rdyrct
Dashboard
← All articles

Set utm_medium=qr Every Time: GA4 Safe UTM Workflow for Marketers

Yes, add UTM parameters to the URL inside a QR code, and lean on a dynamic QR workflow so every scan is attributable and editable. Use utm_source, utm_medium, and utm_campaign at minimum, keep every value lowercase, and generate the code from that tagged link rather than the bare destination URL. Do that, and a printed flyer becomes as measurable as any paid ad.

TL;DR:

  • Using UTM parameters in QR code URLs ensures accurate campaign attribution and distinguishes traffic sources like posters, packaging, or events.
  • Dynamic QR codes are recommended for longer campaigns since they allow updates to the destination link without reprinting, unlike static codes.
  • Building consistent, lowercase, hyphenated UTMs and verifying scans in GA4’s DebugView reduces data loss and misclassification in analytics reports.
  • Proper channel configuration in GA4, such as creating custom rules for medium qr, prevents QR traffic from defaulting to unassigned or direct categories.
  • Thorough testing of QR codes before printing confirms that UTMs are correctly embedded and that all tracking will function as intended during actual scanning.

Table of Contents

What Is UTM Tracking for QR Codes, and Why Does It Matter?

A QR code is just a picture of a URL. Scan it, and the phone’s camera opens whatever link is baked into the code, with zero context about where the scan happened. No referrer header, no campaign name, nothing. That’s the core problem with offline media: a billboard and a coffee cup sleeve both dump traffic into Google Analytics looking identical, usually labeled “Direct.”

UTM parameters fix that by embedding the source, medium, and campaign name directly in the query string. GA4 reads those tags and buckets sessions accordingly, which means the flyer at a trade show and the QR code on your product packaging finally show up as two separate lines in a report instead of one anonymous blob.

Here’s what a properly tagged URL looks like before it ever touches a QR generator:

https://rdyrct.com/promo?utm_source=flyer&utm_medium=qr&utm_campaign=spring-launch

  • The domain and path stay untouched.
  • Everything after the ? is the tracking layer, invisible to the visitor but fully visible to your analytics.
  • Change any parameter and you change how that scan gets categorized, without touching the destination page itself.

How to Build a GA4-Safe UTM URL for Your QR Code

Building the URL is the easy part. Doing it consistently across every printed piece is where most campaigns fall apart.

  1. Start with the final destination page — the landing page, product page, or menu you actually want people to hit after scanning.
  2. Add utm_source to identify the placement type: poster, packaging, business-card, event-banner.
  3. Add utm_medium and set it to qr every single time. Consistency here is what saves your GA4 reports later.
  4. Add utm_campaign with the initiative name: spring-launch, black-friday-2026, store-opening-denver.
  5. Add optional fields if you need finer detail: utm_content for the specific asset version, utm_term if you’re testing messaging variants, or utm_id when you’re syncing with an ad platform’s own campaign IDs, per Google’s own Campaign URL Builder documentation.
  6. Generate the QR code from the finished, tagged URL — never from the raw destination link.

Two rules matter more than the rest combined:

  • Lowercase everything, always. GA4 treats QR and qr as two different mediums.
  • Use hyphens or underscores instead of spaces, and pick one and stick with it.

For bulk campaigns, build your list in a spreadsheet first, run it through Google’s Campaign URL Builder or a similar tool, then batch-generate the codes from that finished CSV.

Static or Dynamic QR Codes: Which One Should You Print?

Static QR codes bake the entire URL, UTMs included, permanently into the code’s pixel pattern. Change your mind about the campaign name after 5,000 posters are already printed, and you’re reprinting 5,000 posters.

Dynamic QR codes solve that by pointing to a short redirect link you control. The printed code never changes, but the destination behind it does, which means you can fix a typo in a UTM parameter, swap the landing page, or redirect the whole campaign to a new offer without touching a single printed piece. That flexibility is exactly why dynamic QR codes are the standard recommendation for any campaign with a print run longer than a weekend.

