QR Codes and GDPR: What a Dynamic QR Code Learns About the People Who Scan It

What happens technically when someone scans

A dynamic QR code contains a short address at Same-QR. When someone scans it, their phone calls this address, and Same-QR redirects to the destination or shows the destination page. As with any web request, the phone’s IP address technically arrives at the servers – without it, the response could not be sent back.

Requests pass through Cloudflare as an upstream network service, which sees the IP address in the process. Which service providers are involved and what they process is described in Same-QR’s privacy policy.

What Same-QR stores – and what it doesn’t

For each QR code, a single number is stored: how often it has been scanned. So that the same person is not counted several times when the camera hesitates, Same-QR keeps a salted hash of the internet connection for 60 seconds – not the IP address itself. After that, the hash is gone too. For wine e-labels, even this hash is skipped and the count simply goes up. On the free plan, Same-QR also counts scans per account and calendar month to check the 100 included scans – again only as a number.

Not stored: the IP address, the time of the scan, the device, the browser and the location. As a customer, you therefore don’t see any such data either – only the total per QR code. There is no breakdown by day, hour or person.

The destination page is your responsibility

After the scan, the person lands on your destination – your website, a form, an online shop. What data is collected there, for example through cookies, analytics tools or contact forms, depends on that page and its privacy policy, not on Same-QR. If you analyze visitors from the QR code with UTM parameters, that happens in your own analytics tool and under its rules.

If you create the destination page directly in Same-QR, such as a menu or opening hours, that page sets no cookie, loads nothing from third-party servers and counts views without recognizing visitors.

Do I need a privacy notice next to the QR code?

For the scan itself, Same-QR stores no data that could identify people. Whether you need a notice therefore depends mainly on what your destination page does. If it collects personal data, the notice belongs where the data is collected. If in doubt, check with your data protection advisor – this article is not legal advice.

• Same-QR stores only the number of scans per QR code.
• No IP address, no time, no device, no location – only a salted hash for 60 seconds to avoid double counting.
• Same-QR’s privacy policy lists the service providers involved.
• What happens on your destination page is governed by its privacy policy.
• Pages created directly in Same-QR set no cookie.

Frequently asked questions