Dynamic QR codes and privacy — what every scan reveals

Where the data comes from

A dynamic QR code does not encode your destination. It encodes a short redirect URL on the provider's domain; the provider's server receives every scan as an HTTP request, looks up the current destination, and forwards the visitor. That indirection is the whole product — it is what makes editing after print and scan counting possible. It is also what makes every scan visible to a third party, and it adds a network round trip — typically 100–300 ms — before your page even starts loading.

What the provider can log on every scan

Field	Source	What it reveals
IP address	the request itself	approximate location, usually to city level, and the network operator
User agent	request header	device class, operating system and version
Timestamp	server clock	when — and, across scans, patterns of when and how often
Accept-Language	request header	the scanner's preferred language
Code identifier	the URL	which printed placement was scanned

The scanner sees none of this happen. There is no banner, no permission prompt — the redirect completes before the destination page, with its own cookie notices, ever loads. A fuller breakdown is in what is actually logged.

The retention and resale question

What is collected is usually documented. How long it is kept, and whether it is shared or sold, often is not. Scan analytics are an asset — for a free dynamic tier they may be the business model — and from outside you cannot audit retention, aggregation or onward transfer. You are also exposed to the provider's lifespan: if it folds, your codes die with it, a failure mode covered in what happens when a QR service shuts down.

When dynamic is still the right choice

Honest answer: sometimes it is. If you need to change a destination after printing 50,000 boxes, or compare scan counts across 40 store locations, a redirect layer is the correct tool, and whether you need one at all is worth ten minutes of thought before you commit. UseQR does not offer dynamic codes; the honest comparison of platforms that do is at best dynamic QR platforms.

Choosing a provider deliberately

If you go dynamic, the privacy questions to ask before the first print run:

• Is there a data processing agreement you can sign?
• Is there a stated retention period for scan logs, with deletion on request?
• Where is it hosted? EU hosting simplifies GDPR analysis considerably — see QR codes and GDPR.
• Can you export your data and codes?
• Can you use a custom domain you own, so a future migration does not kill every printed code?

The zero-intermediary option

A static code pointing straight at your own domain involves nobody else. The only server that sees the visit is yours, under your own privacy policy, with your own retention rules. You can still measure: add campaign parameters to the URL and read them in analytics you already run, as described in how to track QR scans. You give up post-print editing; you gain a code whose privacy properties you fully control and that can never be shut off by a third party.

FAQ

Do QR codes track you?

The code itself cannot — it is printed text. Tracking happens when the code points at a redirect server that logs each request. A static code pointing directly at a destination involves no intermediary, so only the destination site sees the visit.

Can a dynamic QR code see my exact location?

No. The provider sees your IP address, which typically resolves to a city or region, not a street address. Precise GPS location would require the destination page to ask for permission, which you can decline.

Is scanning a dynamic QR code anonymous?

Not fully. The provider records your IP address, device details and the time of the scan before redirecting you. Whether that is ever linked to you depends on the provider's retention and sharing practices, which you usually cannot verify.

What data do dynamic QR providers collect?

Typically the IP address, user agent (device and OS), timestamp, language headers and which code was scanned. Some derive city-level location and device statistics from these and present them as an analytics dashboard.