Privacy · QR Codes
QR Codes Without the Spy: How to Share Links Privately with QR Codes
QR codes are everywhere — on restaurant menus, conference badges, product packaging, business cards, and digital ads. They're the fastest bridge between the physical world and the web. But here's the problem nobody talks about: most QR code generators are surveillance tools in disguise.
Every time someone scans a QR code created with a typical shortener, the service behind it logs the scanner's IP address, device type, operating system, approximate location, timestamp, and sometimes even a unique device fingerprint. The person scanning has no idea this is happening. They just wanted to visit a URL.
If you care about your audience's privacy — whether you're an affiliate marketer, a publisher, or a business distributing QR codes at scale — you need a better approach. This guide explains how QR code tracking works behind the scenes, why it's a privacy risk, and how to generate QR codes that respect your users.
How Traditional QR Code Services Track Scanners
When you generate a QR code with most popular services, you're not just encoding a URL into a square matrix of dots. You're encoding a redirect URL — a link that passes through the service's servers before forwarding the user to the final destination. That pass-through is where the data collection happens.
Here's a typical flow:
You create a QR code for https://example.com/landing. The service gives you a QR code pointing to https://qr-service.com/abc123.
A user scans the code with their phone camera. Their browser sends a request to qr-service.com, including their IP address, User-Agent string, Accept-Language header, and the HTTP Referrer (if applicable).
The QR service logs all of that data, associates it with scan ID abc123, and then redirects the user to example.com/landing — often passing along the Referrer header, which tells the destination site that the user came through qr-service.com.
The destination site now knows the traffic source, and the QR service has a detailed profile of every single scan — time, location, device, frequency.
Multiply this by thousands of scans at a conference or on a product label, and you've built a geo-tagged behavioral database of your audience — without their knowledge or consent.
GDPR alert: Under the GDPR, IP addresses are classified as personal data. If you're distributing QR codes to an EU audience and your QR service logs IPs without a lawful basis or proper disclosure, you may be non-compliant — even if you never see the raw data yourself. The processor (the QR service) is handling personal data on your behalf.
The Referrer Problem on Mobile
There's a specific privacy leak with QR codes that's often overlooked: the HTTP Referrer header on mobile browsers.
When a user scans a QR code, their phone's default browser opens the URL. If that URL is a redirect through a shortener, the browser may send the shortener's domain as the Referrer to the final destination. This creates two problems:
- The destination site learns the traffic source. If you're an affiliate marketer using QR codes on printed materials, the merchant can see your shortener domain and potentially reverse-engineer your distribution strategy.
- The shortener's redirect chain can leak the original page context. On some mobile browsers, especially older Android WebViews, the Referrer header behavior is inconsistent and can expose more information than expected.
This is why referrer stripping isn't just a nice-to-have for QR codes — it's essential. A QR code that redirects through a privacy-first service with proper referrer suppression ensures that the destination URL receives a clean visit with no traceable origin.
What a Privacy-First QR Code Looks Like
A truly private QR code needs to satisfy three criteria:
- No scan logging: The redirect service should not store IP addresses, device fingerprints, or location data tied to individual scans.
- Referrer stripping: The HTTP Referrer header must be removed before the user reaches the destination, so the target site cannot trace the visit back to the QR code service or the context in which it was scanned.
- No third-party scripts: The redirect page itself should not load analytics scripts, ad pixels, or social media trackers that could fingerprint the user during the milliseconds it takes to redirect.
At TraceNull, our QR code generation (available on Business plans) follows all three principles. When you create a short link and generate a QR code for it, here's what happens when someone scans it:
That's our 3-layer referrer stripping architecture: Caddy (reverse proxy), Node.js (application), and an HTML meta tag — because defense in depth matters when you're protecting someone's privacy.
Why three layers? Any single layer can fail. A misconfigured Caddy rule, a Node.js middleware bug, or a browser that ignores meta tags — all are possible. By stripping the Referrer at every level of the stack, we ensure that no single point of failure can leak your users' data.
QR Codes for Affiliate Marketers: Privacy as Strategy
If you're an affiliate marketer distributing QR codes on physical materials — flyers, packaging inserts, event handouts — privacy-first QR codes aren't just ethical. They're strategic.
