What Data Gets Exposed When Scanning a QR Code?
When you scan a QR code, two things happen. First, your browser opens the destination page, which receives standard HTTP data.
Second, OnlineQRcode registers a scan event with limited tracking analytics, such as the timestamp, device/OS type, and the area where it was scanned from based on the IP address for reliability and anti-abuse.
Names, phone numbers, or personal device IDs will not be shared.
Keeping Your Data Private: Real-World Examples
QR code data is shared in many everyday situations. Here are several examples of how QR data is commonly shared:
- Event poster scan: When you scan a QR code on a poster, the organizer sees scans by hour and device type to plan resources, but not your personal ID.
- Restaurant menu QR: If you own a restaurant, scans of your menu will help you better understand busy times, and customers will not receive any of your personal information.
- Marketing campaign: If you scan a QR code on a flyer, the brand dashboard shows channel performance using UTM parameters while keeping your data private.
In every case, analytics are designed to optimize the experience and security without exposing who you are.
OnlineQRcode’s Privacy-First Approach
We design privacy into every step of your QR experience. This means when creating a QR code with our QR code generator, we collect only the data necessary to provide a smooth experience.
This means using it solely for the purposes we’ve mentioned, and securing it with modern protections.
We comply with GDPR and CCPA/CPRA, including “Do Not Sell/Share” options and a simple process for access, deletion, and portability.
This means we focus on:
- Data minimization and purpose limitation, by design
- Clear legal bases, such as contract, consent, legitimate interests
- GDPR/CCPA rights: access, delete, port, and opt-out of sharing
- Encryption in transit/at rest and strict access controls
Scanners vs. Registered Users
You interact with OnlineQRcode in two ways: as a scanner or a registered user who created a code with our generator.
Keep reading for a further breakdown on what data is collected from each type of user.
Data collected from QR code scanners
When you scan a QR code that routes through OnlineQRcode, we record a basic scan event so the code works and campaign owners can view high-level performance.
This typically includes a timestamp, general device/OS info, and a non-precise location, such as a city or region derived from the IP.
We don’t pull personal identifiers from your device, and we don’t capture precise GPS without your explicit consent.
Types of data collected from registered users
If you create an account and QR codes with OnlineQRcode, we process your account data to provide your workspace and features, including your name, email, business details, and team settings.
Your dashboards display campaign analytics that help you improve results, along with any UTM or link performance you configure. These insights are built from aggregated/anonymized scan data, so you never see individual scanner identities.
FAQs
What information can a business see when I scan a QR?
Toggle faqs
Businesses see analytics like total scans, time-of-day trends, and broad location. A business won’t see your name, phone number, email, or personal device IDs. I
If a referrer exists, the destination website may receive it as standard browser data, but code owners, like those who use OnlineQRcode, do not receive your identity.
How does OnlineQRcode protect my scans?
Toggle faqs
We collect only what’s needed to make the QR work and keep the platform secure.
Raw technical logs are kept for short, utility-based periods, then converted into anonymized, aggregated metrics.
We separate scanner data from account data, use encryption, and apply strict access controls to prevent misuse or unauthorized access, all while complying with GDPR and CCPA/CPRA.
Do QR codes collect personal information?
Toggle faqs
QR codes themselves don’t “collect” anything; they simply point your browser to a destination. When you scan with OnlineQRcode, we register a minimal scan event and limited technical details to ensure reliability and prevent abuse.
We don’t capture personal identifiers from your device or precise GPS without clear consent. Code owners see aggregated trends, not your identity or personal contact information.