The QR Code You Created
Is Tracking Everyone
Who Trusts You.
QR code surveillance is not a myth. Free QR generators create tracking codes that log GPS, device, and scan time for every person who scans them — without their knowledge, their consent, or any way to opt out.
Every scan · Every location · Every device · All logged without the scanner ever knowing
You Think the Problem Is Your Data
When most people think about QR code privacy, they think about what happens to them when they scan someone else’s code. They worry about malicious links, phishing sites, data harvested from the destination. That is a reasonable concern. But it is not the primary privacy violation happening with QR codes today.
The real problem is reversed. When you create a QR code with a free generator, you are not creating a link. You are creating a QR code surveillance endpoint that tracks everyone who trusts you enough to scan it.
You are not the victim in this scenario. You are, unknowingly, the agent of QR code surveillance. The platform used your action — creating a code — to insert a tracker into the hands of everyone connected to your business, your event, your restaurant, your life. And because they agreed to their terms of service with you, not with the scanners, the entire operation is completely legal.
The people who scan your QR code trust you. They do not know a third-party surveillance system is recording their location. [EFF Privacy Research] You did not intend this. But intention does not change what the infrastructure does — and the infrastructure was designed to extract data, not to connect people.
The Trap You Set Without Knowing
You printed QR codes for your restaurant menu during COVID. Every customer who scanned it to see what was for lunch became a subject of QR code surveillance — GPS location, device model, operating system, browser type, and exact scan timestamp all logged to a server you never controlled.
You put a QR code on your business card linking to your portfolio. Every person at that networking event who scanned it became a target of QR code surveillance — location, device characteristics, and whether they scanned again later — all recorded in a database you do not own and cannot access without upgrading to a paid tier.
You created a QR code for your event flyer. Every attendee who scanned it to RSVP became a data point in a QR code surveillance system they never knew existed. If they scanned it a second time to check details later, that was logged separately, building a behavioral pattern profile without their knowledge.
You did not intend to surveil these people. But you did. And you did it because the free tool made dynamic tracking codes the default — and never explained what that meant.
QR Code Surveillance Explained: Dynamic vs Static QR Codes
The QR code format itself is an open standard — ISO/IEC 18004 — and it is completely neutral. A QR code is just a mathematical encoding of text. QR code surveillance is not a feature of the QR format itself. It is a feature of the business model layered on top by free platforms that profit from data collection.
Understanding the difference between dynamic and static codes is the foundational knowledge that most free QR generators have a financial incentive not to teach you clearly. This is how QR code surveillance stays invisible to the people it affects most.
- Redirects through the company’s server first
- Logs GPS coordinates for every scan
- Records full device fingerprint
- Captures OS version and browser type
- Timestamps every individual scan
- Builds multi-scan behavioral profiles
- Code dies if the company shuts down
- Data sold to advertising networks
- You cannot delete the collected data
- Destination encoded directly in the pattern
- No server redirect of any kind
- Zero tracking architecturally possible
- No data logged anywhere
- No analytics dashboard to sell
- Works completely offline
- Never expires — permanent by design
- Nothing to sell to anyone
- Scanner interacts with your destination directly
The mechanism of QR code surveillance is simple. A dynamic QR code does not contain your final destination. It contains a short redirect URL owned by the QR platform — something like bit.ly/a8f3k2 or qr.io/x7h2p. When someone scans the code, their device connects to that platform’s server first. The server logs everything it can about the scan, then redirects to your actual destination. The entire transaction takes milliseconds. The scanner never notices. But the log entry is permanent.
A static QR code contains the final destination directly in its pattern. Scan it, and your phone goes straight there. No server. No redirect. No log entry. The QR code is pure geometry — a mathematical encoding of text. There is nothing to track because there is no middleman. The surveillance is not technically possible when the code is static.
Data flow of a dynamic QR scan · GPS · Device fingerprint · OS · Browser · Timestamp — all before the redirect completes
The QR Code Surveillance Data Captured From Every Single Scan
When someone scans a dynamic QR code, the tracking server captures a detailed technical snapshot before the redirect even completes. This happens in milliseconds. The scanner sees nothing unusual — the link just works. But on the backend, a permanent database entry is created containing at minimum the following data points.
QR Code Surveillance Is Legal. You Made It So.
When you created that QR code, you agreed to the platform’s Terms of Service. Somewhere in those terms — typically buried in Section 8 or 12 under “Analytics” or “Service Improvement” — there is language granting the company rights to collect, use, and share data derived from scans of codes you generate. You consented. Legally, you are covered.
