occurred, with timestamp, device type and rough IP geography, but not your identity. A direct static code shows the owner only an ordinary anonymous website visit.

### Do QR codes collect personal data by themselves?
No. The printed code is inert and learns nothing. Data collection happens on the servers the encoded URL passes through, and on the destination page, exactly as it would if you clicked the same link in a browser.

### Does UseQR log my QR codes or scans?
No. Static codes are generated entirely in your browser, so the payload never reaches a server at creation. Scans of a direct static code go straight to your destination: UseQR is not in the path and sees nothing.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate
- https://useqr.app/url