A QR code itself cannot collect your data; it only holds text, usually a web address. Privacy questions start when you open that link. The server behind it can see things like the time of the scan, your IP address, rough location and device type, and the website you land on may track you further with cookies.
QR codes are everywhere: menus, posters, parcels, tickets and payment stands. Many people wonder whether scanning one quietly hands over personal information. The honest answer is "a little, and it depends on what happens after the scan". This guide explains what can be collected, who collects it, how data-protection laws treat it in general terms, and how to stay in control.
What actually happens when you scan
Scanning is a two-step process:
- Your camera or scanner app reads the pattern and turns it into text, such as a URL, Wi-Fi details or a contact card.
- If it is a link and you choose to open it, your phone connects to that website like any other link.
The first step happens on your phone. The QR code is just printed data, so it cannot run code, switch on your microphone or read your files by itself. The second step is where information can be shared, because your browser is now talking to a server.
What a QR code scan can reveal
When you open a link from a QR code, especially a dynamic one that passes through a redirect service, the following information is commonly available to the services involved:
- Date and time of the scan
- IP address, which can suggest your approximate city or region and your network provider
- Device and browser type, such as the operating system and browser version
- Language settings of your phone
- Which code was scanned, so a business knows whether you came from the poster in the window or the flyer at the counter
After that, the destination website may use cookies, analytics tools or advertising trackers like any other site. If you sign in, fill in a form, or pay, you share much more, but that is your choice on the page, not something the QR code does by itself.
What a normal scan does not reveal: your name, phone number, contacts, photos or precise GPS position. A website can only get your exact location if your browser asks for permission and you agree.
Why businesses track QR scans
Most tracking around QR codes is ordinary marketing measurement. A café wants to know whether the table cards are being used. A shop wants to compare a newspaper advert with an in-store poster. Dynamic QR codes make this easy because every scan goes through a short link that counts visits.
Aggregated numbers, such as "120 scans this week, mostly in the evening", are useful and low-risk. Problems start when data is combined, kept too long, shared with third parties, or used in ways people would not expect.
Data protection laws in general terms
Many countries have data-protection laws that apply to information collected through QR codes. In Thailand this is the Personal Data Protection Act (PDPA), and in the European Union it is the General Data Protection Regulation (GDPR). The details differ, and this is not legal advice, but they share some common principles:
- Personal data can include identifiers like IP addresses or device IDs, not only names and emails
- Transparency: people should be told what is collected and why, usually in a privacy notice
- A valid reason is needed to collect and use the data, and some uses require consent
- Data minimisation: collect only what you need for the stated purpose
- Limited retention: do not keep data longer than necessary
- Security: protect the data you hold
- Individual rights, such as access to or deletion of personal data, in many situations
If you run a business and use QR codes for marketing, check the rules that apply to you or ask a qualified adviser.
Privacy tips for people who scan
You do not need to stop scanning QR codes. A few habits keep you in control:
- Preview the link first. Most phone cameras show the address before opening it. Read it, and only continue if it matches what you expect.
- Use a scanner that shows the destination. The QR-TH online QR scanner reads the code in your browser and shows where it leads before you open it.
- Be careful with short links. They hide the final destination. Learn how to check where a short link goes.
- Deny unnecessary permissions. If a page asks for your location, camera or notifications without a clear reason, say no.
- Limit cookies. Use your browser's privacy settings or private browsing for one-off scans.
- Think before filling in forms. A menu should not need your ID number. A parking payment page should be the official one.
- Watch for scams. Fraudsters use QR codes to steal logins and payment details. Our guide to QR code scams explains the warning signs.
Privacy checklist for businesses using QR codes
If you put QR codes on your menus, packaging or posters, you can measure results and still respect your customers:
- Use scan statistics in aggregate, and avoid collecting more than you need
- Explain in a privacy notice what you collect when people scan and visit your page
- Ask for consent where the law requires it, for example for marketing cookies
- Do not force sign-ups just to see a menu or basic information
- Choose a QR provider that links to safe, checked destinations and does not show ads to people who scan
- Delete old data you no longer use
- Protect your account with two-step sign-in so nobody else can change your links or read your statistics
QR-TH's dynamic codes give you scan statistics for your own codes, and the destination links are checked against Google Safe Browsing, so you can measure what works without sending customers to unexpected places.
FAQ
Can scanning a QR code give someone access to my phone?
No. A QR code only contains data such as a link. The risk is the website or app it leads to, which may try to trick you into entering details or installing something.
Can a QR code track my exact location?
Not by itself. The server can estimate a rough area from your IP address. Exact GPS location is only shared if a website asks and you grant permission.
Are dynamic QR codes worse for privacy than static ones?
Dynamic codes pass through a short link, so the provider can count scans. That data is usually used for simple statistics. A static code goes straight to its destination, but that website can still collect data.
Is it safe to scan QR codes in public places?
Usually yes, if you check the link before opening it, and avoid entering passwords or payment details on pages you reached from an unknown code.
Scan with more control
You can enjoy the convenience of QR codes without giving away more than you mean to. Before opening an unfamiliar code, try the QR scanner on QR-TH to see the destination first, and decide for yourself whether to continue.