Consent and QR Codes: Where the Offline to Online Handoff Loses Its Notice
QR codes are everywhere again: menus, parking meters, bus stop posters, gym equipment, product packaging. Each scan jumps a phone from a physical object straight into a web flow, skipping the homepage, the banner habits, and often the moment where anyone explains what data is about to be collected.
That skipped moment is the problem this guide addresses. It looks at what typically loads on a QR landing page, why a scan is not consent to tracking, and how to design short mobile journeys that ask properly without ruining the speed that made QR codes useful.
A scan is an action, not an agreement
Scanning a code shows intent to reach whatever the poster promised: a menu, a payment page, a timetable. It says nothing about advertising tracking, account creation, or marketing messages. Yet many QR flows land on pages stacked with trackers, or worse, route through redirect services that log device details and location before the destination even opens. Each redirect is a data collection point the person never saw. Shorten the chain: the code should point as directly as possible to the destination, and any analytics on the scan itself should be aggregate counts, not per device records tied to identifiers.
The landing page has seconds to be honest
QR journeys happen standing up, in glare, one handed, often in a hurry. A landing page that opens with a full screen banner and three paragraphs will be dismissed, not read, and a dismissed banner followed by tracking is consent in name only. Design for the setting: trackers off until a choice, one short notice in large text, two clear buttons, and the promised content reachable either way. A restaurant menu does not need agreement to marketing cookies to be read. Separating the essential content from the optional tracking is both the legal point and the only design that respects the moment.
Essential services need a non QR path
When the QR code is the only route to something essential, like paying for parking or checking in for an appointment, consent inside the flow is effectively forced, because refusal means no service. Keep an alternative open: a short web address printed beside the code, a card payment option on the meter, a reception desk that still exists. The alternative also covers dead batteries, broken cameras, and people who simply do not use QR codes. Accessibility and consent point the same way here: a single tracked doorway is a bad design for a public service, full stop.
Marketers should count scans, not people, by default
QR campaigns tempt teams to measure everything: scan location, device, time, repeat visits, conversion. Most campaign questions are honestly answered by counts: how many scans, where, and roughly when. Per person tracking answers questions about individuals that a poster campaign never asked permission to study. Set the measurement plan before printing: aggregate scan counts from the redirect or landing page, no fingerprinting, and retention measured in weeks for campaign reporting rather than years in a profile. If a campaign genuinely needs sign ups or bookings, ask for them as their own step with their own notice, after the promised content arrives.
Related reading
These earlier guides cover connected questions in more depth: Consent on Webinar Registration Pages: Tracking Before the Form Is Even Sent, Consent and Live Chat Widgets: The Tracker in the Corner of Every Page, and Cookie Walls and Paywall Choices: When Access Depends on Consent.
Frequently asked questions
Does scanning a QR code consent to tracking?
No. A scan shows you want the menu, payment page, or information the code promised. Tracking, marketing messages, and account creation each need their own notice and choice on the landing page.
Why do some QR codes go through strange redirect addresses?
Many code generators route scans through their own service to provide scan statistics. That redirect can log your device and rough location. Direct codes that point straight to the destination collect far less.
What should a QR landing page do differently?
Load no trackers before a choice, show a short notice in large readable text, let you reach the promised content either way, and keep the whole flow usable one handed in bright light and a hurry.
Is it acceptable for parking or check in to be QR only?
It is risky. Essential services need an alternative route, for accessibility as much as consent. A printed short address or a staffed option keeps the service open to everyone.