But the people who scan your code never consented to anything. They trusted you. They pointed their camera at a piece of paper or a screen you controlled. They assumed the code was just a link. They had no idea a third party was logging their location before the redirect even completed.
This is the structural asymmetry at the heart of QR code surveillance. The legal relationship exists between the platform and you. There is no legal relationship between the platform and the scanner. So the scanner has no rights to enforce, no data to request, no opt-out to exercise. They are not a user of the platform. They never agreed to anything. They just scanned a code that someone they trusted put in front of them.
Scanner sees your QR code on a flyer, business card, restaurant table, or product packaging. They point their camera and tap the notification.
Their device connects to the QR platform’s tracking server. The platform reads their IP address, device headers, and any location data available.
The tracking server creates a permanent database entry associating this scan with your QR code, the scanner’s device profile, and the geographic data.
The platform redirects to your actual destination. The scanner sees your content. Everything appeared normal. They have no idea steps 02 and 03 occurred.
The logged data is packaged with data from thousands of other QR codes on the same platform and sold to advertising networks, data brokers, or used to train targeting algorithms.
When The Company Dies, So Does Your Code
Dynamic QR codes have a second critical failure mode beyond QR code surveillance: they are not permanent.
You printed 10,000 flyers with a QR code. You embedded the code in product packaging that ships internationally. You etched it onto permanent signage. That code points to a redirect URL on a server owned by the QR platform. If that platform shuts down, rebrands, gets acquired, or decides to discontinue its free tier, your code becomes a dead link. Every piece of printed material with that code becomes worthless overnight.
This has already happened. When the platform behind the QR code surveillance redirect shuts down, every code it hosted dies with it. Multiple QR platforms from the 2010s no longer exist. Codes printed on permanent materials now point to 404 errors. The investment in printing, distribution, and signage is irreversible. The content is gone. There is no migration path for a QR code already printed on physical materials.
| Property | Dynamic QR (Tracking) | Static QR (Private) |
|---|---|---|
| Destination editable after print? | Yes — via platform dashboard | No — fixed in the pattern |
| Works if platform shuts down? | No — immediate dead link | Yes — forever |
| Tracks scanner location? | Yes — GPS per scan | No — architecturally impossible |
| Requires account? | Yes — for code management | No — none required |
| Data owned by third party? | Yes — scan data is theirs | No — nothing to own |
| Scan speed (redirect latency)? | Slower — server round-trip required | Faster — direct navigation |
Static QR codes · Permanent by design · No server dependency · No scan tracking · No expiration risk
Static QR Codes: No Server. No Tracking. No Expiration.
The solution to QR code surveillance is technically simple. The QR code open standard — ISO/IEC 18004 — does not require a server. It never did. The entire redirect architecture was added by platforms who needed a business model on top of an open format. Remove the platform, and you remove the surveillance.
A static QR code generator eliminates QR code surveillance by design — encoding your destination URL directly into the QR pattern using the open standard. The code is generated entirely in your browser using JavaScript — no file uploaded, no server contacted, no account created. The QR code image is created locally on your device and downloaded immediately. Nothing leaves your machine.
When someone scans it, their device reads the pattern, extracts the URL, and navigates directly to that destination. No redirect. No middleman. No log entry. Nothing to track because there is no server in the transaction at all.
Static QR codes are technically superior to dynamic ones in every way except one: they do not generate surveillance data that can be monetized. That is not a technical limitation. That is a design choice by platforms that profit from knowing where your audience goes.
You Are Not the Villain. The System Is.
You used a free tool because it was convenient. You did not intend to enable QR code surveillance on the people who trusted you. You did not read 47 pages of terms and conditions because nobody does. You created QR codes because that is how event flyers and restaurant menus and business cards work now. You did nothing wrong.
But the result of QR code surveillance is the same: everyone who trusted you enough to scan your code had their location logged, their device fingerprinted, and their behavior profiled — without their knowledge and without their consent. That data sits in a database owned by a company you never chose to do business with on behalf of people who had no say in the matter.
The fix is not to stop using QR codes. The fix is to use static QR codes that have no QR code surveillance architecture embedded in them by design.
Static codes exist. Tools to generate them locally exist. There is no technical barrier to ending QR code surveillance on your end. There is no cost barrier. There is only the awareness barrier — and you just crossed it. The people who scan your next QR code will not know what changed. But they will be better off because of it.
Create a private static QR code now →