The short answer
A static QR code cannot be tracked. The data is baked into the printed pattern, the phone reads it directly from the image, and no server is involved — so there is nothing to count. You can know the code was scanned only if the destination URL itself has analytics (a normal web page hit).
A dynamic QR code can be tracked, because it does not store your real destination. It stores a short redirect link on a server you control, and every scan passes through that server before reaching the destination. The server logs each request, so you get scan counts, location, device, and time without touching the printed code. That server-side pass-through is the whole basis of QR scan analytics.
Why static codes can’t be tracked
A static QR code is just a printed string. When a phone scans it, the camera decodes the text straight from the image and opens it — there is no call home, no database lookup, and no middleman who could record the scan. This is exactly what makes static codes free, private, and immortal: nothing in the loop to fail or to spy.
If the static code points at a web URL, the destination page sees a normal visitor and can count that visit in its own web analytics (Google Analytics, Plausible, server logs). But that only tells you the page was loaded — not that a specific QR code was scanned, and not on the codes that encode WiFi, vCard, SMS, email, event, or plain text, which never touch the internet at all. See our static vs dynamic QR codes guide for the full picture.
What dynamic QR tracking can measure
A dynamic code funnels every scan through a redirect server, so the server can record details about each request. The standard set is the scan count, an approximate location, the device and operating system, the time of day, and the referrer.
Here is what a typical dynamic QR analytics dashboard reports, and where each data point comes from.
| Metric | What it tells you | Where it comes from |
|---|---|---|
| Total scans | How many times the code was scanned, ever. | Every HTTP request to the redirect link, counted. |
| Unique scans | An approximate count of distinct scanners. | Hash of IP + user agent, or a cookie; never a raw identifier. |
| Location (country/city) | Roughly where scans happen. | IP geolocation, resolved server-side. |
| Device & OS | iPhone vs Android, browser, model family. | The User-Agent header on the redirect request. |
| Time of day | When people scan — peak hours, days, campaigns. | The server timestamp of each request. |
| Referrer | How the scanner got there, when available. | The Referer header, often empty for camera apps. |
What QR tracking can’t tell you
QR analytics is server-side and aggregated, so it deliberately can’t identify a person. You get a scan count, a coarse location, and a device family — but not a name, an email, a phone number, or a persistent profile across codes unless the scanner logs in.
You also can’t tell whether a scan that loaded the redirect actually led to a meaningful action (a purchase, a signup). The scan is a leading indicator of interest, not proof of outcome. For that, append a campaign parameter to the destination URL so the destination’s own analytics can close the loop.
Privacy and GDPR
Scan analytics processes an IP address and a user agent, which are personal data under GDPR and similar regimes. A responsible dynamic tier minimizes what it keeps — coarse geolocation instead of precise, hashed identifiers instead of raw IPs, short retention windows — and aggregates rather than profiles individuals.
In practice that means storing country/city rather than the full IP, not joining scan logs to other datasets, and letting users delete a code and its history. If you operate in the EU, surface a short note on the redirect interstitial that scans are counted, and keep the data you collect proportional to the question you are answering.
How QRForge delivers it
QRForge’s free generator produces static codes by default — untrackable, free, and immortal. The paid dynamic tier (planned) replaces the static destination with a short redirect link on a server you control, logs each scan, and surfaces the metrics above in a dashboard you can edit later without reprinting.
Because every scan passes through that one redirect, you also get the editable destination and the redirect mechanics covered in our qr code redirect guide: change where the printed code goes, set expiry or a scan-count limit, and read the analytics from the same place. That is the bridge from a free static code to a measured, editable campaign.
Frequently asked questions
Can you track QR code scans?
Only with a dynamic QR code. A dynamic code stores a short redirect link on a server, and every scan passes through that server, which logs the request. A static code is read directly off the printed pattern with no server involved, so there is nothing to count.
How do I track how many times my QR code was scanned?
Generate a dynamic QR code and read the scan count from its dashboard. If you must use a static code, the only signal you get is the hit count on the destination URL in your own web analytics — and that only works for URL codes, not WiFi/vCard/text codes.
Can QR tracking identify who scanned my code?
No. Server-side scan analytics record an approximate location, a device family, and a time — not a name, email, or phone number. Identifying an individual requires the scanner to log in or otherwise self-identify, which a plain dynamic code does not do.
Is QR code scan analytics GDPR-compliant?
It can be, with care: keep coarse geolocation instead of full IPs, hash identifiers, avoid joining scan logs to other profiles, and retain data only as long as needed. Treat the IP and user agent as personal data and minimize what you store.