rdyrct
Dashboard
← All articles

QR Code Tracking: A Practical Guide for Marketers

QR Code Tracking: A Practical Guide for Marketers

Decorative title card illustration for QR code tracking article

The fastest way to turn a physical scan into usable campaign data is a dynamic QR code backed by a privacy-first analytics platform. Here is the short version: create a dynamic short link, add UTM parameters, generate a branded QR pointing to that link, and monitor every scan in real time through Rdyrct. You get location, device, referrer, and scan-count data without storing a single IP address. That combination covers the full measurement loop from print to conversion.

Table of Contents

Dynamic vs. static QR codes: which one should you use?

Only dynamic QR codes are reliably trackable. A static code is a fixed image that encodes a URL permanently. Once printed, you cannot change the destination and you collect zero scan data. Dynamic codes encode a short link. The destination lives in the redirect server’s settings, so you can update it anytime without reprinting, and every scan gets logged.

Hand applying dynamic QR code sticker

Feature Static QR code Dynamic QR code
Destination editable after print No Yes
Scan analytics None Full (count, location, device, referrer)
UTM parameter support No Yes
Branded short domain No Yes
Best for Wi-Fi passwords, vCards, permanent URLs Campaigns, packaging, print ads, events

The decision rule is simple: if you need to measure anything or might change the destination, use dynamic. Static codes make sense for permanent, offline-only data like a Wi-Fi credential or a contact card where analytics add no value.

Pro Tip: Already printed materials with static QR codes? You can overlay a new dynamic QR on a sticker and place it over the old one. It is not elegant, but it works for short-run corrections. For anything reprinted, switch to a dynamic short link from the start. Rdyrct’s dynamic QR code guide walks through the full setup.

Key QR code tracking metrics you should collect and why they matter

Prioritize these seven metrics: total scans, unique scanners, scans over time, location/country, device type, referrer/source, and conversion events via UTM tags passed into GA4. Each one answers a different marketing question.

Total scans tell you raw reach. A flyer in a coffee shop that gets 400 scans in a week is performing. One that gets 3 is not placed well.

Unique scanners are harder to measure precisely without storing persistent identifiers, but a good platform approximates them by deduplicating within a session window. The gap between total and unique scans signals repeat engagement, which matters for loyalty programs and menus.

Scans over time reveal campaign momentum. A spike on launch day followed by a flat line suggests the QR was seen once and forgotten. Sustained daily scans suggest the placement is working continuously, like a restaurant table tent or a product package.

Location and country data matter most for out-of-home (OOH) advertising and retail. If you placed QR codes in three cities and 80% of scans come from one, you know where to concentrate the next print run.

Device type shapes the landing page experience. If 95% of your scanners are on iOS, your destination page needs to load fast on Safari. A high desktop share on a print campaign is a red flag — it may indicate bot traffic or someone typing the URL rather than scanning.

Referrer/source identifies the app that opened the link. Most QR scans show as direct or from a native camera app. An unexpected referrer can surface sharing behavior you did not anticipate.

Conversion events via UTM are where QR analytics connect to business outcomes. A scan is an early-funnel signal; a purchase or form fill is the outcome. Physical-to-digital touchpoints like QR codes are effective for measuring campaign reach as early-funnel engagement, and UTM tags let you trace that scan all the way to a GA4 conversion event.

How to set up QR code tracking in three practical steps

Step 1: Create a dynamic short link with UTM parameters.

In Rdyrct, create a new short link pointing to your destination URL. Before saving, append UTM parameters. A clean UTM string for a QR campaign looks like this:

https://yoursite.com/promo?utm_source=flyer&utm_medium=qr_code&utm_campaign=spring_launch&utm_content=coffee_shop_a

Keep naming conventions consistent across every QR in a campaign. Inconsistent capitalization or spacing fragments your GA4 channel reports. The UTM parameter guide from Ortto covers naming conventions in detail.

Step 2: Generate a branded QR code pointing to that short link.

Use your short link as the QR’s encoded URL. In Rdyrct, you can attach a custom domain so the encoded URL reads as your brand (e.g., go.yourbrand.com/spring). Set the QR size to at least 2 cm × 2 cm for print. Add a call-to-action label below the code (“Scan for 20% off”) and leave a quiet zone of at least four modules around the code’s edge. For color and contrast guidance, Rdyrct’s QR code color design guide covers scannability requirements.

