QR codes in municipalities and public authorities: Data protection without tracking

Many QR code providers advertise detailed analytics: location, device, time, and repeat visitors. That might be interesting for an advertising corporation. But a municipality, a school, or an office wants to provide information to citizens without profiling them. That is why it is worth looking at what is actually stored when a QR code is scanned.

What technically happens when you scan

A dynamic QR code contains a short address on Same-QR. When you scan it, your phone loads this address, and Same-QR redirects you to the destination. As with any website visit, the IP address technically reaches the server; otherwise, no response could be sent back. The requests run through Cloudflare as a front-end network service. The data privacy policy of Same-QR lists the involved service providers.

What Same-QR stores

• For each QR code, a number: how often it was scanned
• For 60 seconds, a salted hash of the connection, so that a hesitant phone does not count twice; after that, it is gone
• In the Free plan, additionally the number of scans per account and month

What Same-QR does not store

• The IP address
• the time of the scan
• device, operating system, and browser
• the location

Therefore, there is no analysis by person, day, or location, not even for you as a customer. You only see the total count per QR code. For a public authority, this is sufficient to determine whether a notice is being used.

No cookies, no advertising

No ads are displayed when scanning, in any plan. Pages you build directly in Same-QR, such as “Opening hours & directions” or “All links”, set no cookies, load nothing from external servers, and count views without re-identification.

The destination page is the crucial part

After the redirect, the user lands on your destination. Whether cookies, analytics tools, or forms on that page collect personal data is governed by that page’s privacy policy. A QR code linking to a municipal website with analytics tools is therefore as data-efficient as the website itself. In case of doubt, consult your data protection officer; this article is not legal advice.

Practical rules for public authorities

• Link to your own pages or to pages of public partners, not to platforms with advertising.
• Write next to the code where it leads, e.g., “Waste calendar on gemeinde.at”.
• Use a separate code for each notice; then the total number of scans is sufficient for evaluation.
• After a relaunch, check whether all goals are still correct and update them in the dashboard.

Conclusion

QR codes and data protection are compatible when the provider stores little data and the destination page is clean. With Same-QR, only a number is stored per code: no IP address, no device, no location. You can start for free on sameqr.com and try it out with a single code.

Frequently asked questions