Quick answer
A private QR scanner app needs exactly one permission — your camera — and nothing else. It should show you the decoded link before opening it, flag known-bad URLs, and work without an account or cloud sign-in. If an app asks for contacts, precise location, or microphone just to read a black-and-white square, it's not built for privacy. It's built for data collection.
Checklist: camera-only permissions, a link preview before you tap through, no forced account, no ad SDK riding along.
Why most QR scanner apps track you
Free scanner apps have to make money somehow, and for many, that's ad and analytics SDKs bundled into the install. Those SDKs log scan location, frequency, and device type — even when the code was completely harmless, as Malwarebytes documents. None of that data is needed to decode a QR code. Reading one is self-contained: camera in, URL out.
The bigger issue is permission scope creep. Wikipedia's QR code overview notes that reader apps can request GPS, contacts, and browser history — access that has nothing to do with scanning and everything to do with an ad profile. Our breakdown of quishing, sticker scams, and how to stay safe covers the malicious-code side of things. The app doing the scanning is the other half most people never check.
Step-by-step: evaluating a scanner's privacy
Check the permission list before you install. Camera access is the baseline — the one thing a scanner genuinely needs. Anything beyond that (contacts, precise location, microphone, background data) is a mismatch. CISA's guidance on managing app permissions is blunt: if a permission isn't tied to the app's function, deny it.
Look for on-device or pre-flight link checking. A scanner worth using previews the decoded URL and flags it against a known-threat list before you land on the page — "scan, then pause," as Uniqode's QR safety guide puts it.
Skip apps that require an account or cloud sync just to scan. Decoding a code doesn't need a server round-trip. If a scanner forces sign-up first, ask what it's syncing and why.
Consider what's already on your phone. Android 14's Camera app and iOS's Camera app both read QR codes natively — no extra app, no bundled SDK, making them the lowest-tracking default. See what's built into your phone already — though neither checks URLs against a threat database, so you're still on the hook for reading the link yourself.
Common problems and fixes
"The link looked weird but I already tapped it." Check the domain for misspellings or switched letters, and be skeptical of urgency — "your account will be suspended." If you're not sure the source is legitimate, verify through a number or site you already know is real, not the one the code gave you, per FTC guidance.
"The code tried to download a file instead of opening a page." That's the clearest single red flag for a malicious code — safe QR codes open web pages, not forced downloads. Cancel it.
"There's a sticker over part of the sign." Treat any code on public signage or a parking meter as unverified by default. Stickers over legitimate codes are a documented attack pattern, not a rare one. Our deeper look at QR code phishing walks through how these sticker swaps play out.
Doing this on QRDock specifically
QRDock scans on-device, previews the link before you open it, and flags known-risky URLs — without requiring an account or running ads. The URL check is a best-effort layer, not a guarantee, so the habits above still matter no matter which scanner you use. Want a scanner built around this checklist? QRDock is free and doesn't ask for anything beyond your camera.
Frequently Asked Questions
Does a QR scanner app need any permission besides the camera?
No. A scanner's only job is to read what's in front of the camera and show you the decoded link. Contacts, location, microphone, or background access on top of that means it's collecting more than it needs — deny those or pick a different app.
Is my phone's built-in camera scanner private enough?
For most people, yes. It doesn't require installing anything extra, so there's no bundled ad or analytics SDK. The tradeoff: it generally doesn't check the destination URL against a threat database, so you still need to preview the link yourself.
What permissions should I deny when installing a QR scanner app?
Anything beyond camera access unless the app clearly needs it for an advertised feature — contacts, precise location, microphone, and background data by default. If it's not tied to reading a QR code, it doesn't belong on the list.
Does QRDock track what I scan?
QRDock scans on-device and doesn't run ads or sell scan data. It's built to do one job — decode the code and flag risky links — without turning your scan history into a product.
Is a paid QR scanner automatically more private than a free one?
Not automatically. Price isn't a privacy signal by itself. What matters is whether the app discloses what it collects, needs an account to function, and whether its permissions match what a scanner actually needs.
Conclusion
Picking a private QR scanner is a five-minute permissions check, not a research project: camera-only access, a link preview before you open anything, no forced account. As QR codes keep showing up in unexpected places — packages you didn't order, parking meters, public screens — the scanner you're using matters just as much as the code you're pointing it at.