QR Scan Attribution: How to Tie Offline Scans to Results
QR scan attribution is the practice of linking each scan of a printed or on-screen QR code to the campaign, placement and creative that produced it, and then to what the scanner did next. You get it by giving every placement its own dynamic QR code, adding consistent UTM parameters to the destination, and measuring conversions on the page or in the app. This guide shows you how, where it breaks and what scan data can never tell you.
TL;DR
- Give every placement (poster, flyer, shelf talker, package) its own dynamic QR code, so the scan itself tells you where the person was.
- Add
utm_source,utm_mediumandutm_campaignto each destination, and keep the capitalisation identical every time, because values are case-sensitive. - Scans are a signal of interest, not proof of sales. Connect them to leads, purchases or installs with conversion tracking on the destination.
- Collect only what you need and say so. Device, IP address and location data count as tracking in the eyes of regulators.
- Choose a platform that keeps codes working after printing, so attribution history is never lost to a reprint.
Table of Contents
- What QR scan attribution means
- Step 1: One code per placement
- Step 2: Tag the destination with UTM parameters
- Step 3: Connect scans to conversions
- Why QR attribution fails, and how to prevent it
- Which metrics to track
- How to get more scans to attribute
- What scan data can and cannot tell you
- Privacy: collect less, explain more
- Perspective: attribution only works if the code outlives the campaign
What QR scan attribution means
A printed poster has no click. Nobody can tell which poster, flyer or shop window sent a visitor to your site, so offline spend often looks like a black box. A QR code fixes this by turning the physical item into a link you can count.
Attribution adds three layers:
- The scan. A redirect records that someone scanned a specific code, and when. Typical details are the time, the approximate location and the device type, as the Canadian Centre for Cyber Security notes when it lists what QR-related collection can include.
- The session. The destination URL carries campaign tags, so your web analytics knows the visit came from “flyer, spring campaign, version B” rather than “direct”.
- The outcome. A form submission, purchase or app install is tied back to that session.
Most teams stop at layer one. The value is in layers two and three.
Step 1: One code per placement
The most useful attribution decision is made before anything is printed. If a single code appears on twenty posters and three mailers, every scan lands in one bucket and you learn nothing about which placement works.
Use a separate dynamic code for every combination you want to compare:
- Channel (street poster, direct mail, packaging, in-store display)
- Location or venue (store 12, the airport banner, the conference hall)
- Creative version (headline A or headline B)
- Print run or batch
A dynamic code points to a short redirect that you control, so you can change the destination later without touching the print. That is also what makes counting possible: the scan hits the redirect first, is recorded, and is then forwarded. You can read more about how that works in our practical guide to QR code tracking, or create one with our dynamic QR code generator.
Static codes, which hold the URL directly, cannot be counted by the code itself and cannot be edited. They suit a one-off personal use, not a measured campaign.
Step 2: Tag the destination with UTM parameters
The redirect tells you a scan happened. UTM parameters tell your analytics tool what that visit was. Google’s documentation on campaign URLs defines the core set:
| Parameter | What it records | QR example |
|---|---|---|
utm_source |
The origin of the traffic | flyer or store_window |
utm_medium |
The marketing medium | qr or print |
utm_campaign |
The campaign identifier | spring_launch |
utm_content |
Which creative or placement | poster_a or shelf_12 |
A workable pattern for print is to keep utm_medium=qr for every code, so one filter in your reports isolates all QR traffic, and to use utm_source for the physical format. Use utm_content to separate the versions or locations you want to compare.
If you want a step-by-step version of this, our guide on UTM for QR codes walks through it. For the thinking behind tagging each source, channel, campaign and creative, this overview of tagging destination URLs is a good companion.
Three naming rules that save your reports
- Pick lowercase and stay there. Google Analytics states that UTM values are case-sensitive, so
Flyerandflyershow up as separate rows and split one campaign in two. - Never leave a parameter out. Google warns that missing parameters can produce “(not set)” values in reports, so set the relevant campaign parameters every time.
- Keep a naming sheet. One shared spreadsheet of approved sources, mediums and campaign names stops a colleague from inventing
print-adwhen you already useprint_ad.
Our QR analytics and campaign sheet gives you a template to start from.
Step 3: Connect scans to conversions
A scan counts as attribution only when you can follow it to an outcome. The method depends on where the scanner lands.
Web landing pages
The simplest case. The UTM-tagged visit arrives in your analytics, and you mark the actions that matter (a lead form, a booking, a checkout) as conversions. Report by utm_medium=qr and then by campaign and content. Because the tags travel with the visit, you can compare the conversion rate of the poster against the leaflet, not only their scan counts.
Give the landing page one clear next step. A page built for a scanner on a phone, with a short form and large tap targets, converts better than your desktop homepage.
App installs
App journeys need more plumbing. Google’s Tag Manager guide for Android conversions says install measurement requires a conversion, a trigger and a tag, plus an app event pushed to the data layer, and extra deep-link information when deep linking is used.
For Android, Google’s privacy-compliant attribution guide explains that install attribution from a deep link can use the Play Install Referrer API’s gclid, while later engagement can use gclid or gbraid from the referring URL. The same guide tells implementers to store these values for up to 180 days, or until a newer value replaces them, depending on the scenario. On iOS, Google says SKAdNetwork supports conversion tracking for installs even when the advertising identifier is unavailable.
