Scan analytics

Every scan of a dynamic code is a web request to the redirect service, and the request carries what any web server sees: the time, the IP address, the user agent string (which reveals device, operating system and browser), the phone’s preferred languages, and sometimes a referrer, which camera scans usually lack. The service turns the IP address into an approximate location with a geolocation database, stores the record and then redirects.

Good tools also filter out requests that are not people, such as chat apps fetching a link to build a preview and search crawlers, usually by their user agent. A static code produces no scan data at all, because nothing stands between the phone and the destination.

Scan data is useful when you read it for what it is:

• It is not identity. A scan does not reveal a name, email or phone number.
• Location is approximate. It comes from the IP address, not GPS. MaxMind, a large IP geolocation provider, puts its country-level accuracy at 99.8% but its US city-level accuracy at 66% within 50 km, so treat the country as reliable and the city as a guess.
• Scans are not visits or sales. Use UTM parameters and your web analytics to see what happens after the scan.
• Scan rate needs an outside number. The share of people who saw a code and scanned it requires an estimate of how many saw it, such as a print run or foot traffic, which no QR tool can measure.

The most reliable use is comparison: one code per placement, read side by side over the same period, shows which poster, table or mailing did the work. Unique scans estimate how many different people that was. Scan logs can also be personal data under privacy laws such as the GDPR, which affects how they should be stored.