Can a static QR Code track scans?

The symbol itself cannot. A UTM-tagged web destination can attribute measured visits, and a controlled or hosted redirect can record requests before forwarding, but those observations are not automatically unique people.

How do I track a QR Code for free in GA4?

Create a consistent UTM-tagged URL for each useful placement, generate a separate static code, verify the full path and analytics setup, then analyze session campaign dimensions and relevant key events in Traffic acquisition.

Does Google Analytics count every QR scan?

No. It measures interactions the implemented analytics setup records after the destination loads, subject to consent, blocking, connectivity, configuration, and other factors. It is not a raw scanner counter.

Why do redirect analytics and GA4 totals differ?

They observe different stages and may handle bots, repeats, time zones, consent, blocking, failures, and uniqueness differently. Compare definitions and trends rather than expecting identical totals, and document which system supplies each reported metric.

Should every printed placement use a different QR Code?

Use a distinct attributable URL for each placement or creative you genuinely need to compare. Keep source, medium, and campaign naming consistent, vary a documented placement value such as utm_content, and avoid creating variants that will not support a real decision.

Which UTM parameters do I need for a QR code?

Google says to always include utm_source, utm_medium and utm_campaign, and strongly recommends utm_id. Add utm_content to tell placements apart. Missing parameters show as (not set) in reports, and values are case-sensitive, so use lowercase consistently and keep a registry of what each value means.

Why does QR traffic show up as direct in GA4?

Google says traffic can be labeled direct when links lack UTM parameters, when redirects strip them, or when visitors come from offline documents. Google's page does not name QR codes, but an untagged code is likely to land there. Tag the URL and test the full redirect chain.

Can I track scans without cookies or consent banners?

Server-side redirect logs can record requests without a page tag, but they still involve personal data such as IP addresses in many jurisdictions. Whether consent is needed depends on local law and what you collect. Minimize data, state it in your privacy notice, and take legal advice for your audience.

QR Code Tracking Guide: UTM, GA4 and Scan Analytics

A static QR Code cannot count scans by itself. To measure a campaign, either add UTM parameters to a web destination and analyze visits in your consent-aware analytics setup, or route the code through a redirect service that records requests before forwarding visitors. These methods observe different points and neither automatically counts unique people.

Use separate, documented URLs for each physical placement, test the complete redirect and landing-page path, and judge the campaign by a meaningful outcome, not by a headline “scan” number alone.

What can QR tracking actually measure?

Measurement point	What it can show	What it cannot prove
Redirect request	A request reached the redirect provider	A unique person or completed page visit
Landing-page analytics	A measured visit with campaign attributes	Every attempted scan
Key event	A configured action such as a submitted form	Revenue unless reconciled to business records
Order or CRM record	A business outcome tied to an identifier	Perfect attribution without a sound data design

Five stages from scan attempt to business record, showing which are observed and where counts can be too high or too low — Original diagram: each stage produces a different number, and the scan attempt itself is never recorded.

Repeat scans, link previews, security tools, bots, staff tests, and refreshes can add requests. Consent choices, ad or script blocking, network failure, browser closure, and tagging errors can prevent analytics collection. Report the observed metric by its real name.

Vendor help pages describe the inflation risk directly. One QR provider says a reader app can request a link twice, first for a preview or security check and then when it forwards the user. Another separates total requests from unique visitors, and a third lists link-preview bots among the sources of extra scans. These are vendor descriptions of their own products, not an industry standard, so check how any tool you use defines total, unique and bot-filtered counts.

Method 1: UTM-tagged destination URLs

UTM parameters describe the campaign source, medium, and name when a tagged link opens. Google states that these values can populate traffic-source dimensions and appear in the GA4 Traffic acquisition report.

Parameter	Purpose	Example
`utm_source`	Specific source or placement family	`store_poster`
`utm_medium`	Consistent channel category	`offline_qr`
`utm_campaign`	Marketing initiative	`autumn_membership`
`utm_content`	Creative or individual placement	`front_window_a`
`utm_id`	Internal campaign identifier	`cmp_2047`

A landing page URL broken into the page address and four UTM parameters with example values — Original diagram: the parts of a tagged URL. All values are examples.