Step 3: Test scans and verify the analytics flow.

Before printing at scale, run this checklist:

  • Scan from an iPhone (Safari camera) and an Android device (Google Lens)
  • Confirm the redirect lands on the correct destination page
  • Check that UTM parameters appear in the destination URL
  • Open Rdyrct’s dashboard and confirm the test scan appears in the live click feed
  • Verify the scan shows the correct device type and country
  • Check GA4 to confirm the session is tagged with your UTM source/medium

If UTMs are missing in GA4, the most common cause is a double redirect stripping parameters. Google’s guidance on measuring redirects explains how to preserve campaign parameters through redirect chains.

How do you connect QR scan data to Google Analytics and UTM workflows?

The answer is UTM parameters passed through the short-link redirect into GA4. When a scanner hits your short link, the redirect appends your UTM string to the destination URL. GA4 reads those parameters on page load and attributes the session to your campaign. No additional tagging on the destination page is required for basic attribution.

For more advanced setups:

  • Direct GA4 measurement via redirect: works for most campaigns. The short link redirects with UTMs intact, and GA4 logs the session under the correct source/medium. GA4’s developer documentation covers event-level attribution and the measurement protocol for server-side setups.

Pro tip on UTM hygiene: use lowercase consistently, avoid spaces (use underscores), and agree on a naming taxonomy before launching multiple QR codes in a campaign. Fragmented naming turns a clean GA4 report into a mess of near-duplicate rows.

What features should a QR code tracking tool have?

The non-negotiable list for any marketing team:

  • Dynamic links with editable destinations — you need to fix a broken URL or swap a seasonal offer without reprinting. This is the single most important feature for any printed campaign.
  • Custom domain / branded short links — a branded URL in the QR builds trust and keeps your analytics tied to your own domain. Generic short domains look suspicious on packaging.
  • Real-time dashboard with live click feed — see scans as they happen. Useful for event check-ins and launch-day monitoring.
  • Device and referrer tagging — know whether scanners are on iOS or Android and which app opened the link.
  • Bot filtering and scan validation — automated crawlers and link checkers inflate scan counts. A tool that filters bot traffic gives you cleaner data. Market signals from QR tool launches confirm that bot filtering and real-time analytics are now standard expectations.
  • UTM parameter builder — a built-in builder reduces typos and enforces naming conventions across a team.
  • API and webhooks — for teams that need scan events in external systems (CRMs, data warehouses, automation tools).
  • Roles and team access — multiple users should be able to view analytics without sharing admin credentials.

Rdyrct covers all of these. The free tier gets you dynamic links and basic analytics. Paid plans add branded QR codes, custom domains, longer analytics history, and team roles.

Privacy-first QR tracking: what U.S. marketers need to know

You can collect useful scan metrics without storing personally identifying data. The key distinction is between aggregate context data (country, device type, referrer, timestamp) and personal data (IP addresses, persistent device identifiers). A privacy-first tracker captures the former and discards the latter.

What a privacy-respecting QR analytics tool should record:

  • Scan timestamp and count
  • Country derived from routing (not stored IP)
  • Device type and OS
  • Referrer app or browser
  • UTM parameters

What it should avoid:

  • Raw IP address storage
  • Persistent cross-site identifiers
  • Fingerprinting-based unique user tracking

Rdyrct’s approach: no IP addresses are stored, and analytics are built around aggregate signals rather than individual tracking. That posture matters for U.S. marketers operating under the California Consumer Privacy Act (CCPA). Under CCPA, IP addresses can qualify as personal information for California residents. A tool that never stores IPs removes that category of data from your vendor contracts and privacy disclosures entirely.

Pro Tip: When evaluating any analytics vendor, ask for their data processing agreement (DPA) and confirm whether IP addresses are stored, even temporarily. A vendor that logs IPs “for fraud prevention” and then deletes them still creates a processing obligation under CCPA. Rdyrct’s no-IP-storage design sidesteps that entirely.

This article is general information, not legal advice. Confirm your specific CCPA obligations with a qualified privacy attorney or your compliance team.

Common marketing use cases and best practices to maximize scans and data quality

QR codes perform best when the scan leads to immediate value. The destination should answer the question “why did I scan this?” within two seconds of loading.

