QR Code Privacy: Scan Tracking Under GDPR and CCPA

A dynamic QR code sends every scan through a redirect server, which can log what the phone’s request contains. A typical scan record, and how privacy law sees each part:

Cookies and pixels on the landing page bring their own rules. For the technical side, see what scan analytics record.

Yes, in most cases. The GDPR defines personal data as information about an identified or identifiable person and lists “an online identifier” among the ways a person can be identified (Article 4(1)). Recital 30 names “internet protocol addresses” and “cookie identifiers” as examples. Before the GDPR applied, the Court of Justice ruled in Breyer (C-582/14, 19 October 2016) that a dynamic IP address is personal data for a website operator that has legal means to identify the visitor with the internet provider’s help.

Hashing does not change that. Article 4(5) defines pseudonymization as processing data so it can’t be linked to a person without separately kept additional information, and Recital 26 says pseudonymized data “should be considered” information about an identifiable person. The EDPB’s Guidelines 01/2025 on pseudonymisation (consultation version, January 2025) say the same. There is a technical reason too: there are only about 4.3 billion IPv4 addresses, so anyone holding the salt can hash them all and match the results.

A 2025 ruling, EDPS v SRB (C-413/23 P), accepted that pseudonymized data may not be personal data for a recipient who cannot re-identify anyone. Your own scan logs still are.

Of the six lawful bases in Article 6(1), two fit scan tracking:

• Legitimate interests (Article 6(1)(f)) for basic, aggregate measurement: scans per poster, per day, per kind of phone. The EDPB’s Guidelines 1/2024 (consultation version, October 2024) set three cumulative tests: a legitimate interest, processing that is necessary for it, and people’s rights not overriding that interest. Minimal fields, short retention and no profiling help you pass.
• Consent (Article 6(1)(a)) for anything beyond that: building profiles of individual scanners, combining scan data with customer records, or sending it to advertising platforms.

Whichever you use, Article 13 requires telling people at the time of collection who you are, why you collect the data and how long you keep it.

A second law applies on top of the GDPR. Article 5(3) of the ePrivacy Directive allows storing information on, or reading it from, a user’s device only with consent, unless it is strictly necessary for a service the user asked for. That covers cookies and similar identifiers. The EDPB’s Guidelines 2/2023 (final version, adopted 7 October 2024) read it broadly: tracking links, tracking pixels and even IP-based tracking can fall within it, although that does not always mean consent is required.

In practice, for EU audiences, landing-page analytics or advertising cookies need consent, and so, generally, do retargeting pixels and ad-platform forwarding. A plain redirect that logs request data and stores nothing on the phone is lower risk, but not automatically outside the rule.

The UK has its own versions, the UK GDPR and PECR. Section 112 of the Data (Use and Access) Act 2025, in force since 5 February 2026, added exceptions to the consent rule. The ICO’s guidance on the statistical purposes exception says it covers aggregate analytics used to improve your own service, requires clear information and a free way to object, and does not apply to online advertising (as of October 2026).

Under the GDPR you are usually the controller and your QR provider a processor. Article 28 requires a contract between you, usually called a data processing agreement (DPA). Ask any provider for one before an EU or UK campaign, along with answers to these questions:

• Is the raw IP address stored, or only a hash? Is the hash salted?
• Where is the data stored, and which subprocessors receive it?
• How long are raw scan records kept, and can you delete them?
• Is anything sent to advertising platforms, and only when you switch it on?

Data minimization and storage limitation (Article 5(1)(c) and (e)) mean collecting only what you need and keeping it no longer than necessary. Totals can last for years; raw scan logs rarely need to.

The CCPA, as amended by the CPRA, applies only to for-profit businesses doing business in California that meet one of three tests in Civil Code §1798.140(d): annual gross revenue above a threshold the California Privacy Protection Agency lists as $26,625,000 (effective January 1, 2025, as of October 2026); buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or earning half or more of revenue from selling or sharing it.

If it applies:

• Scan data counts. Personal information includes “online identifier” and “Internet Protocol address” (§1798.140(v)).
• Ad forwarding can be “sharing”. Disclosing personal information to a third party for cross-context behavioral advertising, such as retargeting, is sharing, paid or not (§1798.140(ah)).
• People can opt out. Consumers can tell a business to stop selling or sharing (§1798.120), usually through a “Do Not Sell or Share My Personal Information” link (§1798.135).
• Global Privacy Control is an opt-out. The regulations require businesses that sell or share to treat a valid opt-out preference signal as an opt-out request for that browser (11 CCR §7025), and the Attorney General names GPC as one.

Other US states have their own comprehensive privacy laws with similar opt-out rights; the IAPP keeps a state-by-state tracker.

1. Decide what you need to learn, usually scans per placement and per day, and don’t collect more.
2. If you rely on legitimate interests, write a short balancing test: the purpose, why scan data is needed, and why it doesn’t override people’s rights.
3. Explain scan logging, your provider and retention in a privacy notice on the landing page. A line near the printed code helps, since the scan is logged first.
4. In the EU, get consent before analytics or ad cookies on the landing page. In the EU and UK, get it before retargeting pixels or ad-platform forwarding.
5. Honor Global Privacy Control. If CCPA applies and you share data for cross-context ads, add a “Do Not Sell or Share” link.
6. Sign a processor agreement with your QR provider and get answers to the questions above.
7. Set a retention period for raw scan logs and CSV exports, and keep only totals after it.
8. Keep personal data out of URLs and UTM tags.

If you add routing by location or language, the same data is involved; see how QR routing works. For campaign tags, see UTM tracking for print.

For each scan of a dynamic code, CirculateQR records the time; country, region, city and approximate coordinates derived from the IP address; time zone; device type, operating system, browser and language; referrer and user agent; the routing rule or destination used; UTM tags; and a bot flag. The IP address is not stored in scan records. A salted one-way hash (truncated SHA-256) is stored instead and used to count unique scans. That is pseudonymization, so treat the records as personal data.

Opening a CirculateQR short link or hosted page also sets a first-party cookie on the phone holding a random visitor ID, kept for a year, and some hosted pages use short-lived cookies of their own. Include them in your consent assessment for EU and UK audiences.

Dashboards show 7 days of history on the free plan, 90 on Studio, 365 on Artisan and unlimited on Stealth. That is how far back you can see, not a deletion schedule, so set your own retention for CSV exports.

Pixel forwarding (Artisan and up) sends server-side events to the Meta Conversions API, the Google Analytics 4 Measurement Protocol and the TikTok Events API. It is skipped when the browser sends Global Privacy Control or Do Not Track, or the visitor has opted out. That is not the same as EU or UK consent, so leave it off for those audiences unless you collect consent first.