GDPR-Compliant QR Code Tracking: A Practical Guide

Dynamic QR codes deliver valuable figures: how often, when and with which device a code was scanned. But they also process data that falls under data protection law. This article explains what data a scan generates, which laws apply and how to set up QR code tracking with as little data as possible.

Note: This article provides a general overview and does not constitute legal advice. For your specific situation, please consult your data protection officer or a qualified lawyer.

What happens technically during a scan

A dynamic QR code contains a short redirect address. When someone scans it, the smartphone requests that address from the QR code service's server. As with any website visit, the browser automatically transmits some technical information:

• the IP address, the network address under which the device is currently reachable on the internet
• the user agent, an identifier for browser and operating system
• the time of the request and, where applicable, the language setting

The service builds its statistics from this information. Using GeoIP, it derives the approximate region from the IP address, such as country, state or city. GeoIP relies on databases that map IP address ranges to locations. It does not reveal a precise address.

Is an IP address personal data?

Yes, as a rule. In the Breyer case (C-582/14) in 2016, the Court of Justice of the European Union ruled that even a dynamic IP address can be personal data for a website operator if the operator has legal means to have the person identified using additional information held by the internet provider. In practice, IP addresses are therefore treated as personal data.

This means the General Data Protection Regulation (GDPR) applies. You need a legal basis, must provide transparent information and may only process as much data as the purpose requires.

Which laws apply?

GDPR

The GDPR sets out the conditions under which personal data may be processed. For QR code tracking, two legal bases in Article 6(1) GDPR are particularly relevant:

• Consent (point a): The person agrees to the processing freely, on an informed basis and unambiguously.
• Legitimate interest (point f): The processing is necessary for your legitimate interests, and the interests of the person concerned do not override them.

TDDDG

Germany's Telecommunications Digital Services Data Protection Act (TDDDG) was called the Telecommunications Telemedia Data Protection Act (TTDSG) until May 2024. Its substance has remained largely the same. Section 25 implements the EU ePrivacy Directive and governs access to end devices: anyone who stores information on a user's device or reads information stored there generally needs consent. Exceptions apply only where access is strictly necessary to transmit a message or to provide a service the user has explicitly requested.

This mainly concerns cookies, local storage and similar techniques, for example on the landing page. Unlike the GDPR, Section 25 TDDDG does not allow a balancing of interests. Whether merely analysing the information automatically transmitted during a redirect falls under Section 25 is a matter of debate. The European Data Protection Board interprets the scope broadly in its Guidelines 2/2023 and explicitly includes techniques similar to cookies.

Consent or legitimate interest?

With a QR code redirect, there is no moment at which you could obtain consent before the request. The redirect is meant to happen instantly. For pure scan statistics, legitimate interest is therefore usually the relevant basis in practice, and only if processing is limited to what is necessary.

This table is a simplified guide. For the balancing test under Article 6(1)(f) GDPR, document the interest you are pursuing, why the data is necessary for it and how you protect users' interests.

Implementing data minimisation: concrete measures

Minimise data

• Truncate or discard IP addresses: For statistics, the derived region is usually sufficient. The full IP address does not need to be stored permanently. Clarify with your provider how long it is retained.
• Keep regions broad: Country or state is enough for most analyses. Very fine location resolution increases the risk of drawing conclusions about individuals.
• No recognition: Avoid identifiers that recognise the same person across multiple scans unless you have consent.
• Set retention periods: Keep raw data only as long as needed and work with aggregated figures afterwards.

Check your provider

If an external service processes the scans, it usually acts as a processor. You then need a data processing agreement under Article 28 GDPR. Also ask about the server location: processing within the EU avoids the additional requirements for transfers to third countries.

Inform transparently

Article 13 GDPR requires you to inform data subjects. Add a section on QR codes to your privacy policy: which service is used, which data is processed during a scan, for what purpose, on what legal basis and for how long. A short note next to the printed code, such as "This code records scan statistics, details at …", builds additional trust.

Do not forget the landing page

Many data protection issues arise not during the scan but on the landing page. If analytics or marketing tools that are not strictly necessary load there, you need consent via a cookie banner that only activates these tools after the user agrees.

Checklist: setting up compliant QR code tracking

1. Record the purpose of the analysis in writing
2. Collect only the data required, keep regions broad
3. Clarify whether and for how long full IP addresses are stored
4. Define the legal basis and document the balancing of interests
5. Sign a data processing agreement with your QR code provider
6. Check the provider's server location and sub-processors
7. Update your privacy policy
8. Review the landing page for cookies and tracking tools and obtain consent
9. Set retention periods and delete exports containing raw data as well
10. Add an entry to your record of processing activities

Privacy-conscious tracking with QRFlow

QRFlow, the QR code product from Simplify Data, offers dynamic QR codes with scan analytics by device, region and time based on GeoIP, plus exports to CSV, Excel and PDF. During setup, we are happy to advise you on limiting analysis to what is necessary. View QRFlow

Sources

• Telecommunications Digital Services Data Protection Act (TDDDG), Section 25
• General Data Protection Regulation (EUR-Lex)
• CJEU, judgment of 19 October 2016, C-582/14 (Breyer)
• German Data Protection Conference: Guidance for providers of digital services
• EDPB: Guidelines 2/2023 on the technical scope of Art. 5(3) ePrivacy Directive