Do QR Codes Track You? What's Actually Logged When You Scan One

What it is

A QR code can't track you on its own. It's just a static block of encoded text — usually a URL — with no battery, no radio, no network connection. Scan it, and your phone decodes that text. Nothing gets sent anywhere unless you choose to open what it decoded to. Tracking only enters the picture once you tap through: either the destination website logs your visit the way any website logs visitors, or something about the scanning app itself picks up data along the way. Here's exactly what gets logged, by whom, and the one risk that's actually worth watching for.

How it actually works

Static codes vs. dynamic codes

Not every QR code behaves the same way once you scan it. A static QR code has its destination baked in permanently — same URL or text every time — and because nothing routes through a middleman, there's no way for it to report back that a scan happened. A dynamic QR code works differently: it points to a short redirect link controlled by a service, which forwards you to the real destination. That middle step is where logging happens. Every redirect can get recorded. This mechanical difference is behind most "is this QR code tracking me" suspicion — see static vs. dynamic QR codes for how to tell which one you're looking at.

What a tracked landing page actually logs

Once a scan opens a link, the landing page behaves like any other web page a visitor lands on — nothing more exotic than that. Standard analytics tooling can capture your IP address (which maps to an approximate city, region, and country), your device category and operating system, your browser type from the user-agent string, and a precise timestamp of the request. These are the same fields any analytics platform captures for any website visit, QR-driven or not. None of it requires anything special from the QR code itself; it's standard web logging, and it kicks in the moment your phone's browser requests the page.

UTM parameters, explained honestly

Noticed a long string of ?utm_source=... text tacked onto a link after scanning a code? That's a UTM parameter — a plain-text tag marketers use to track which campaign drove the click. The five variants — utm_source, utm_medium, utm_campaign, utm_term, and utm_content — carry no personal data at all. They just label the click so an analytics tool can count it toward a specific poster, menu, or ad. Creating QR codes yourself and want this kind of campaign data? See QR code analytics for how to set it up properly.

Where you'll see it

Legitimate tracking: marketing and events

Most tracking you'll actually run into is mundane. A restaurant wants to know how many people scanned the table-tent code for the menu. An event organizer wants to count check-ins. A brand wants to see which packaging QR code drove more scans this quarter. All of it runs on dynamic codes and ordinary web analytics. That's measurement, not surveillance — no different from a website tracking its own traffic.

The real risk: malicious QR codes ("quishing")

What's actually worth worrying about isn't passive analytics. It's QR codes designed to deceive. Scammers cover legitimate codes with their own stickers on parking meters and signage, or send codes via unsolicited text or email claiming a package couldn't be delivered. Phishing by QR code — "quishing" — works precisely because you can't read a code's destination with your eyes, unlike a suspicious link sitting right there in an email. Scan one of these and you'll typically get routed through attacker-controlled infrastructure that fingerprints the device before landing on a fake login page built to steal credentials or hijack a session.

Tips, gotchas, and a quick how-to with QRDock

Before scanning anything from a flyer, sticker, or unsolicited message, get in the habit of checking where it leads. Both iPhone and Android camera scanners show a preview of the decoded URL before opening it — read that domain carefully for misspellings or a swapped letter before tapping through. Treat any QR code that arrives by unexpected text or email with the same suspicion you'd give a sketchy link, and verify through the company's official channel instead.

It also matters which app does the scanning. Some free scanner apps monetize by logging your scan history or running ads against it — see how to pick a private QR scanner for what to check before you install one. QRDock's scanner shows you the destination before it opens and runs a best-effort URL safety check, without logging your scan history or running ads. Try it at qrdock.app.

Frequently Asked Questions

Can a QR code track my location without opening a link?

No. A plain QR code is just encoded text — scanning it decodes that text on your device, and nothing is sent anywhere until you choose to open a link or share data it contains. Location tracking only happens if you open the destination and that page (or an app with location permission) reads your GPS.

What's the difference between a static and a dynamic QR code for tracking?

A static QR code encodes a fixed URL or text that never changes and has no way to report back when it's scanned. A dynamic QR code encodes a short redirect URL controlled by a service; that service can log every time the redirect fires, which is how most QR code analytics and campaign-tracking tools work.

Does a QR code know my IP address?

The code itself doesn't — it has no network connection. If scanning it opens a link, your phone's browser sends a normal HTTP request to that destination, and the destination server can log your IP address the same way any website logs visitors.

Are UTM parameters in a QR code link dangerous?

No. UTM parameters (utm_source, utm_medium, utm_campaign, and similar) are plain text tags read by analytics tools to measure which QR code or ad drove a click. They don't carry your name, device ID, or any personal data — they just label the click.

How do I check what a QR code will do before I scan it?

Use your phone's built-in camera or a scanner that previews the decoded link before opening it — both iOS and Android show the destination URL first. Read the domain carefully for misspellings, and don't scan codes from unsolicited texts or emails pushing urgency.

Conclusion

The code itself is inert. Whatever tracking actually happens takes place at the destination page or inside the app you used to scan — and most of the time, that's the same ordinary web analytics every site already runs, nothing unique to QR codes. What deserves your attention is malicious codes designed to deceive you, not passive logging. Preview the link, read the domain, and pick a scanner that doesn't track you either.