The black-and-white square printed on cereal boxes, wine bottles, and cosmetics packaging was not designed with consumers in mind. QR codes were invented in 1990s Japan to track automotive parts through manufacturing lines - a logistical tool, not a marketing one. Decades later, they have migrated from factory floors to kitchen shelves, and the data they can help collect when scanned raises serious questions about consumer privacy that the packaging industry has been slow to confront.
What a QR Code Actually Does When You Scan It
A QR code, at its most basic, is a machine-readable web address. It does nothing on its own. The moment a consumer scans one, however, their device is directed to a website - and that transition opens a channel through which companies may be able to capture data including the time of the scan, approximate location, device type, and product batch number. What gets recorded depends on how the underlying system is configured, what analytics platforms are connected, and what a company's terms and conditions permit.
The picture grows more complicated when third-party QR management platforms are involved. Rather than directing a user straight to a brand's website, some codes route traffic through an external platform first - adding an additional layer of data processing before the consumer reaches their intended destination. The user is unlikely to know this is happening. The URL that flashes briefly on a phone screen before a scan completes gives no meaningful indication of where the data will travel or who will receive it.
Tom Sulston, head of Policy at the NGO Digital Rights Watch, draws a direct line between QR code scanning and the broader web-tracking ecosystem. "Data brokers tend to follow people around the web as much as they possibly can," he says. "Their business model is predicated on knowing as much about an individual as possible. So it's very likely that following QR codes printed on packaging will result in the user being tracked - even if they're not logged into a specific system."
His concern is not abstract. Web-tracking infrastructure is pervasive, and most major analytics and advertising systems are built to aggregate behavioral data across sessions and devices. A consumer who scans a QR code on a medicine box, a dietary supplement, or an over-the-counter health product is, in effect, announcing that interest to whatever data systems sit behind that code. "You could easily imagine insurers being interested in the medical products that a person is looking at on the web," Sulston notes.
The Industry's Defense - and Where It Falls Short
Appetite Creative's managing director Jenny Stanley and Polytag CEO Alice Rackley both argue that consumer agency provides an inherent safeguard. Because scanning a QR code is a deliberate act, they suggest it is categorically different from passive tracking technologies like browser fingerprinting or behavioral advertising cookies, which operate invisibly and without active participation.
"A QR code is the opposite of covert tracking. It does nothing until a consumer actively chooses to scan it - it's an invitation, not a beacon," Stanley says. Rackley adds that personal information is only shared if a consumer volunteers it - for a competition entry, a survey, or a marketing email sign-up - and that platforms operating under GS1-approved frameworks use QR codes primarily to deliver practical value, such as product information and food safety updates.
These are reasonable points, but they address only part of the risk. The opt-in framing assumes that consumers understand what they are opting into - and that assumption is fragile. Sulston identifies a fundamental transparency problem: a QR code "doesn't easily allow a human to know where they're about to visit on the internet before opening it." Unlike a typed web address, or even a hyperlink that displays a destination URL on hover, a QR code is opaque to the human eye. Scanning an unfamiliar one is, as QR code company Flowcode has put it, comparable to opening a front door to a stranger.
Stanley herself acknowledges that the industry has not kept pace with the technology it has deployed. "Standards are moving faster than shared best practice on consent design," she says. "As an industry, we should be doing more - consistent opt-in, plain-language data-use disclosure, and privacy-by-design with GDPR and CCPA built in from the start, not bolted on." That candid admission suggests the gap between what is technically possible and what is routinely practiced remains wide.
Regulation, Accountability, and What Genuine Transparency Requires
Legal frameworks do exist. The European Union's General Data Protection Regulation and California's Consumer Privacy Act both establish obligations around data collection, consent, and transparency. Under GDPR, accountability sits with the brand as data controller and its technology partners - not with the consumer who scanned the code. The principle, as Stanley summarizes it, is straightforward: collect only what you need, be transparent about why, and return real value to the consumer.
The difficulty is enforcement and, more fundamentally, the gap between legal compliance and genuine informed consent. Sulston argues that company transparency, while necessary, is "not really sufficient." Terms and conditions - the documents in which data practices are typically disclosed - are, he says, "long and unwieldy," and most consumers do not read them. A privacy policy buried behind a QR-code-linked webpage is not the same as meaningful disclosure at the point of interaction.
What genuine best practice would look like is not technically complicated. Plain-language disclosure before or immediately after a scan, a clear indication of which third parties may receive data, a real opt-out mechanism, and data minimization - collecting only what is operationally necessary - are all achievable within current technology. The barrier is not capability; it is commercial incentive. QR codes have become a valuable first-party data collection tool at a moment when third-party cookies are being phased out, and that gives brands a strong reason to keep the data pipeline as wide and as frictionless as possible.
As QR codes become embedded in everyday consumer behavior - replacing paper inserts, enabling digital product passports, and connecting physical packaging to online ecosystems - the privacy questions they raise will only grow more pressing. The technology is not inherently harmful, but treating it as a neutral design feature ignores what it has become: an analytical marketing instrument that operates at the intersection of the physical and digital worlds, in a space where consumer awareness remains low and industry self-regulation has, so far, lagged meaningfully behind.
