How to Track QR Code: Scans, Sources, and Conversions

You printed 500 posters. The QR code sits in the bottom right corner. Three weeks later someone asks how the campaign performed, and you have nothing to show them.

This is the normal state of offline campaigns. The code works, people scan it, and none of it appears anywhere you can see.

The fix starts with changing how you think about the problem. To track a QR code, you do not track the code itself. You track the link behind it by encoding a short link that routes each scan through a redirect server, which logs the scan before forwarding the visitor to your destination. The printed square is inert. It never reports anything and has no idea it was scanned.

QR codes are worth measuring properly. A US Census Bureau working paper found that 89 million people in the United States used QR codes in 2022.

For marketers, ecommerce brands, agencies, freelancers, creators, and businesses using QR codes and branded links across print, packaging, retail, events, and other campaigns, that missing scan data creates a real attribution gap between offline touchpoints and online results.

Short answer: you track a QR code by encoding a short link that routes each scan through a redirect server. That server logs the scan, then forwards the visitor to your destination. Add UTM parameters to see the traffic in Google Analytics, and install a tracking pixel to measure what happens after the scan.

This guide covers how scan tracking works, how to set it up in five steps, how to read the data in GA4, what the numbers can and cannot tell you, how to connect scans to actual conversions, how to manage multiple codes, and how to automate tracking at scale.

What it actually means to track a QR code

Tracking a QR code means logging the web request that fires when the encoded URL opens. The data comes from a server, never from the code itself.

What happens the moment someone scans

The sequence is short and worth knowing precisely, because every limitation later in this article traces back to it.

1. The camera decodes the black and white pattern into a text string.

2. The phone opens that string as a URL.

3. If the string points at a redirect service, the request hits that server first. The server reads the IP address and user agent from the request headers, writes a scan record, and returns a 301 or 302 redirect.

4. The browser follows the redirect to your destination.

5. The destination page loads and fires whatever tags are installed on it.

Everything you learn about a scan comes from step three and step five. The printed code contributes nothing beyond the string it holds. That is why a QR code you generated on a free tool three years ago cannot be tracked retroactively. There was no server in the path to record anything.

The two data layers

Scan tracking produces two separate datasets, and confusing them causes most reporting arguments.

These two layers answer different questions. Redirect data tells you the code was scanned. Page data tells you what the person did next. You want both, and most guides treat them as competing options rather than complementary ones.

Static vs dynamic QR codes, and what most guides get wrong

Nearly every article on this topic states that static QR codes cannot be tracked and dynamic ones can. That framing is imprecise enough to mislead you.

Why the usual explanation falls apart

A QR code encodes a string. Whether you can track it depends entirely on what that string points at.

A code encoding a raw destination URL such as https://yourshop.com/spring-sale has no server in the path. Nothing gets logged. This is genuinely untrackable at the scan layer, and it is what people mean when they say static codes cannot be tracked.

A code encoding a short link routes every scan through a redirect server. Every scan is logged. The printed pattern never changes, and yet the tracking works perfectly.

The real dividing line is redirect or no redirect

Reframe the distinction and it becomes obvious. What vendors sell as a "dynamic QR code" is a fixed pattern encoding a short redirect link they control. The image is as static as any other. The infrastructure behind it is what makes it dynamic.

This matters for a practical reason. If you understand that the code points at a link rather than a destination, you understand why you can change the destination later without reprinting anything.

In ShortPen, every QR code is dynamic by default. The code encodes your branded link, meaning your domain plus the slug, rather than the long destination URL. Change where that link points and the printed poster keeps working.

What QR code analytics can actually tell you

A scan produces a small set of data points read from the HTTP request: a timestamp, an IP-derived location, the device, the operating system, the browser, and the referrer where one exists.

Why scans and clicks belong in separate columns

Here is a problem most platforms handle badly. The same short link often lives in two places at once: printed on a table tent and pasted into an email newsletter. If the platform counts both interactions as generic "clicks," you cannot tell which channel drove the traffic.