A few things to check before you send a QR code to print:

  • Export at high resolution: SVG for anything that will be scaled or printed large, PNG for digital use.
  • Keep the quiet zone (the white border around the code) intact. Cropping it too tight breaks scanning on older phones.
  • Test contrast. A QR code printed in light gray on white looks sleek and scans terribly.
  • Never place a QR code over a busy background image without a solid color block behind it.

Pro Tip: Give every printed placement its own dynamic QR code, even when they all point to the same campaign. That way you can tell which physical location or asset actually drove the scan, instead of lumping a store window and a mailer under one identical code.

Why Does GA4 Show QR Traffic as “Unassigned”?

This is the pitfall that trips up almost every marketer running a first QR campaign, and it’s rarely the UTMs themselves that are broken.

GA4 assigns sessions to channels using a rules-based system called channel grouping. If your utm_medium value doesn’t match any rule in that system, GA4 dumps the session into a catch-all bucket called Unassigned, even though the UTM data is sitting right there in the raw event parameters. QR scans that skip UTMs entirely just show up as Direct traffic, which is arguably worse: at least Unassigned tells you something is tagged.

Two fixes, depending on how much control you have over the GA4 property:

  1. Build a custom channel group. Duplicate GA4’s default channel group, add a new channel named something like “QR / Print,” and set its condition to match sessions exactly where medium equals qr. Reorder it above Unassigned in the rule list, and every properly tagged scan now lands in its own reportable channel instead of getting swallowed.
  2. If you can’t touch channel groups, fall back to a GA4-recognized medium value like referral alongside a clearly named utm_source, and treat the loss of a dedicated “QR” label as an acceptable trade for cleaner default reporting. Test either approach in DebugView before you commit to a print run, so you can watch a live scan populate source, medium, and campaign fields correctly.

Marketers who skip this step tend to discover the problem weeks into a campaign, once someone finally asks why the QR traffic “isn’t showing up anywhere.”

Pro Tip: Set utm_medium=qr on every single QR campaign you run, forever. Once you’ve built the custom channel group once, every future campaign benefits automatically. Changing the medium value mid year just recreates the same mess with a different name.

Naming Conventions and UTM Templates for QR Campaigns

Consistent naming is what separates a GA4 report you can actually filter from one that’s a graveyard of one off values. Lowercase, hyphenated naming prevents the kind of fragmented reporting where “Spring-Launch” and “spring launch” and “springlaunch” all show up as three unrelated campaigns.

A simple role structure keeps everything sortable: utm_source describes the placement type, utm_medium stays fixed at qr, utm_campaign names the initiative, and utm_content distinguishes between asset versions when you’re running the same campaign across multiple physical formats.

Six placements, six ready-to-copy patterns:

  • Poster: utm_source=poster&utm_medium=qr&utm_campaign=fall-sale&utm_content=main-street
  • Packaging: utm_source=packaging&utm_medium=qr&utm_campaign=product-launch&utm_content=box-insert
  • Table card: utm_source=table-card&utm_medium=qr&utm_campaign=happy-hour&utm_content=v2
  • Event banner: utm_source=event-banner&utm_medium=qr&utm_campaign=trade-show-2026&utm_content=booth-12
  • Business card: utm_source=business-card&utm_medium=qr&utm_campaign=networking&utm_content=andrea
  • In-store POS: utm_source=pos&utm_medium=qr&utm_campaign=checkout-promo&utm_content=register-3

Test and Verify Before (and After) You Print

Printing a QR code that leads nowhere useful is a wasted print run. Verify it in two passes: before it goes to the printer, and again once it’s out in the world.