Google’s URL builder page says to always use utm_source, utm_medium and utm_campaign whenever you add parameters, and strongly recommends utm_id as well. Missing values show as “(not set)” in reports. Values are case-sensitive, so google and Google are different sources, and Google’s best practice is lowercase throughout. Decide the naming convention before generating codes, and keep a campaign registry with the final URL, placement, owner, dates, artwork version and expected outcome.

Create a trackable static QR Code

Choose a fast, mobile-accessible HTTPS landing page that you control.
Confirm the site's analytics and consent configuration is appropriate for the intended audience and jurisdictions.
Create a UTM naming plan and reserve one utm_content value for each placement or creative you need to compare.
Build the complete destination URL with the UTM builder or Google's Campaign URL Builder.
Open that URL and verify that parameters survive any redirects.
Encode the complete URL with the URL QR Code generator.
Test the final code and confirm a test visit appears in the intended analytics property and report.
Record the test traffic so it can be excluded or annotated during analysis.

If the printed URL is long or creates a dense symbol, use a stable short path on a domain you control. Do not choose an unowned shortener solely for smaller artwork; losing the redirect account or domain can break every printed code.

One placement, one attributable URL

If the same exact URL appears on a storefront sign, table tent, package insert, and direct-mail card, landing-page analytics cannot tell which physical object produced a visit. Use distinct utm_content values, or separate controlled short paths, for the placements you need to compare.

Four placements, each with its own utm_content value, pointing to one landing page, with a registry sheet below — Original diagram: one landing page, one tagged URL per placement you want to compare, and a registry kept outside the URL.

Do not create excessive variants that no decision will use. A useful plan might distinguish store, city, artwork, or mail version. A wasteful plan generates a unique code per leaflet without the staff, sample size, or decision process to analyze it.

Find QR campaign traffic in GA4

Google's current guidance places session-level campaign analysis in Reports → Acquisition → Traffic acquisition. Use dimensions such as Session source, Session medium, Session campaign, or Session source / medium. Exact navigation and available dimensions can change as products evolve.

Check at least:

sessions or engaged sessions from the tagged campaign;
the landing page and device experience;
configured key events relevant to the campaign;
outcomes by placement or creative;
conversion rate rather than traffic alone; and
reconciled orders, leads, redemptions, or registrations where appropriate.

UTM data describes acquisition; it is not a dedicated scan counter. Google’s page on direct traffic says visits can be labeled “(direct) / (none)” when links lack UTM parameters, when redirects (including HTTPS-to-HTTP) strip them, and when visitors arrive from offline documents. It does not mention QR codes by name, so treat a code without tags as likely to land in the same bucket and test the deployed chain instead of assuming attribution works.

The Traffic acquisition report also reads session-level data. The current Google help page lists Session campaign, Session medium, Session source, Session source / medium and Session source platform, and a Key events metric that counts the events you have marked as key events. Google notes that UTM values are omitted from the landing page and query string dimension and appear in Page location instead.

Method 2: redirect-request tracking

A hosted “dynamic QR Code” normally contains a provider-controlled short URL. The provider receives a request, may record permitted metadata, and redirects the browser to the destination. Depending on the service and plan, the destination may be editable after printing.

Before using a provider, evaluate:

who owns the short domain and what happens if the subscription ends;
whether redirects remain active after cancellation or plan changes;
export, retention, deletion, access, and incident-response controls;
bot filtering and definitions for total versus unique requests;
location precision and how it is derived;
consent, privacy notice, and processor terms;
redirect speed, uptime, HTTPS, and abuse controls; and
the process for changing destinations and reviewing history.

Two paths: a tagged URL in a static code seen only by landing page analytics, and a short redirect URL logged by a redirect service before the landing page — Original diagram: where a tagged URL and a redirect each observe a visit.

Provider analytics and GA4 will not necessarily match. They observe different stages, filter traffic differently, and may use different time zones or uniqueness windows. Reconcile trends and definitions rather than forcing identical totals.