ShortPen logs a scan separately from a click on the same link, with totals and uniques for each, and unique scans help estimate new users interacting with the code.

Link analytics break that traffic down by source (both referrer domain and the exact referring URL), country, browser language, device type, browser, operating system, UTM parameters, and timeframe by day or hour.

Reading one link against the whole workspace

Single-link analytics answer questions about one campaign asset. Workspace analytics help you analyze campaign performance across many links.

If you are running a product launch with a landing page link, three regional QR codes, and a partner link, the workspace view aggregates them, and folders and tags let you filter down to just the QR placements to determine which placement drove the most engagement.

That segmentation is what makes multi-placement comparison practical rather than a spreadsheet exercise.

Unlimited links, unlimited QR codes, and unlimited tracked clicks are included on the ShortPen free plan, so you can build this structure before deciding whether you need a paid tier.

How to set up QR code tracking, step by step

Five steps, in order. The order matters more than people expect, because two of these steps cannot be redone after printing.

Step 1: Create the trackable short link first

The link comes before the code. Decide the destination, the domain, and the slug now.

Use a branded domain if you have one. On most phones the URL preview appears before the user taps through, and a recognisable domain does better than a generic shortener string. Connecting a custom domain is available on the ShortPen free plan.

Step 2: Add UTM parameters to the destination

Tag the destination URL before you generate the code. Adding UTMs afterwards means regenerating and reprinting.

One warning worth taking seriously: never run an already-tagged URL through a second generic shortener. Many of them drop the query string, which silently strips your UTM parameters and leaves you wondering why GA4 reports everything as direct traffic.

Step 3: Generate and customise the code

Design decisions here directly affect how many scans you get, so once the destination URL is ready, use a qr code generator to create the code.

The specifications that matter, and that most features let you customize for branding and readability:

• Size: minimum physical size is roughly the viewing distance divided by 10. A poster viewed from two metres needs a code around 20cm. A flyer held at 30cm needs 2.5 to 3cm.

• Quiet zone: leave a blank margin of at least four modules around the whole code. Printers often auto-scale artwork, so check this survives in the final proof.

• Contrast: dark code on a light background. Inverse works but fails more often under glare.

• Format: SVG for print, PNG or JPG for digital use. Export raster files at 300 DPI or higher.

• Logos: keep any centre logo to 15 to 20 percent of the code area and clear of the three large finder squares.

Step 4: Test before you print

This is the step video tutorials demonstrate and written guides compress into a single line, and it is where campaigns break.

Scan the code with more than one phone, on the actual material you are printing on. Matte stock reads more reliably than glossy under bright light. Then confirm the scan registered, and start tracking in the real-time analytics view before printing.

ShortPen shows clicks, scans, and tracked events in real time, so verification takes seconds rather than waiting for a reporting delay.

Step 5: Read the analytics

Open the link, pick a date range, and start with the timeframe view to see when scans cluster. Scan volume for offline campaigns tends to spike within hours of a placement going live and then settle into a long tail.

How to track QR codes in Google Analytics 4

GA4 has no built-in QR channel. A camera scan carries no referrer, so without UTM parameters, Google Analytics has no way to know the visit came from your poster.

UTM conventions for QR campaigns

There is genuine disagreement about what belongs in utm_medium, and it is worth understanding before you commit.

Option one: treat QR as the channel. Set utm_medium=qr, put the placement in utm_source. This isolates all QR traffic in one row regardless of where the codes are printed.

Option two: treat print as the channel. Set utm_medium=print or packaging, put the specific publication in utm_source. Analytics Mania recommends this approach, which groups offline media together.

Either works. Consistency matters more than the choice. Most teams find option one easier to read, because QR then behaves like any other channel next to email and paid social.

A tagged URL for a spring campaign looks like this:

That structure makes each qr code campaign easier to compare inside Google Analytics and across marketing campaigns, and consistent tagging helps optimize your broader marketing strategy.

