How to track QR code scans without a paid tool

Q: What UTM convention should I use for QR codes?

Set utmmedium to qr always, utmsource to the physical placement, and utmcontent to the individual asset so you can compare placements directly.

Point the code at a URL on your own domain carrying UTM parameters, and read the results in your own analytics. That gives you scan counts, timing and placement attribution with no third party in the path and no subscription that can lapse.

The pattern

Printed code → https://example.com/p/poster-a → 302 → your landing page

The redirect runs on your server, so you see every request. You control the code's destination, and there is nothing to pay for and nothing to expire.

Option 1: UTM parameters only

Simplest. Encode the destination directly with UTM tags:

https://example.com/sale?utm_source=poster&utm_medium=qr&utm_campaign=spring26&utm_content=lobby

Your analytics attribute the visit. No redirect needed.

The cost is payload length — a full UTM set adds 60–100 characters, which typically pushes the code up two or three versions and shrinks every module.

Conventions that make the data useful:

utm_source = the physical placement (poster, packaging, receipt)
utm_medium = qr, always, so you can segment all QR traffic at once
utm_campaign = the campaign
utm_content = the individual asset, so you can compare the code by the till against the one in the window

Option 2: a short redirect you own

Better for print. Encode a short path and expand it server-side:

Code:     https://exmpl.co/p/a1
Server:   302 → https://example.com/sale?utm_source=poster&utm_medium=qr&...

The code stays low-version and coarse. You get a server log entry per scan with timestamp, coarse geography from the IP, and user agent. And you can change the destination later, which is the thing dynamic-QR products actually sell.

Fifteen lines of server configuration, and no third party.

What you can and cannot learn

Can: total scans, scans over time, which placement performed better, device type, coarse region, what people did after landing.

Cannot, reliably: unique people (no cookie before the first load), exact location, whether the same person scanned twice, or scans that did not result in a page load.

Note that no QR analytics product can do better on the first three — the code itself carries no identity. Vendor dashboards showing "unique scans" are inferring from IP and user agent like anyone else.

Why not just use a dynamic-QR provider

You can, and for short-lived campaigns it is convenient. The trade is that your printed material now depends on their uptime, their domain and your subscription. For packaging or signage with a multi-year life, that is a bad trade — see static vs dynamic.

Privacy

Your own server logs are your own responsibility: state the retention period in your privacy notice, and do not build profiles from them. The advantage of this approach is that no third party learns anything about the people scanning your codes.

FAQ

Can I track QR code scans for free?

Yes. Point the code at a URL on your own domain with UTM parameters and read the results in your own analytics. No third-party product is required.

Do I need a dynamic QR code to see scan counts?

No. A static code pointing at your own redirect gives you the same counts in your own server logs, without a subscription or a third party in the path.

What UTM convention should I use for QR codes?

Set utm_medium to qr always, utm_source to the physical placement, and utm_content to the individual asset so you can compare placements directly.

Can QR analytics tell me who scanned?

No product can. The code carries no identity. Dashboards showing "unique scans" are inferring from IP address and user agent, which you can do yourself.