Static UTM or hosted redirect?

Requirement	UTM to your page	Hosted redirect
Campaign attribution on your measured site	Yes, when correctly implemented	Usually add UTMs as well
Observe redirect requests before the landing page	No	Potentially
Change destination after print	Only with a redirect you control	Common provider feature
Avoid third-party redirect dependency	Yes	No
Use your existing web consent and analytics controls	Yes	Also review provider collection

For a short campaign with a stable landing page, distinct UTM-tagged static codes may be enough. For expensive long-lived print whose destination must change, use a durable redirect under organizational control or contractually evaluate a provider. Tracking alone is not a reason to surrender link ownership without review.

Measure outcomes, not vanity metrics

Define the decision and outcome before printing. Examples include completed registration, coupon redemption, qualified lead, product setup, menu order, donation, or support deflection. Configure the least amount of measurement needed to answer that question.

A basic funnel can be expressed as:

Observed visits: measured landing sessions from a placement;
Action rate: relevant completed actions divided by observed visits;
Cost per action: attributable campaign cost divided by actions; and
Business value: verified value or savings associated with those actions.

Do not interpret a low visit count until you also check distribution, visibility, print quality, call-to-action clarity, destination speed, access restrictions, and measurement health.

Privacy and responsible analytics

A QR Code does not create an exemption from privacy or consent requirements. Document the data collected by the landing page and any redirect provider, minimize it, restrict access, define retention, and provide required notices and choices. Avoid embedding names, emails, customer IDs, or other personal information in UTM parameters because URLs can appear in browser history, logs, analytics, and shared screenshots.

Google’s consent mode documentation explains that when a visitor denies consent, Google tags stop storing cookies and send pings instead, and that GA4 properties can use those pings to model some of the missing data. Under an IAB TCF consent setup, that modeling is not available. In practice, a low landing-session count can partly reflect consent choices, and the figures you see may include modeled data. See the scan privacy policy for how this site handles scan data from its own dynamic codes.

Google documents consent management and notes that denied consent can affect measurement. Measurement Protocol is an advanced server-to-server supplement to normal tagging, not a shortcut for bypassing user choices or replacing a sound web implementation.

Preflight checklist

Campaign and outcome definitions are documented.
Each useful placement has a consistent unique value.
No personal or secret data appears in the URL.
HTTPS, redirects, UTMs, consent behavior, and key events are tested.
The landing page is fast, mobile usable, accessible, and matches the printed promise.
The QR Code has adequate contrast, quiet zone, size, and production quality.
Final physical proofs are tested on representative devices.
Staff and agency test traffic is recorded.
Redirect ownership, renewal, and end-of-campaign behavior are assigned.
Reports use honest metric names and stated limitations.

What does a tracking mistake look like?

Look at a gym that prints one QR code, with no tags, on a window poster, 300 flyers and a membership card. After a month the analytics show 140 direct visits to the sign-up page and the owner concludes the poster “worked.” Direct traffic cannot say that. Staff also scanned the code a dozen times while testing the card, and some visitors came from the gym’s own email list.

A repaired plan uses one tagged URL per item (poster_window, flyer_street, card_member), records the staff test visits, and watches sign-ups from each value. Even then, the result describes measured sessions and form submissions, not the number of people who scanned.

What can scan tracking not settle?

How many people saw the code and chose not to scan. No method records the scan attempt.
Unique people. Vendors define unique visitors in different ways, and shared devices, VPNs and privacy tools can distort any count.
Whether one placement caused a sale that also had other influences. UTM attribution is a last-touch convenience, not proof.
Which privacy rules apply to your audience and which consent flow you need. That depends on where your visitors are and what you collect.

Start by building a consistent campaign URL with the UTM builder, create and test its QR code before committing the artwork to print, and read static versus dynamic QR codes if the destination might need to change. If a redirect will carry the code, the dynamic QR code generator and do QR codes expire explain the ownership trade-offs.

This guide is general information, not legal advice. Analytics, consent and data-protection duties vary by country and sector, so check your local rules and your analytics provider’s terms.