Can You See Who Scanned Your QR Code? What Owners See

Nookesh Karri

Can You See Who Scanned Your QR Code?

No. A QR code can't reveal a scanner's name, number or email. A dynamic code shows when, roughly where and on what kind of phone it was scanned.

Nookesh Karri Oct 24, 2026 · 6 min read

No, you can’t see who scanned your QR code. A QR code has no way to collect a name, phone number or email address from the person who scans it. If you use a dynamic code, you can see when each scan happened, roughly which city it came from and what kind of phone was used, but not who was holding the phone.

What actually happens when someone scans

The camera app decodes the pattern into text, usually a web address, and the phone opens it. The code doesn’t run anything on the phone and doesn’t read its contacts, accounts or number.

The other end gets what any website gets when a browser asks for a page: an IP address and a header called User-Agent. MDN describes that header as a string that “lets servers and network peers identify the application, operating system, vendor, and/or version” of the browser. Good for device stats. No name in it.

It has also gotten vaguer. According to MDN’s User-Agent reference, modern Android browsers report a fixed model, K, and a fixed Android 10 platform version, so a dashboard often can’t tell one Android phone from another. An iPhone still says iPhone.

What a dynamic code can show you

A static code sends the phone straight to the destination, and nothing in between keeps a record. A dynamic code points to a short link on a redirect server, which logs the scan before passing the phone along. (Not sure which kind you printed? The dynamic vs static guide shows how to tell.)

From that one request, a scan dashboard can usually show:

The time of the scan, so you can see which hours or days the code works best.
Approximate location, looked up from the IP address.
Device type and browser, read from the User-Agent header.
Total versus unique scans, an estimate of how many separate devices scanned.

The guide to tracking QR code scans explains how those counts are made and why they rarely match your web analytics.

How rough the location really is

The location comes from matching the IP address against a database. It isn’t GPS, and it was never meant to find a person.

MaxMind, which sells IP location data, publishes its own accuracy figures by country. For the United States, it places 60% of IP addresses within 50 km of the right location, puts 33% in a city outside that radius, and has no city-level answer for 7%. The UK comes in at 67% within 50 km, Germany at 71%. MaxMind adds that “due to the nature of geolocation technology” it can’t guarantee future accuracy.

A scan labeled “Chicago” could come from well outside the city. That’s fine for comparing a poster in Austin with one in Denver, and useless for working out which house a scan came from.

Why the IP address still counts as personal data

A city and a phone model look harmless. In the EU, the IP address behind them isn’t automatically treated that way.

GDPR Recital 30 says people “may be associated with online identifiers provided by their devices,” names internet protocol addresses as one example, and warns that such traces can be used “to create profiles of the natural persons and identify them.” Before GDPR, the EU Court of Justice ruled in the Breyer case on 19 October 2016 that dynamic IP addresses can be personal data for a website operator, because legal channels exist for it to get the matching subscriber details from the internet provider.

So you can’t see who scanned, but a raw log could still be tied back to a person. How a tool stores scan data matters, and our GDPR compliant QR code analytics guide covers what to look for.

QRAnalytica collects scan data without cookies and without storing personally identifiable information. You get the country and city map, device details and hourly counts, with no profile of the person behind each scan. The limitation: our city data comes from the IP address too, with every accuracy problem above, and nothing in the dashboard will tell you who a scanner is.

When you do need to know who scanned

Ask. It’s the only reliable method, and it keeps you on the right side of privacy law.

Point the code at a page where the person chooses to identify themselves:

A real estate agent puts a code on a yard sign that opens a “Book a viewing” form for that listing.
Table codes at a restaurant can open a loyalty sign-up with a free dessert on the first visit.
At the badge table, an event organizer’s code opens check-in with the attendee’s registration email. The event QR code analytics guide covers event tracking in more depth.

My take: if a campaign only works when you know each scanner by name, build the landing page around that from day one. Squeezing identity out of scan logs gets you a pile of rough cities and phone models, plus a privacy problem you didn’t need.

If you’re the one scanning

Scanning a code doesn’t hand over your number, name or contacts. The real risk is a code that sends you to a fake login page or an unexpected download, and how to scan a QR code safely explains what to check before you tap.

FAQ

Can a QR code get my phone number when I scan it?

No. Scanning only makes your phone open whatever the code holds, usually a web address. The page you land on sees the same things any website sees, such as your IP address and browser details, but not your phone number, name or contacts.

Can the owner of a static QR code see anything about scans?

Not from the code itself. A static code holds the final address directly, so nothing in between records the scan. If it points to the owner’s own website, their web analytics can count the visit like any other.

How accurate is the location shown for a scan?

It comes from the IP address, not GPS. MaxMind’s own figures put 60% of US addresses within 50 km of the right spot, and some addresses get no city at all.

How can I find out who scanned my code?

Ask them. Send the code to a page with a form, a sign-up or a booking, and the people who want to hear from you will tell you who they are.

It can be, but IP addresses can count as personal data in the EU, so how a tool stores them matters. Cookie-free, anonymized scan counts are the safer setup.

Sources

Track your dynamic campaigns. 7-day trial, no credit card.

Generate Dynamic QR