  1. Scan the code on at least two different phones, one Android and one iOS, on both Wi-Fi and cellular data. Confirm the URL that opens still has every UTM parameter intact, since some redirect chains and shorteners silently strip query strings along the way.
  2. Open GA4’s real-time report or DebugView and confirm the session’s source, medium, and campaign match exactly what you set. This is the moment to catch a typo before it’s baked into 10,000 printed units.
  3. If you’re distributing at scale, batch test a sample of the actual codes rather than just the master link, since a printing or export error can corrupt individual codes without affecting others.
  4. If a CRM or ad pixel also needs to fire on that landing page, confirm it captures correctly during the same test scan rather than assuming the UTM tracking and pixel tracking are equally reliable.

Rdyrct’s Take on Running This Workflow in Practice

Some link and QR code platforms run on the workflow described above, because there isn’t a shortcut version that actually holds up in GA4. Branded short links can accept a fully tagged UTM URL as their destination, and QR codes generated from those links can be dynamic by default, so a campaign name typo or a landing page swap never requires a reprint.

  • Short links can carry utm_source, utm_medium, and utm_campaign values directly, matching the naming conventions covered above.
  • QR codes generated from those links can have their underlying destination changed after printing, which matters most for anyone running a multi-location or multi-quarter print campaign.
  • Analytics on the back end can break down by country, referrer, and device without logging visitor IP addresses, helping keep campaign reporting useful without collecting more personal data than the marketing question requires.

Analyzing UTM Data From QR Scans in Google Analytics

Once the tagging and channel setup are solid, the actual analysis happens in GA4’s Traffic Acquisition report, filtered by session source/medium. Pull up that report, filter for medium: qr, and you’ll see every campaign broken out by the utm_campaign values you assigned, each with its own sessions, engagement rate, and conversion counts.

The comparison that actually matters is rarely “did the QR code get scanned.” It’s whether QR-driven sessions convert at a rate comparable to your other channels. A poster that generates 400 scans but a 2% landing page conversion rate is a worse investment than a table card generating 60 scans at 18%, even though the raw scan count looks less impressive on a slide.

Cross-reference utm_content values within the same campaign to see which physical placement or version actually pulled its weight. If “poster A” and “poster B” both point to identical offers but one was placed near the entrance and one near the register, the utm_content split tells you which location earns real estate next quarter.

One thing to watch for: GA4’s default lookback window and attribution model can undercount QR-driven conversions that happen days after the scan, particularly for higher-consideration purchases. If someone scans a QR code in a store, then converts online three days later from a different device, session-based UTM tracking may miss that connection entirely unless the person logs into an account that bridges the two visits. That’s a limitation of last-touch analytics generally, not something unique to QR campaigns, but it matters more here because the scan and the conversion are so often physically separated by both time and device.

Where to Place QR Codes With UTMs for Best Results

Placement decisions should come before you finalize your utm_source naming scheme, not after, since the physical location is exactly what that field is meant to describe.

Give the code room to breathe. A QR code smaller than roughly one inch square struggles under poor lighting or on a phone camera held at an angle, and cramming it into a corner with three other logos guarantees some people won’t bother. Put it somewhere a person is already standing still: next to a register, on a table tent, at eye level near an entrance, rather than on a moving vehicle or somewhere a scan requires awkward positioning.

Always pair the code with a short, human line explaining what happens after the scan. “Scan for 10% off your next order” converts scans into intent far better than a bare code with no context, and it also filters out accidental scans that would otherwise muddy your session data with people who had no interest in the offer.

Distance matters more than most marketers assume. A code meant to be scanned from across a room (a stage backdrop, a highway billboard) needs a much lower information density and larger overall size than one meant for close range, like a menu or receipt. If a code will be scanned outdoors, test it in direct sunlight glare before finalizing the print, since glossy paper and bright light are a common combination that renders an otherwise fine QR code unreadable.

Privacy Considerations When Tagging QR Codes With UTMs

UTM parameters themselves are not personal data. They describe a campaign, not a person: utm_source=poster says nothing about who scanned it. That distinction matters because it means marketers can get rich campaign attribution without touching anything that resembles individually identifiable tracking.

