Do QR Codes Collect Personal Data? What a Scan Can and Cannot Reveal

A QR code image does not collect personal data by itself. Learn where data can be collected after a scan and how static QR codes differ from tracked links.Written by Qraffe · Updated October 5, 2026 · 6 min read

A QR code image does not collect personal data by itself. It is a pattern that stores information such as a website address, Wi-Fi details or contact information.

Data collection can begin after the scan if the code opens a website, passes through a tracking redirect or starts an action in an app. The distinction matters when you are choosing a QR code for a printed menu, poster, product label or event.

The short answer

A static QR code does not know who scanned it. It cannot record a name, phone number, location or scan count on its own.

If a QR code opens a website, that website can collect data under its own settings and privacy policy. If the code first opens a redirect managed by a QR provider, that provider can also receive the request before sending the visitor to the final destination.

What a QR code actually stores

A QR code stores data in its pattern. For a website QR code, that data is usually the destination URL. For a Wi-Fi QR code, it can include the network name, security type and password.

The image is not an internet connection and it does not send a message when someone points a camera at it. A phone reads the pattern locally then decides what action to offer.

This is why a static QR code can work without a Qraffe account, a database or a Qraffe redirect after you download it. The information is already inside the code.

Where data can be collected after a scan

The website that opens

When a QR code opens a website, the visit is handled like any other web visit. The website may keep server logs, use analytics tools or set cookies depending on how it is built and which choices the visitor makes.

That data collection belongs to the website. It does not come from the QR pattern itself.

For example, a QR code that opens https://example.com/menu is only a route to that page. The menu website may measure visits but the code does not identify the person who scanned it.

A redirect or dynamic QR service

Some QR services put their own short URL in the code. A scan reaches that service first and the service redirects the visitor to the final destination.

Because the request passes through that service, it can count requests and may record details that its privacy policy allows. This is the usual mechanism behind scan dashboards and editable destinations.

Read Static vs Dynamic QR Codes: What Actually Changes? before choosing this setup for printed material. A managed redirect can be useful when you genuinely need to change the destination later. It also adds another service to the path between the scan and your page.

You can measure visits to your own website without using a QR provider redirect. Add campaign parameters to the destination URL before you make the code.

For example, a restaurant could use a URL like this:

https://example.com/menu?utm_source=table-qr&utm_medium=qr&utm_campaign=summer-menu

Google Analytics documents that UTM parameters can identify the source, medium and campaign that brought a visit to a website. This approach measures visits that reach the page. It does not tell you how many people pointed a camera at the code but decided not to open the link.

Keep campaign labels simple and do not put a person’s name, email address or other personal information in a URL.

Static QR codes and privacy

A static QR code is a good fit when you want the code to contain the final destination directly. There is no QR-provider redirect layer between the phone and that destination.

That does not make the destination website private by default. If the site uses analytics or cookies, explain that clearly on the site and give visitors the choices required for your situation.

It does mean the QR image is not silently reporting each scan to the generator that created it. With a browser-based static generator such as Qraffe, the QR payload is processed in your browser and the final code stores the destination directly.

What to tell people before they scan

Clear labels are useful for privacy as well as usability. Tell people what the code opens before they scan it.

  • “View the menu” is clearer than an unlabeled code on a table.
  • “Open product instructions” sets an accurate expectation on packaging.
  • “Join guest Wi-Fi” lets people decide whether they want to use the network details in the code.

Use the final destination that people expect. Avoid hiding a surprise sign-in screen, a payment request or an unrelated marketing page behind a code.

The bottom line

A QR code does not collect personal data simply because someone scans it. Any data collection happens in the service or website that the code opens after the scan.

Choose a static direct link when you want a simple path to a destination you control. If you measure website visits, use a clear campaign label and a privacy policy that explains the website’s own data practices.

Create a static QR code with Qraffe

Sources