High-performing use cases:

  • Restaurant menus and ordering — table tents with dynamic QR codes let you update the menu without reprinting. Scan data shows peak meal times.
  • Event check-ins — a QR on a ticket or badge scanned at entry gives real-time attendance counts and device-type data.
  • Product packaging — a QR linking to a how-to video or warranty registration captures post-purchase engagement that no other channel can measure.
  • OOH and print advertising — a QR on a billboard or direct-mail piece is the only way to measure physical ad reach as a digital signal.
  • Post-purchase surveys — a QR on a receipt or packing slip drives survey completions at the moment of highest engagement.

Design and placement checklist:

  • Minimum size: 2 cm × 2 cm for print; larger for anything viewed from more than arm’s length
  • High contrast between the code and background (dark modules on light background is most reliable)
  • Quiet zone: four modules of white space around all edges
  • Always include a call-to-action label (“Scan to claim your discount”)
  • Test with both iOS and Android before printing
  • For color and branded QR design, follow scannability best practices to avoid contrast failures

Measurement tips:

  • Set a consistent sampling window before launch (e.g., measure week-over-week, not day-over-day, for print campaigns where distribution is gradual).
  • A scan spike on day one followed by a steady baseline usually means the QR is in a high-traffic location. A spike with no tail means the placement was one-time (an event, a social share of the printed piece).
  • Compare device-type ratios across placements. A QR in a tech conference program will skew differently than one on a grocery shelf.
  • Use UTM content tags to distinguish individual placements within the same campaign (e.g., utm_content=shelf_a vs. utm_content=shelf_b).

Key Takeaways

Dynamic QR codes backed by a privacy-first short-link platform are the only reliable way to collect scan analytics, connect them to GA4 via UTM parameters, and stay compliant with U.S. privacy expectations.

Point Details
Dynamic links are required Only dynamic QR codes that redirect through a short link capture scan analytics; static codes collect nothing.
UTM tagging connects scans to outcomes Append UTM parameters to your short link so GA4 attributes scans to the correct campaign, medium, and source.
Privacy-first defaults reduce legal risk Choose a tool that avoids IP storage to simplify CCPA vendor obligations and protect scanner privacy.
Test before printing at scale Verify redirects, UTM capture, and bot filtering on both iOS and Android before committing to a print run.
Rdyrct covers the full workflow Rdyrct provides dynamic short links, branded QR codes, a UTM builder, no-IP analytics, and a free starting tier.

Why privacy-first QR tracking is the smarter long-term bet

Most marketers treat privacy as a compliance checkbox. That framing misses the real advantage. When you build your measurement stack on tools that avoid IP storage and persistent identifiers from the start, you are not just reducing legal exposure under CCPA. You are also future-proofing your analytics against the browser and OS changes that keep breaking cookie-dependent measurement.

QR codes are one of the few physical-to-digital channels where privacy-first tracking does not require a tradeoff. You get country, device, referrer, and scan count without ever touching a personal identifier. That is genuinely useful signal, and it is signal that survives every privacy update Apple or Google ships. The marketers who figure this out early will not scramble to rebuild their attribution models every time a platform changes its data policies.

The trend toward cookieless analytics is not a future problem. It is already reshaping how campaigns are measured, and QR tracking with aggregate-only data is one of the cleanest implementations of that model available today. The tools that enforce data minimization by design, rather than by configuration, are the ones worth building on.

Rdyrct gives you trackable QR codes with privacy built in

If you have read this far, you know what a production-ready QR tracking setup looks like: dynamic short links, branded QR codes, UTM builder, real-time analytics, bot filtering, and no IP storage. Rdyrct delivers all of that in a single platform, with a free tier that lets you test the full workflow before committing to a paid plan.

Rdyrct

Getting started takes about five minutes. Create an account at rdyrct.com, build a branded short link with UTM parameters, generate a QR code, and scan it from your phone. The live click feed updates immediately. For teams with strict data-sovereignty requirements, Rdyrct is also available as open-source self-hosted software on Cloudflare, giving you full infrastructure control without rebuilding the analytics layer from scratch.

Start on the free plan, run a real campaign, and upgrade when the data tells you to.

Authoritative sources and further reading

The sources below are worth bookmarking for implementation details and ongoing reference:

  • What are UTM parameters? (guide)
  • What is brand awareness? (Qualtrics)
  • QRCode-AI on Product Hunt
  • rdyrct — Short links that carry your brand
  • Dynamic QR Codes: Create, Track, and Update Them