Can a QR Code Track Your Location? What Scan Analytics Really See

No — a QR code cannot access your GPS or find where you are. Scanning one only opens a link; the code has no software and no sensors and learns nothing about you. Anything that could ask for your location comes from the website behind the link, not the code. And a scan-analytics service only sees coarse technical details — Enqre, for example, stores no location at all, not even a country, and never your raw IP address.

A QR code is a printed link, not a tracker

A QR code is a pattern of squares that encodes some text — almost always a web address. Your camera reads that text and offers to open it. The code cannot run code, cannot read your GPS, camera roll or contacts, and cannot phone home. It is as passive as a printed URL on a poster. "Can it track me" is really two different questions: what the code does (nothing), and what happens after you open the link.

What actually happens when you scan

The code hands your phone a URL and your phone opens it. From that point it is an ordinary web visit: the destination site can do whatever any website does — set cookies, ask the browser for location permission (which you would have to grant), or run its own analytics. That is the site's behaviour, not the QR code's. The lesson for a cautious scanner: the code is harmless; judge the destination.

What a dynamic-QR analytics service can see

A dynamic code routes each scan through a redirect, so the service running it can record details of the request: the time, the device type, the operating system and browser as the request reports them, and the referrer. Many services also derive a rough location from the visitor's IP address — city or country level. That is a choice the provider makes, and it is worth knowing which providers do it.

What Enqre deliberately does not collect

We built the analytics to answer "how is this code performing" without following anyone. So a scan records the time, which code it was, device type, OS and browser, and the referrer — and then:

• No location at all — no coordinates, no city, and no country are derived from a scan.
• No raw IP stored — only a salted hash, used to count unique visitors, which cannot be turned back into the address.
• No identity and nothing cross-site — no name, no account, nothing that follows a person to another site.

You get real numbers — scans, trends, devices, referrers — with nothing that identifies a person. See how to track QR code scans and the privacy and GDPR details.

So where is the real risk?

Not in being located by a sticker. The genuine risk is a malicious code — a fake QR stuck over a real one that sends you to a phishing page ("quishing"). The defence is the same as for any link: look at the URL before you act on it. More in QR code scams and quishing.

Frequently asked questions

Can a QR code get my GPS location?

No. The code cannot access your location. Only the website you open could ask for it, and only with your explicit permission in the browser.

Can a QR code access my camera, contacts or photos?

No. Scanning uses your camera to read a pattern; the code cannot reach into your phone. It just produces a link.

Does scanning a QR code reveal who I am?

Not by itself. The code carries no identity. A dynamic-code service sees technical request details; whether that includes location depends on the provider. Enqre stores none.

Can the business behind the code see my exact location?

Not from the scan. At most, providers that use IP geolocation infer a city or country — never a precise position. With Enqre, not even a country.

Is it safe to scan QR codes, then?

The scanning is safe — the code cannot harm or locate you. Caution belongs at the destination: check the link before opening, especially on codes in public places.

Measure your codes without collecting personal data — create one free or read the plans.