QR codes have become ordinary. Restaurant menus, event tickets, product packaging, payment terminals, bus stops — they’re everywhere. Most people point their phone at them without a second thought, because a QR code looks like a simple shortcut to a URL.
It is a simple shortcut to a URL. But the act of scanning that URL, and the infrastructure behind it, involves more data disclosure than most people realize.
What a QR Code Actually Is
A QR code is a machine-readable image that encodes a string of data — usually a URL, but sometimes text, contact information, or other content types. When your phone’s camera reads the code, it decodes the string and, for URLs, typically opens a browser window to that address.
The code itself is passive. It doesn’t collect data, doesn’t track you, and doesn’t know you scanned it. The data disclosure happens at the destination URL and in the infrastructure between you and it.
Understanding what gets collected requires understanding each step in that chain.
What Happens the Moment You Scan
When you scan a QR code that links to a URL and your phone opens that page, a standard HTTP request is sent to the server hosting that URL. That request includes:
Your IP address. Every web request includes the IP address it originated from. Your IP address reveals your approximate geographic location — generally at the city or region level, sometimes more specific depending on your ISP — and is logged by default in most web server configurations.
Your device and browser information (User-Agent string). The HTTP request includes a User-Agent header describing your browser, its version, your operating system, and your device type. A typical User-Agent string looks something like Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15. This information identifies your platform in enough detail to distinguish individual device models.
The time and date of the request. Web servers log the timestamp of every request.
What referred you (if applicable). If you clicked a link inside an app before being redirected, the referring page may be included in the request headers.
This is the baseline data disclosure from any web request — not specific to QR codes. What QR codes add is an additional tracking layer.
How QR Code Tracking Works
Most QR codes in commercial use aren’t pointing directly to the final destination. They link to a redirect service — a tracking URL that records the scan and then forwards the user to the actual content.
This is true of most “dynamic” QR codes, which are generated and managed through services like Bitly, QR code generators, Canva, or dedicated QR management platforms. The destination can be changed without reprinting the code (hence “dynamic”), but the mechanism that enables this is an intermediate redirect that logs every scan.
When you scan a dynamic QR code, the typical sequence is:
- Your phone reads the QR code and opens the encoded redirect URL
- The redirect service’s server receives your request, logging your IP address, User-Agent, timestamp, and sometimes your GPS location if the scanning app has location access
- The redirect service forwards you to the final URL
- The final destination’s server also logs the full request
At step 2, the QR code operator sees: how many people scanned, when they scanned, where they scanned from (via IP-based geolocation), and what devices they used. Some platforms go further, using JavaScript at the redirect step to collect additional device fingerprinting data.
Location Tracking: When It’s More Precise Than You’d Expect
IP-based geolocation is approximate — usually accurate at the city level, sometimes more granular depending on your ISP. But some scanning contexts produce much more precise location data.
QR code scanning apps with location permission. Third-party QR scanner apps often request location permission. If you grant it, scans made through that app can include precise GPS coordinates in the data sent to or logged by the redirect service.
Contextual inference. A QR code on a specific product, at a specific retail location, or in a specific advertisement conveys location context without needing GPS. If you scan a QR code on a shelf at a particular store, the QR code operator knows you were at that store, at that time, with that device — even without GPS.
Wi-Fi vs. mobile data. Scanning over Wi-Fi may reveal an IP address associated with a specific location (your home network, a specific café) more precisely than mobile data.
What Gets Done With the Data
Legitimate businesses use QR scan data primarily for analytics: how many people scanned, peak times, geographic distribution of users, device breakdown. This is not categorically different from web analytics on a website.
What varies is what happens with that data after collection:
Sharing with advertising platforms. Many QR redirect services integrate with ad platforms. Scan data — including device identifiers and approximate location — can be matched against advertising profiles, enriching those profiles with information about physical behavior. A device that shows up in a QR scan at a competitor’s event, or at a medical facility, or at an attorney’s office, adds data points to an advertising profile.
Data broker sharing. The data collected at the redirect layer may be sold to or shared with data brokers, who aggregate location and behavioral data across sources.
Persistent tracking via cookies. The final destination URL sets cookies in your browser. If the destination is a marketing site, those cookies may be used to track you across other websites that participate in the same ad network.
Account linking. If you’re already logged into an account on the destination site (a retailer’s app, a loyalty program), the scan can be linked to your account, associating physical location data with your identified account history.
QR Phishing: The More Acute Risk
Beyond the data-collection concerns, QR codes have become an increasingly common vehicle for phishing attacks — a tactic security researchers call “quishing.”
The mechanism is straightforward: an attacker creates a QR code linking to a malicious site and places it somewhere people will scan it. Common quishing scenarios:
Fake parking payment terminals. Stickers placed over legitimate parking meter QR codes, directing users to fake payment pages that capture credit card data. This has been documented across multiple cities.
Phishing emails with QR code images. Rather than including a malicious link (which email filters often catch), attackers embed a QR code image in an email. The QR code links to a phishing page. Many email security systems scan URLs in email text but don’t decode embedded QR codes.
Physical mail. Fake package delivery notifications with QR codes directing recipients to fake carrier login pages.
Tampered point-of-sale terminals. QR codes placed over or near legitimate payment terminals at retail locations.
The challenge with QR phishing is that you can’t examine a QR code the way you’d examine a suspicious URL. You can’t hover over a QR code to preview the destination.
How to Scan More Safely
None of this means QR codes should be avoided entirely. The risks are manageable with some awareness.
Use your phone’s built-in camera
Most modern iOS and Android phones decode QR codes directly in the stock camera app, without requiring a separate QR scanner. The stock camera app previews the URL before opening it and does not have additional data collection layers beyond the basic HTTP request.
Third-party QR scanner apps add another party to the chain — they may log scans, have their own tracking infrastructure, or request permissions (like location and contacts) that the stock camera doesn’t need.
Preview the URL before tapping
When your camera decodes a QR code, it shows you the destination URL before you tap to open it. Pause and look at it. Red flags include:
- A short URL or redirect URL (bit.ly, tinyurl, qr.page) rather than the brand’s actual domain
- A domain that looks like a brand but has added characters (amazon-secure.com, paypal-update.net)
- HTTP rather than HTTPS
- A URL that doesn’t match the context — a QR code on a product box linking to a completely different company’s domain
Don’t scan codes in unsolicited contexts
Be more cautious about scanning QR codes in emails you didn’t expect, on physical notices in public places you’re not sure are legitimate, and at payment terminals where stickers could have been placed over the original code.
Disable location for your camera app if you don’t use geotagging
If you have a third-party scanner app or want to be thorough, check what permissions your camera app has. Revoking location access means QR scans can’t include GPS coordinates.
When Your Files Don’t Have a QR Code
There’s a version of QR-related privacy thinking that applies to how you share your own files and links.
If you’ve generated a sharing link for a document or photo from a cloud storage service, that link functions similarly to a QR code: anyone with the link (or code) can access the content, and the access is often logged by the storage provider. Every time someone opens your shared link, the provider knows who accessed it (if they’re logged in) or at minimum their IP address, device, and access timestamp.
Keeping sensitive files private — not generating shareable links, not creating QR codes for sensitive content — is the most direct way to eliminate this category of disclosure. Files stored privately in a personal archive don’t generate access logs for third parties because no third party has access to them.