Where privacy questions actually enter the picture is downstream, in whatever analytics platform receives that tagged session. Some platforms log full IP addresses alongside every UTM-tagged visit, which turns an anonymous campaign metric into something that can, in combination with other data, identify an individual visitor. That’s a meaningfully different privacy posture than a platform that reports aggregate country and device data without retaining the IP itself.

For marketers running QR campaigns in physical locations, especially retail, healthcare, or anywhere foot traffic could be considered sensitive, it’s worth checking exactly what your analytics stack retains before you print a single code. A UTM-tagged link dropped into a general-purpose shortener may quietly log more than the marketing team ever intended to collect, simply because IP logging is the platform’s default behavior rather than a deliberate choice anyone made.

None of this means UTM tracking requires a consent banner or special disclosure in most jurisdictions, since the tags themselves aren’t personal identifiers. But if your broader analytics setup does combine UTM data with IP addresses, device fingerprinting, or account level identity, that combination is what triggers privacy obligations, not the UTM parameters on their own.

Common Mistakes That Wreck QR Campaign Tracking

The same handful of errors show up in almost every broken QR campaign audit, and every one of them is preventable with a five-minute check before print.

Generating the QR code from the untagged URL. This is the single most common mistake: someone builds the perfect UTM string, then accidentally copies the plain destination link into the QR generator instead. The code scans fine. It just never carries any tracking data at all.

Inconsistent capitalization across placements. utm_medium=QR on one poster and utm_medium=qr on another splits identical traffic into two separate GA4 rows, quietly understating your real campaign performance.

Reusing the same utm_campaign value across unrelated initiatives. This flattens two different campaigns into one line item, making it impossible to tell which one actually drove results.

Printing static codes for campaigns likely to change. Anything with a seasonal offer, a promo code, or a landing page still in flux belongs on a dynamic QR code, not a static one baked permanently into the printed pattern.

Skipping the DebugView test. A code that scans and opens a page looks successful. Whether GA4 actually parsed the source, medium, and campaign correctly is a separate question that only shows up once you check.

Letting a redirect strip the query string. Some link shorteners and intermediate redirects drop everything after the ? during the hop. Always verify the final landing URL still carries every tag intact.

Why “It Scanned Fine” Is the Wrong Success Metric

The biggest misconception I see in QR campaign postmortems is treating a working scan as proof the tracking worked. Those are two entirely different questions, and conflating them is why so many marketers end a campaign with a pile of printed material and no usable data to show for it.

The conventional advice on this topic stops at “add UTMs and generate a QR code,” which is true but incomplete. The part that actually determines whether your GA4 report is usable six weeks later is the channel grouping work: deciding in advance how utm_medium=qr will be categorized, and confirming it in DebugView before a single poster goes up. Skip that step, and you’ll spend a campaign retrospective explaining why half your scans vanished into Unassigned instead of showing results.

If there’s one thing to prioritize first, it’s naming discipline before creative execution. Lock the utm_source, utm_medium, and utm_campaign structure before anyone designs a single poster. Retrofitting consistent tracking onto a campaign that’s already printed is far harder than building it in from the first draft.

— Andrea

Put This Into Practice With Rdyrct’s Free QR Tools

Building the UTM URL and generating the code doesn’t have to be two separate tools and a copy-paste step. With Rdyrct, you create a branded short link carrying your full UTM string, generate a dynamic QR code from that link in one pass, and if the campaign name or landing page needs to change after the poster is already on the wall, you edit the destination and every printed code updates instantly.

The privacy angle matters here too: Rdyrct’s analytics break scans down by country, referrer, and device without storing visitor IP addresses, so you get real campaign performance data without collecting more than the analysis actually calls for. That’s a meaningfully different setup than a general-purpose shortener that logs everything by default.

Start with the free QR code generator to build your first UTM-tagged dynamic code with no account required, and check the pricing page when you’re ready to add custom domains and extended analytics history for ongoing campaigns.