How to track QR code campaigns: UTM parameters, dynamic codes and A/B tests

A QR code campaign with no tracking is a poster you can never learn from. Tracking is cheap to set up and costs nothing to run, but it has to be designed in before the codes are printed. This guide shows the two ways to do it, when to use each, and what the numbers mean.

Two ways to count a scan

There are two methods, and they measure slightly different things.

UTM parameters are extra pieces of text on the end of a URL, such as ?utm_source=poster&utm_medium=qr&utm_campaign=spring. The page loads exactly as normal, and your web analytics records the source, medium and campaign of the visit. UTM works with any static QR code and any analytics tool. The cost is a longer URL, which means a denser code.

A dynamic QR code holds a short redirect link. When scanned, the redirect service counts the scan, records the time and approximate location, then forwards the phone to the real page. The code stays short, and you can change the destination later. The cost is that you depend on the redirect service staying online.

Step 1: give every placement its own code

Tracking only tells you something if you can compare. A campaign with one code on the poster, the leaflet and the bus shelter reports one number, and you cannot tell which placement earned it. Make a code for each placement you want to compare. Same destination, different tag.

Worked example, UTM style. Three codes, one destination:

• Poster: https://example.org/spring?utm_source=poster&utm_medium=qr&utm_campaign=spring
• Leaflet: https://example.org/spring?utm_source=leaflet&utm_medium=qr&utm_campaign=spring
• Bus shelter: https://example.org/spring?utm_source=busshelter&utm_medium=qr&utm_campaign=spring

Keep utm_medium as qr on all of them. Then one filter in your analytics shows every QR visit, and the source splits them by placement.

Step 2: keep the URL short enough to print

UTM parameters add length, and length adds modules. The 56-character link below fits a version 4 code, 33 modules wide. Add three UTM parameters and it becomes 108 characters and version 7, 45 modules wide. At the same printed size each module is about a quarter smaller, so the code needs to be printed larger to stay readable. The two codes below encode the same base link, with and without tracking.

Two fixes. Shorten the parameter values, s=p&m=qr&c=sp still works if your analytics is set up to read them, though the standard utm_ names work everywhere. Or use a dynamic code, which keeps the printed URL short and adds the UTM parameters at the redirect. The capacity calculator shows the version for any URL.

Step 3: know what the numbers mean

Analytics can tell you how many scans happened, when, roughly where, and on what kind of phone. That is enough to compare placements, spot the best time of day and see whether a poster in a new location is worth keeping.

Analytics cannot tell you who scanned. It cannot tell you how many people saw the code and walked past. It counts scans, not people, so one person scanning twice looks like two. And a scan that never reaches the page, because the signal dropped or the reader gave up, is counted by a dynamic redirect but not by UTM.

Step 4: run a simple A/B test

An A/B test compares two versions of one thing, changing one variable. QR codes make this easy because each version can carry its own tag. Worked example: a café wants to know whether a call to action helps. It prints two batches of table cards. Batch A has the code alone. Batch B has the same code with Scan for today’s specials printed above it. Each batch has its own code, utm_content=plain and utm_content=cta, and the cards are spread evenly across tables for two weeks.

At the end, compare scans per card. If B wins clearly, the call to action stays. Change only one thing per test, or you will not know which change made the difference.

Step 5: respect privacy

Counting scans by time and country is aggregate data and rarely a concern. Anything that identifies a person is different. Under GDPR, storing an IP address or a persistent device identifier is processing personal data. You need a lawful basis, and you should say what you collect near the code, for example a short line and a link to your privacy notice on the poster. Check what your dynamic code provider records by default, and turn off anything you do not need. The analytics explainer goes deeper into what a redirect can and cannot see.

Checklist

• Chose UTM, dynamic codes or both before the artwork went to print
• One code per placement to be compared
• utm_medium=qr on every tracked code, a distinct utm_source per placement
• URL kept short enough for the printed size, checked with the capacity calculator
• Own test scans filtered out before launch
• A/B tests change one variable at a time
• Privacy notice near the code and no unnecessary personal data collected
• Destination page checked on a phone on mobile data
• Report reviewed after two weeks and again at the end of the campaign