Consider these scenarios:
| Scenario | Traditional QR Service | TraceNull QR |
|---|---|---|
| Merchant sees traffic source | Yes — referrer exposes your shortener domain | No — referrer stripped at 3 layers |
| QR service builds audience profile | Yes — IP, device, location logged per scan | No — zero personal data stored |
| Competitor reverse-engineers your funnel | Possible — public scan counters and referrer data | No — no public analytics, no leaks |
| GDPR compliance for EU audience | Requires DPA with QR service, cookie notice | Compliant by default — no personal data processed |
When a merchant can't see where your traffic comes from, they can't cut you out of the deal by targeting the same channels directly. When a QR service doesn't build scan profiles, there's no data to breach, subpoena, or sell. Privacy protects your business model as much as it protects your audience.
How to Create a Privacy-First QR Code with TraceNull
Here's the practical walkthrough:
Create a short link. Go to tracenull.cc and shorten your destination URL. On the Business plan, you'll get a 2-character slug (e.g., tracenull.cc/a7) with a 365-day TTL.
Generate the QR code. Business plan users can generate a QR code directly from the dashboard. The QR code encodes your short link — not the destination URL — so the redirect passes through TraceNull's referrer-stripping pipeline.
Optional: Add password protection. If your QR code is for a restricted audience (e.g., VIP customers, internal team links), enable password protection on the short link. Scanners will see a clean password prompt before being redirected.
Optional: Attach UTM parameters. Use the built-in UTM builder to add campaign parameters to the destination URL. The UTM data travels to your own analytics (like Plausible or Matomo) — TraceNull doesn't read or store it.
Download and distribute. Print the QR code on your materials. Every scan will be referrer-free and tracker-free.
But What About Scan Counts?
A fair question: if TraceNull doesn't track users, how do you know if your QR codes are working?
We count aggregate redirects — not people. Our system increments a counter each time a short link is accessed, but it does not associate that count with an IP address, a device, a location, or a timestamp tied to a specific user. You get a total click count. You don't get a surveillance dossier.
For more granular campaign analytics, pair your QR codes with UTM parameters pointing to a privacy-respecting analytics tool on your own domain. That way, the data lives on your infrastructure under your control — not on a third-party QR service's servers.
The principle: You should be able to measure campaign performance without a third party building a shadow profile of your audience. Aggregate counts + first-party UTM analytics give you everything you need.
Choosing a QR Code Solution: What to Ask
If you're evaluating QR code tools, here are the questions that matter:
- Does the service store IP addresses? If yes, it's processing personal data under GDPR. You need a Data Processing Agreement and potentially a cookie notice on the redirect page.
- Does the redirect strip the Referrer header? If no, your destination URL (and its analytics) will see the QR service's domain — or worse, the page the user was on before scanning.
- Does the redirect page load third-party scripts? Check with your browser's dev tools. Many QR services load Google Analytics, Facebook Pixel, or ad scripts on their redirect pages — fingerprinting your users in transit.
- Where is scan data stored, and for how long? Some services retain scan data indefinitely and reserve the right to use it for their own analytics products.
- Can you self-host or use a custom domain? Custom domains (available on TraceNull Business) mean the QR code points to your own branded domain, reducing dependency on a third party.
The Bottom Line
QR codes are one of the most frictionless ways to bridge offline and online experiences. But that frictionlessness cuts both ways: users scan without thinking, and most QR services exploit that trust to collect data silently.
Building QR codes on top of a privacy-first short link service flips the model. Your audience gets a clean redirect with no referrer leakage and no scan profiling. You get aggregate performance data without the compliance headaches. And your campaigns stay strategically opaque to competitors and merchants alike.
Privacy isn't a feature you bolt on after the fact. It's an architecture decision — and with QR codes, it starts at the link layer.
Generate Privacy-First QR Codes
TraceNull Business includes QR code generation, custom domains, password-protected links, UTM builder, and 3-layer referrer stripping — all with zero user tracking. See what private link sharing looks like.
View Business Plan