Use lowercase and underscores throughout. GA4 treats QR and qr as different values, which fragments your reporting.

Where the data appears

Go to Reports, then Acquisition, then Traffic acquisition, and switch the primary dimension to Session medium. Your QR traffic appears as its own row.

Once enough traffic is collected, these GA4 reports can surface valuable insights and broader insights. The website must load successfully for those visits to appear in GA4 reports.

Verify in the Realtime report or DebugView first by scanning the code yourself. Processed reports take 24 to 48 hours, so an empty report on launch day means nothing.

Why QR traffic shows as direct in GA4

Seeing (direct)/(none) where your campaign should be usually has one of four causes:

1. The destination URL was never tagged with UTM parameters.

2. A second shortener stripped the query string.

3. The visitor arrived through an in-app browser that blocked the parameters.

4. The link points to HTTP and redirects to HTTPS, dropping data in transit.

ShortPen reports UTM breakdowns by source, medium, campaign, content, and term on the link itself. That gives you scan attribution immediately, independent of whether GA4 has finished processing.

The limits of QR scan data

Every platform reports these numbers with more confidence than the underlying data deserves. Knowing where the soft edges are prevents you from making decisions the data cannot support.

Unique scans are an estimate

Deduplication relies on IP address combined with user agent. Two consequences follow. A conference hall where 200 people share one Wi-Fi network collapses many scanners into far fewer uniques. The same person scanning on cellular data and again on Wi-Fi counts twice.

Treat unique scans as a directional estimate of reach rather than a headcount.

Location is IP-based and approximate

Scan location comes from the IP address, which resolves to the internet provider's registered location rather than the person's actual position. City-level accuracy is the realistic ceiling, and it is frequently wrong. VPNs and privacy relays move the apparent location entirely.

ShortPen labels these cases rather than guessing. Traffic with no resolvable location appears as "Unknown" instead of being assigned to a country that may be wrong.

In-app browsers distort device data

Scans opened inside Instagram, TikTok, or a messaging app report non-standard user agents, which can also distort operating-system reporting on iOS and Android. A large "Other" share in your browser table usually means in-app traffic rather than an exotic browser. Similarly, missing referrer data shows up as "Direct" in source reports.

What this means in practice

Use scan data for relative comparison and data-driven decisions, not exact measurement. Poster A against poster B, this week against last week, one city against another. Those comparisons hold because the same measurement error applies to both sides. Absolute precision does not hold, and no platform can give it to you, though these metrics are still useful when interpreted with the same margin of error across comparisons.

From scans to conversions: tracking what happens next

Scan counts on their own are a vanity metric. A window decal with 4,000 scans and no signups lost to a table tent with 300 scans and 40 signups.

Connecting a scan to a real action

To measure outcomes you need something on the destination page that reports back and ties the action to the original link, so conversion tracking helps analyze qr code performance rather than stopping at scan counts.

With ShortPen you install the ShortPen Pixel once on your site, enable event tracking on the link, then create events from the dashboard to see how your audience interacts after the scan. Two types cover most cases:

• URL-triggered events fire when someone reaches a specific page, such as a thank-you page or order confirmation screen.

• Code-triggered events fire on a specific action, such as a form submission or button click.

If you run Shopify, the ShortPen app installs the pixel automatically and maps e-commerce events like add-to-cart and purchase without custom work.

Each event reports a count and a conversion rate calculated against clicks and scans, visible at link level and workspace level. That turns "the poster got 4,000 scans" into "the poster produced 62 signups at a 1.6 percent conversion rate," which makes it easier to drive engagement improvements and monitor conversion rates more clearly.

Two constraints worth knowing. Without the pixel you still get clicks and scans, but no events or conversions. And events are not retroactive, so the setup has to happen before the campaign launches. The free plan includes event tracking with a monthly cap of 100 events, and paid plans come with a 14-day trial.

