QR Code Tracking and Privacy: What You Can Collect
Is QR code tracking legal? None of the regulator documents we reviewed mentions QR codes, so any answer is an analogy to the rules for website analytics, and it varies by country. The European Commission lists an IP address among its examples of personal data, while the UK ICO and the French CNIL each describe narrow cases where aggregate statistics need no consent. This article is not legal advice.
Facts checked on 17 October 2026.
What data does a QR code scan send?
A QR code holds text, usually a web address. Scanning it makes the phone request that address, and the server receives the phone's IP address. The Court of Justice of the European Union notes this in a footnote to its press release on the Breyer case. The EDPB's guidelines also name HTTP headers, such as the user agent, among the context data a request can carry.
With a dynamic code, that request reaches the redirect service, which is where scan statistics come from. With a static code, only the destination site sees it (how the two differ). The code creates no data by itself; whoever runs the server decides what to keep.
If you never store the IP address, is it still personal data?
The Commission's explainer lists an IP address and a cookie ID as personal data. It defines processing as any operation on such data, including collection, consultation and use, and gives storing IP addresses as one example. It adds that anonymisation counts only if it is irreversible.
In Breyer (C-582/14), the Court of Justice held that a dynamic IP address is personal data for a website operator when the operator has legal means to identify the visitor using extra information held by the internet access provider. We read the Court's press release of 19 October 2016, not the judgment text, and the case was decided under a 1995 directive that, per the EDPB's guidelines, the GDPR repealed.
So "we do not store IP addresses" is narrower than "we process no personal data". The address still arrives with every request, and a same-day hash of it is still derived from it. None of the texts we read says a service in that position is outside data-protection law, so we make no such claim. The CNIL's self-assessment tool describes an IP address with its last octet removed as pseudonymised.
Can QR code scan tracking skip a consent banner?
Two questions get mixed up here. The first, under data-protection law (GDPR, UK GDPR): is the data personal, what is your lawful basis, what do you tell people. The second, under ePrivacy-style rules on storing or reading information on a person's device: when is consent needed. The exemptions below answer only the second. The ICO says the UK GDPR still applies where statistics involve personal data, and the CNIL says its self-assessment tool does not assess compliance as a whole.
A scan redirect clearly raises the first question. Whether it engages the second depends on what the service collects and how it uses it: the EDPB's guidelines say collecting IP addresses or HTTP headers such as the user agent can bring the ePrivacy rule into play (paragraphs 42, 43 and 55), without saying it always does. None of these documents addresses QR codes.
| Authority | What it says about statistics | Date |
|---|---|---|
| UK, ICO guidance | No PECR consent if the sole purpose is aggregate statistics on how a service is used, to improve it, with clear information and a "simple and free" way to object. Tracking individual visitors, for example by IP address, needs consent. | Last updated 29 April 2026 |
| France, CNIL page (French) | Exempt if limited to the publisher's own audience measurement and anonymous statistics, with no cross-referencing or cross-site tracking. Advises informing users and keeping data at most 25 months. | 4 July 2025 |
| EU, EDPB | Technical scope only. Exemptions are left to national law and authorities; the rule applying does not automatically mean consent is needed. | Adopted 7 October 2024 |
The ICO's test: the exception is "about how your service is used, not about who uses it." Its examples of activity likely to qualify as aggregate statistics include device types, browser or system versions, the referrer URL and coarse location, at city or region level, that does not identify people.
One line in the CNIL's tool matters for QR codes: it lists measuring acquisition channels and ad-campaign performance among purposes to keep switched off by default in its exempt set-up. People often count scans to compare placements such as flyers and posters. The tool does not mention QR codes, so check how this applies to you. These documents come from the UK, France and the EU level; we did not review other countries.
How does a real scan record compare?
