QR tracking, privacy and suspicious links

What a scan report actually measures

A static QR that directly encodes a destination does not report scans to Ultimate QR. The destination website may have its own analytics, but that is separate from QR-service tracking. A dynamic code opens a hosted redirect where requests can be recorded before the visitor continues.

Ultimate QR's dynamic reports include totals and available device, operating-system and country information. These describe recorded requests and estimates, not a guaranteed count of unique people. Repeated scans, tests, automated requests and incomplete visits can all make a total different from the number of customers you imagine it represents.

Country information should not be treated as a precise physical address. Device classifications are not verified identities. Do not use a scan chart to claim that a particular person visited, bought something or received a service unless a separate lawful and reliable system establishes that event.

Separate placement testing from conversion claims

For physical campaigns, separate codes for separate placements can make the source clearer. Label them consistently in the dashboard and keep a record of which print went where. If codes are reused across several locations, their totals cannot reliably distinguish those locations.

Pro A/B testing assigns requests to two destinations and reports the assigned scan totals. It does not automatically know whether someone bought, booked or submitted a form on either destination. Measure those outcomes separately when appropriate, with an honest privacy notice and consent where required.

Visitors: inspect the address before acting

The FTC warns that scammers can replace legitimate codes or send QR codes in messages to direct people to spoofed websites. Look at the link preview and check the domain for unexpected spelling, substitutions or an unrelated address. A short link can conceal the final destination, so be cautious about what happens after it opens.

Do not enter a password, payment detail or identity information just because the page arrived through a QR. If a message claims an urgent account issue, open the organisation's known website or app independently. HTTPS helps protect the connection but does not prove that a site or its operator is trustworthy.

• Check for stickers pasted over an existing printed code.
• Read the previewed domain before opening.
• Avoid unexpected downloads or login requests.
• Use a known official channel for urgent account claims.
• Do not interpret a branded logo as proof of legitimacy.

Owners: treat the printed surface as part of security

Inspect public signs periodically for tampering, especially when a code is used for payments or account actions. Include a readable destination address or business context so visitors have something to compare. Test after changing any redirect or advanced routing settings.

Protect the account used to manage destinations and plan who can update it. A password-protected QR controls a particular hosted flow; it does not encrypt already visible artwork or guarantee that a destination is safe. A/B or device routing also makes testing more complex because different visits may open different pages.

Collect less and explain what is collected

If a QR opens lead capture or a private feedback form, explain the purpose and who receives the information. Do not ask for sensitive health, financial or identity details through a generic QR form. Optional marketing consent should not be confused with permission to follow a link.

Ultimate QR's privacy policy explains account, saved content, analytics and support-message handling. Business owners using a destination page, retargeting pixels or collected leads are responsible for their own lawful notices and use. Prefer aggregate measurement when it answers the question without identifying individual visitors.