Does a QR code collect your data? What the GDPR says

Scanning a QR code is clicking a link

The starting point is more reassuring than people assume: a QR code collects nothing. It is an image containing text, usually a web address. It has no memory, no connection and no ability to observe. Everything that can be collected is collected by the page that opens next — exactly as if you had typed the address by hand.

So the right question is not “what does this QR code collect?” but “what does the site it leads to collect?”. And the answer is the same as for any other page on the web.

What a scan reveals — and what it does not

When a QR code is dynamic, your phone goes through a relay before reaching its destination. That relay sees an ordinary web request go by, with the information a browser always sends.

What is observable is therefore modest, and above all: none of it identifies you. A scan counter knows a visitor came by, not which one. It knows neither your name, nor your email, nor your number, and it cannot follow you from one site to another.

Static or dynamic: only the second can count

The technical distinction has a direct consequence for privacy. With a static QR, the address is encoded in the pattern: your phone opens the page with no intermediary. Nobody, not even whoever created the code, knows a scan took place.

With a dynamic QR, the relay sees every scan go by, and that is precisely what lets a business know whether its poster works. The trade-off is easy to state: dynamic exchanges a little measurement for a lot of flexibility. And that measurement is about visits, not about people.

What the GDPR says, in plain language

The General Data Protection Regulation, applicable across the European Union since 25 May 2018, governs the processing of personal data — that is, any information relating to an identified or identifiable person. Four principles are enough to understand what applies to QR codes.

• Minimisation: collect only what is necessary for the stated purpose. Counting scans does not require knowing who scans.
• Legal basis: every processing operation needs a foundation — consent, but also legitimate interest, which generally suffices for simple, non-intrusive audience measurement.
• Transparency: people must be able to find out what is collected and why, through an accessible privacy policy.
• Storage limitation: data is not kept indefinitely; a retention period must be defined, and actually applied.

One point is worth knowing: an IP address counts as personal data, including when it is dynamic, as soon as cross-referencing could identify the person. The Court of Justice of the European Union established this in its Breyer ruling of October 2016. In practice, a service storing visitors' IP addresses in the clear is processing personal data, with all the obligations that follow.

The role of the IP address, and why hashing changes everything

To count scans without counting the same visitor twice, a service needs a marker. The IP address is the most obvious one — and the most problematic, since it is personal data.

A solution exists, and it is technical rather than contractual: never store the IP itself, only its fingerprint. You apply a hash function (SHA-256) to the address, combined with a secret salt, and keep only the result — a string from which the original address cannot be recovered. Rotating that salt every month even prevents linking visits from one month to the next.

The point is that this is not a promise but a property: even if the database leaked, there would be no IP address to leak. It is data protection by design, written into Article 25 of the GDPR, applied literally. That is the choice QRyx made: IP addresses are never written in the clear.

Do you need a cookie banner for a QR code?

This is the most frequent question from businesses, and the answer is more nuanced than yes or no. The banner does not come directly from the GDPR but from the ePrivacy directive — in France, Article 82 of the Data Protection Act. That text targets a specific operation: storing or reading information on the visitor's device.

In other words, what triggers the consent requirement is the cookie or tracker placed on the phone — not server-side measurement. A scan counter that writes nothing on the visitor's device therefore falls outside that requirement. On the other hand, as soon as a third-party analytics tool sets an identifier, or an advertising pixel sits on the destination page, the banner becomes necessary again.

France's data protection authority also allows an exemption for strictly necessary audience-measurement trackers, under conditions: a purpose limited to statistics, no cross-referencing with other processing, no cross-site tracking, and proportionate retention. This is the path cookieless analytics follow.

For businesses: your obligations in practice

If you display QR codes and measure scans, you are the data controller for that measurement, and your provider is your processor. That implies a few concrete steps, none of them heavy:

1. Mention scan measurement in your privacy policy, with its purpose and its retention period.
2. Record the processing in your register — required even for a small organisation, and it fits in a few lines.
3. Sign a processing agreement with your provider: that is Article 28 of the GDPR, and a serious service hands it over without being asked.
4. Check where the data is hosted. Hosting within the European Union avoids having to justify an international transfer.
5. Do not link scans to identifying data (name, email) without a clear legal basis and proper information for the people concerned.

The right questions to ask a provider

Not all dynamic QR solutions are equal on this ground. Five questions settle it quickly, and their answers should be public:

• Are IP addresses stored in the clear? If so, walk away; if they are hashed, ask with which algorithm and whether the salt is rotated.
• Where is the data hosted? European hosting avoids a whole layer of formalities.
• Are cookies or trackers placed on the visitor's device? The answer determines whether you need a banner.
• How long is scan data retained, and what happens afterwards?
• Is an Article 28-compliant processing agreement provided, and available without having to ask?

A provider that answers these five questions clearly, with documentation to back it up, saves you far more time than one euro of difference on the monthly subscription.