QR code analytics and GDPR
SmartQRCode editorial · Updated October 2026
QR code analytics and GDPR work is a field list, not a slogan. Hosted SmartQRCode types store totals, device type, and a country from request headers. They do not store a name or email. Wi-Fi outside the hop means those codes contribute nothing to the chart. If you do not need a count, do not create the hop.
QR code analytics and GDPR
You are writing a processor narrative page for a campaign that already decided to use a tracked code, or you are deciding whether that decision was necessary. This does not apply to a static Canva PNG of a https brochure link. That file never calls this product.
Redirect and landing-page types encode a SmartQRCode URL. Scans hit the host, then 302 onward so later destination edits are not frozen by a 301 cache. The destination site is a separate processor if it sets cookies. Keep the scan hop and the landing page in two sentences, not one blur.
This product launched in January 2026 as SmartQRCode on smart-qrcode.com. Support sits at support@smart-qrcode.com. Those are identity facts for the narrative, not a lawful basis.
List the fields on one sheet before legal review
- Name the encoding: hosted URL in the modules, or static Wi-Fi with no server.
- If hosted, write the three stored scan fields in the order totals, device type, country from headers.
- Write the absences: no GPS in the log, no mailbox, no legal name.
- Name the redirect as 302 and explain it as cache behaviour, not as consent.
- Split pause and archive. Archive keeps scanning. Pause stops the live hop.
- Name provider dependence: the print lasts as long as the host resolves.
- If the type is Wi-Fi, mark the row Wi-Fi outside the hop and stop collecting "scan counts" for that code.
- Export SVG or 300 dpi PNG at final size. Test-scan, then confirm the dashboard shows a total and a country, still without an identity.
How do you list lawful scan fields
Lawful basis is your counsel job. The product job is not to invent a basis. Hand them the three fields and the absences. A tracking generator is how you opt into those fields. A menu code uses the same log shape if you choose a hosted menu.
Country headers fail on VPNs and some mobile networks. Do not claim precision you do not have. Device type is a layout hint. Totals answer whether the poster was used.
A 7-day paid trial is an intent filter, not an unpaid experiment. After 7 days it converts to the annual plan unless cancelled. That billing fact does not expand the scan columns. Lifetime is a one-time payment with no renewal. Monthly and annual are subscriptions. None of those options add a name field. We do not sell an unpaid product tier.
Healthcare should pair any tracked code with a visible https URL for people who refuse the hop. See healthcare.
Does a country header identify a person
Almost never in this product, and never as a GPS pin. Do not stitch the country field to a booking name from another system and call the bundle "QR analytics." That stitch is your stitch.
A scanner who wants no owner log should not scan a hosted code. Put the typed URL on the same sign.
When does skipping analytics help GDPR
When the campaign does not need a count and will not change the URL. Print a static file in Canva, Google Chart, or the iOS generator. You skip the processor, the invoice, and the dashboard. Use us when you need edit-after-print or a count you can defend as those three fields.
What breaks this narrative in production
Promising unlimited scans as if that cancelled provider dependence. It does not. Extra public shorteners. Treating pause as delete. Exporting a screenshot of /qr-preview. Counting Wi-Fi joins that never existed. Inventing user totals for a slide.
A bulk CSV job creates many hosted URLs. Each still has the same three fields. Volume does not create identity. Webhooks and an activity log, when you use those business surfaces, still do not attach a scanner mailbox. GA4 forwarding, if you enable it, sends whatever that pipe is documented to send; it does not invent a name in this product scan table.
A destination that asks for an email is not this product collecting an email. That form is the restaurant, the clinic, or the campaign site. Write it as a second processor. If you do not want that form, do not put it on the landing page. A website code that 302s to a page with no form still only stores the three scan fields on the hop.
Smart routing, when used, can send scanners to different destinations by rule. That is still a destination decision. It is not a way to infer a legal name from a scan. Document the rules as marketing logic, not as profiling you cannot actually perform.
Error correction level on the print (L, M, Q, or H) has no GDPR meaning. It only changes how much damage the camera can restore and how dense the modules become. Quiet zone of four modules is a scan rule, not a privacy rule.
Images galleries (up to 40 images), PDF landings, video landings, and text landings share the hop. They do not share a licence to store a passport number. If your landing page asks for one, that ask is yours. Put it in the narrative as a form on your page, with whatever basis you have for that form.
A paused code stops the hop. An archived code does not. If legal asks you to "turn it off," pause is the word. If they ask whether old posters still resolve, archive is the honest yes. Mixing those verbs in a DPIA is how you get a reprint and a letter.
Sibling pages: QR code privacy and tracking and who sees QR code scan data.
Questions this raises
Write the three stored scan fields: totals over time, device type, country from headers. State that a scanner name is absent.
No GPS in the log. A country from headers is coarse and can be wrong on a VPN. It is not a postal address.
When you do not need a count. A Canva static URL or a paper menu leaves Wi-Fi outside the hop and leaves hosted analytics unused.
302 is a cache control so destination edits stay live. It is not a lawful-basis argument.
User-archived codes keep scanning. Pause stops the hop. Neither is a substitute for your own retention policy on exports.
Keep going
The tools and playbooks this post refers to, one click away.
Make the code this post is about
$1.99 for 7 days, then a paid plan. Pick a type, brand it, and edit the destination whenever you like, even after it is printed.