Test the pixel before launch

Use the Event Testing Panel to confirm your events fire correctly. Finding a broken pixel after 10,000 flyers are in circulation is an expensive way to learn this lesson.

Tracking multiple QR codes across placements

One code across every placement gives you one number and no insight. Separate codes give you a comparison.

One code per placement

Take a single offer running in four places: a window decal, a table tent, a receipt footer, and a packaging insert. Four separate links, four separate QR codes.

That matters even more in print campaigns where the same creative shows up in multiple physical placements. Now the data answers which placement earns its production cost.

In ShortPen each QR code belongs to one link, so separate placements mean separate links. Duplicating an existing link gives you a fresh set of analytics with the same settings, which makes A/B tests quick to spin up.

Separate links also let you compare the number of scans for each placement instead of collapsing everything into one total.

Organising the comparison

Folders and tags segment workspace analytics. Tag all four codes with the same campaign tag and you can view them as a group or drill into any one of them without rebuilding filters.

Changing the destination after printing

Editing the destination URL does not reset analytics for trackable QR codes. Your scan history stays attached to the link, so you can point a printed code at a new landing page mid-campaign, which is useful for a time-sensitive promotion, and keep the full record.

One change does break a printed code: editing the slug or switching the domain. That is what the QR encodes, so a new pattern is required. Download a fresh code and reprint. Plan slugs carefully for anything with a long shelf life like packaging or signage.

Automating QR tracking at scale

Manual creation stops working somewhere around the fiftieth code. Store-level codes across 200 locations, per-attendee event badges, and per-batch packaging inserts all need bulk generation.

The ShortPen REST API creates and edits links programmatically and retrieves click analytics, with webhooks for pushing events into other systems as they happen. Native integrations with Zapier, Make, and viaSocket cover the same workflows without code. Full API access is a paid-plan feature.

Frequently asked questions

Can you track a static QR code?

It depends what the code encodes. If it encodes a raw destination URL, no, because there is no server in the path to log anything. If it encodes a short link, then yes, every scan is tracked even though the printed pattern never changes. The distinction is whether a redirect happens, not whether the image is labelled static or dynamic.

How do I know how many times my QR code has been scanned?

Your link platform reports it. Open the link the code points to and look at the scan count for your chosen date range. If the code encodes a plain URL with no redirect, that number does not exist anywhere and cannot be recovered after the fact.

What is the difference between total scans and unique scans?

Total scans count every scan event. Unique scans estimate distinct people by deduplicating on IP address and device signature. Unique scans are always an approximation, and shared Wi-Fi networks compress the number while multiple devices per person inflate it.

How accurate is QR code location tracking?

City-level at best. Location is derived from the IP address, which reflects the internet provider rather than the person. VPNs and privacy relays shift it entirely. Use it for regional comparison, not for precise targeting.

Why does my QR code traffic show as direct in Google Analytics?

A camera scan sends no referrer, so GA4 has nothing to attribute the visit to unless you added UTM parameters to the destination URL. The other common cause is a shortener that stripped the query string from an already-tagged link.

Can I change where a QR code points after it is printed?

Yes, if the code encodes a short link. Change the destination and every printed code redirects to the new page, with scan history preserved. Changing the slug or domain is the exception, since that alters the encoded URL and requires a reprint.

How long does QR code data take to appear in GA4?

Real-time reports show scans within minutes, but processed reports take 24 to 48 hours. Link platforms log scans at the redirect server, so those appear immediately.

Can I track conversions from a QR code rather than just scans?

Yes, with a tracking pixel on your destination site. The pixel records the action and ties it back to the link that brought the visitor in, so you get a conversion rate per code rather than a raw scan count.

Conclusion

Tracking a QR code is really tracking the link behind it. Once that clicks, the rest follows: encode a short link, tag the destination, test before you print, and read scan data as a comparison tool rather than a precise count.

The more useful question is not how many people scanned, but what they did afterwards. Set up event tracking before your next campaign goes to print, and you will be able to tell the difference between a placement that gets attention and one that gets results.