QR Maker AI's privacy policy lists what each scan record holds. Set against the examples above:
| Item | ICO and CNIL examples | QR Maker AI scan record |
|---|---|---|
| IP address | ICO: tracking individuals by IP needs consent. CNIL tool: if used, for city-level location, then pseudonymised by removing at least the last octet | Not stored, full or truncated; held in memory only to make the daily hash |
| Location | ICO: city or region level. CNIL tool: city level | Country, state or province, and the time zone they imply; no city |
| Device and browser | ICO: device types, browser and OS versions. CNIL tool: minimise, for example major versions | Device type, browser, system and major versions as the browser reports them |
| Referrer and tags | ICO lists the referrer URL. CNIL tool: domain only, no campaign identifiers in URLs | Referer header as sent, plus an optional placement tag you add, such as ?s=poster |
| Visitor count | ICO and CNIL tool: no tracking of individual visitors | A keyed hash of address and date counts same-day unique visitors and cannot be linked across days; pseudonymous, not anonymous |
| Retention | ICO: store individual-level data only as long as needed, and it lists retaining that data after aggregating it as going beyond the exception. CNIL: advises 25 months at most | Scan records are kept with the code and the privacy policy gives no fixed period, so on this row we are not stricter than the ICO and CNIL examples |
On IP address, this record is more conservative than these examples. Its location is no finer than the region level the ICO names. On referrers, tags and retention it is not stricter than every example. The comparison is ours, not a regulator's assessment, and no text we read recommends "store no IP" as a standard. Scan statistics need a dynamic code, which needs a verified account; as of October 2026 the free plan includes three active ones. Create one to see these categories on your own codes.
What should you tell your audience?
Our privacy policy says the code owner is generally the controller of scan data and is responsible for having a lawful basis and informing scanners. Put these points in a privacy notice linked from the page the code opens, because a printed code has little room for text:
- Purpose. Scan data is used to see how the code performs, for example which placement is scanned, and for nothing else. The ICO's exception depends on that sole purpose.
- Categories. List what your provider records, copied from its policy, not assumed.
- Aggregate or individual. Say whether you see only totals and whether a visitor identifier, such as a daily hash, exists. Claim it cannot be linked across days only if your provider documents that.
- Retention. State how long you keep scan records.
- Objection and contact. Give a working address. The ICO asks for a "simple and free" way to object, and the CNIL's tool puts the objection route in the privacy policy.
- Service providers. Name your QR provider.
- Extras. Describe any cookies or per-visitor tracking on your own page separately; four ways to track scans compares the options.
This summarizes public documents; it is not legal advice. Check the original text for each country where your audience lives.
FAQ
Is QR code tracking legal?
We found no regulator text written for QR scans. The ICO and CNIL treat narrow, aggregate, single-purpose statistics most leniently, but rules differ by country and by what you collect. Ask a lawyer who knows your market.
Do I need cookie consent for QR scan analytics?
It depends on what is stored on or read from the person's device and on national rules. The EDPB leaves exemptions to national authorities.
Is a hashed or truncated IP address anonymous?
Do not assume so. The Commission says anonymisation must be irreversible, and the CNIL's tool calls an IP address with its last octet removed pseudonymised.
Sources
- European Commission — Data protection explained. Undated. Accessed 17 October 2026.
- Information Commissioner's Office (UK) — What are the exceptions? (Guidance on the use of storage and access technologies). Guidance last updated 29 April 2026. Accessed 17 October 2026.
- CNIL (France) — Cookies : solutions pour les outils de mesure d'audience. French; paraphrases are ours. Published 4 July 2025. Accessed 17 October 2026.
- Court of Justice of the European Union — Press Release No 112/16, Judgment in Case C-582/14 Patrick Breyer v Bundesrepublik Deutschland. Published 19 October 2016. Accessed 17 October 2026.
- European Data Protection Board — Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, Version 2.0. Adopted 7 October 2024. Accessed 17 October 2026.
- CNIL (France) — Outil d'auto-évaluation relatif à la mise en œuvre d'une solution de mesure d'audience exemptée de consentement. French; paraphrases are ours. July 2025. Accessed 17 October 2026.