In practice, send app-bound scans through a redirect that detects the device and forwards to the right store or deep link, and ask your developers to confirm the campaign values survive the install.
In-store and offline purchases
Here the link is weaker, and honesty helps. Common approaches:
- A scan-only offer, such as a code or coupon shown on the landing page and redeemed at the till.
- A booking or reservation form reached through the QR code.
- A comparison of sales at locations with and without the code, which is a correlation and should be reported as one.
Why QR attribution fails, and how to prevent it
Most broken attribution comes from a short list of causes.
| Problem | What you see | Fix |
|---|---|---|
| Inconsistent UTM capitalisation | One campaign split into several rows | Lowercase only, one naming sheet |
| Missing parameters | “(not set)” values, traffic filed as direct | Build every URL from a template |
| One code on many placements | Scans with no way to compare | One code per placement |
| Parameters lost in a redirect chain | Visits arrive untagged | Test the full path on a phone before printing |
| Code with no context | Few scans at all | Tell people what they get |
| Code that stops working | Dead scans, wasted print | Use codes that stay live |
Test before you print. Scan the finished code on an iPhone and an Android phone, over mobile data, and check that the visit appears in your real-time analytics with the right source, medium and campaign. This takes five minutes and it is the cheapest quality check in the process.
Our article on unique versus repeat scans covers a related trap: counting one person who scans six times as six people.
Which metrics to track
Scan counts alone flatter a campaign. A useful scorecard pairs activity with outcome:
- Total scans and unique scans. Total shows volume, unique approximates reach.
- Scan rate. Scans divided by estimated impressions (print run, footfall or circulation). This is the fairest way to compare a billboard with a leaflet.
- Scans by time and place. Peaks show when people are in a position to scan, and a heat map highlights which cities or venues respond.
- Device split. This tells you whether to design the destination for iOS, Android or both.
- Conversion rate. The share of QR visits that complete your goal, taken from analytics.
- Cost per conversion. Print and placement cost divided by conversions attributed to each code.
A worked example. A retailer prints 2,000 leaflets and 500 window posters. The leaflet code records 120 scans and 18 sign-ups, the poster code 60 scans and 12 sign-ups. The leaflet scan rate is 6%, the poster’s is 12%, and sign-up conversion is 15% against 20%. The poster wins on both counts even though it lost on raw volume. This is invented arithmetic to show the method, not a benchmark.
For more on the four numbers worth watching, see our guide to scaling QR campaigns without reprints.
How to get more scans to attribute
Attribution is only as good as the number of scans it has to work with. The Nielsen Norman Group points out that a QR code carries no information scent on its own, so you need to state what the code does and where it leads. Its guidance also covers linking to mobile-friendly content, placing the code where people are likely to look and making it big enough to scan.
In practice:
- Put a short line next to the code: “Scan for the menu” or “Scan to book a demo”.
- Offer a reason: a discount, a guide, a sign-up shortcut.
- Place it at eye level and at a distance people can actually stand at.
- Keep a quiet margin around it and strong contrast.
- Use your brand colours and logo only if you test that the code still scans.
More ideas are in our list of ways to boost QR code scans. For the analytics side of reading those results, this piece on marketing analytics and ROI helps frame what to report.
What scan data can and cannot tell you
Scan data is useful but narrow.
It can tell you: that a code was scanned, when, on roughly what kind of device and from roughly where, and which tagged visits went on to convert.
It cannot tell you: who the person was, whether they saw the poster once or ten times before scanning, whether a sale in a shop was caused by the scan, or what happened to the people who saw the ad and never scanned. Treat QR attribution as a direct-response measure. It captures the people who act, and it understates the awareness effect of the print itself.
Privacy: collect less, explain more
QR tracking touches on privacy law and consumer expectations in the United States. The Federal Trade Commission has said that online behavioural advertising can raise concerns when people are unaware of cross-site tracking, and that tracking data can be misused or passed to third parties without adequate safeguards. Its COPPA guidance adds that persistent identifiers, such as IP addresses and mobile device identifiers, can be personal information when collected from children under 13, with notice and verifiable parental consent required unless an exception applies. If a campaign targets young audiences, such as toys, schools or family attractions, take advice from a privacy lawyer before you set up tracking.
Safe habits for any campaign:
- Count scans without collecting more than you need. Aggregate analytics usually answers the marketing question.
- Say what you track in your privacy notice and link to it from the landing page.
- Do not pass scan data to third parties you have not vetted.
- Avoid placing tracking cookies on the landing page without a clear reason.
Our guides on QR data privacy and cookieless QR analytics go through the options in detail.
Perspective: attribution only works if the code outlives the campaign
We see the same pattern again and again. A team plans careful UTM tags, prints thousands of pieces, and then a free generator deactivates the codes after a billing lapse or a cancelled plan. The printed material is ruined, and the scan history that justified the spend goes with it.
That is why we built QRlytics around one promise: every code created during an active subscription keeps working permanently, whatever happens to billing afterwards. Attribution is a long game. A catalogue stays on a coffee table for months, packaging sits on a shelf for years, and the best comparison data comes from a code that never breaks.
Dynamic destinations let you fix a wrong link without reprinting. Real-time analytics, global heat maps and CSV export let you see what each placement does and move the numbers into your own reports. Cookieless, GDPR-aware tracking means you get the insight without building a surveillance system.
*The