---
title: "What data you can collect from QR code scans (location, device, behavior)"
description: "A concrete list of QR scan data points, accuracy limits, and compliance notes for privacy-safe tracking."
canonical: "https://linkbreakers.com/help/article/what-data-you-can-collect-from-qr-code-scans-location-device-behavior"
last-updated: 2026-10-24
---

# What data you can collect from QR code scans (location, device, behavior)

> A concrete list of QR scan data points, accuracy limits, and compliance notes for privacy-safe tracking.

QR code scans in Linkbreakers capture scan events, device information, actor detection, IP-based location and the steps visitors take through your workflow.

What is captured depends on the data collection level you choose (None, Basic or Advanced). Personal details such as email, name and phone are only stored when visitors type them into your forms. You remain responsible for using this data in line with [GDPR](https://linkbreakers.com/help/article/what-is-gdpr-and-how-does-linkbreakers-handle-it) and other privacy laws that apply to you.

## Concrete data list (at a glance)

- **Timestamp** and time zone
- **Approximate location** (city/region from IP, no GPS)
- **ISP and ASN** (network provider and routing entity)
- **Device type**, detected actor, and OS
- **Browser** and user agent
- **New vs repeat** visitors (recognized with a first-party cookie)
- **Entry and destination URLs**
- **Campaign tags** and UTM parameters
- **Workflow events** (clicks, form submits, conversions)

## Full data reference

### Core event data (captured automatically on every scan)

| Data Field | Type | Privacy Level | Description |
|---|---|---|---|
| **Event ID** | string (UUID) | Technical | Unique identifier for the event object |
| **Action** | enum | Technical | First-time scan or recurring scan from the same device |
| **HTTP Method** | enum | Technical | The HTTP request method used (typically GET) |
| **Scanned At** | timestamp | Technical | When the QR code or link was accessed |
| **Triggered By** | enum | Technical | Indicates the scan was initiated by a visitor (not automated) |
| **Entrypoint** | string | Technical | Short link URL that received the request |
| **Destination** | string | Technical | Final resolved destination after workflow evaluation |
| **Link ID** | string (UUID) | Technical | Identifier of the link producing the event |
| **Device ID** | string (UUID) | Technical | Device identifier derived from the first-party `linkbreakers.browser` cookie |
| **Visitor ID** | string (UUID) | Technical | Visitor profile associated with the event |
| **Workspace ID** | string (UUID) | Technical | Identifier of the owning workspace |
| **Created At** | timestamp | Technical | Timestamp when the event object was created |
| **Updated At** | timestamp | Technical | Timestamp when the event object was last updated |
| **Journey** | object | Technical | How far the visit got through the link's workflow: steps reached, steps on the path, and whether it reached an exit (optional, `include=journey`) |

### Geographic and location data (Basic and Advanced)

Location is derived from the IP address with a local MaxMind GeoLite2 database. No GPS position, latitude and longitude or postcode is collected.

| Data Field | Type | Privacy Level | Description |
|---|---|---|---|
| **Timezone** | string | Geographic | Visitor's timezone identifier (e.g. America/New_York, Europe/London) |
| **Country** | string | Geographic | Two-letter country code determined from IP address |
| **Region** | string | Geographic | Geographic region or state determined from IP address |
| **State** | string | Geographic | State or province when location can be determined |
| **City** | string | Geographic | City location estimated from IP address |
| **ISP** | string | Geographic | Internet Service Provider or network organization name |
| **ASN** | uint32 | Geographic | Autonomous System Number identifying the network routing entity |

### Device and browser data

In the Collection column, Basic fields are captured at the Basic and Advanced levels, and Advanced fields only at the Advanced level.

| Data Field | Type | Collection | Privacy Level | Description |
|---|---|---|---|---|
| **Device Type** | enum | Basic | Technical | Physical form factor: mobile, tablet, desktop, or unknown |
| **Device Actor** | enum | Basic | Technical | Who or what is operating the device: human, bot, agent, or unknown |
| **Device Actor Name** | string | Basic | Technical | Specific non-human actor when detected, such as Googlebot, GPTBot, or ClaudeBot |
| **Device Actor Origin** | string | Basic | Technical | Company or organization behind the detected non-human actor, such as Google, OpenAI, or Anthropic |
| **Device Name** | string | Basic | Technical | Specific device model (e.g. iPhone 14 Pro, MacBook Air) |
| **Device Brand** | string | Basic | Technical | Manufacturer: Apple, Samsung, Google, Microsoft, etc. |
| **Device Memory** | double | Advanced | Technical | RAM available on the device in gigabytes |
| **Device Concurrency** | int32 | Advanced | Technical | Number of processor cores |
| **Screen Width** | double | Advanced | Technical | Width of the device screen or browser window in pixels |
| **Screen Height** | double | Advanced | Technical | Height of the device screen or browser window in pixels |
| **Screen Ratio** | double | Advanced | Technical | Aspect ratio calculated from width and height |
| **GPU** | string | Advanced | Technical | Graphics processor information used for rendering |
| **Browser Name** | string | Basic | Technical | Chrome, Safari, Firefox, Edge, etc. |
| **Browser Version** | string | Basic | Technical | Browser version string |
| **Browser Language** | string | Basic | Technical | Language and locale preferences from the visitor's browser |
| **Platform Name** | string | Basic | Technical | Operating system: iOS, Android, Windows, macOS, or Linux |
| **Platform Version** | string | Basic | Technical | Operating system version string |
| **Touch Screen** | bool | Advanced | Technical | True if the device supports touch input |
| **Network Connection** | string | Advanced | Technical | Type of internet connection: wifi, 4g, 3g, ethernet, etc. |
| **Network Bandwidth** | double | Advanced | Technical | Estimated connection speed in megabits per second |
| **Network RTT** | double | Advanced | Technical | Network latency (ping time) in milliseconds |
| **User Agent** | string | Basic | Technical | Complete browser identification string |
| **IP Address** | string | Basic | Personal | Internet address used to connect to the QR code, stored in full |
| **Last Used At** | timestamp | Basic | Technical | Last time this device was associated with an event |

### Personal data (only collected via form submission)

| Data Field | Type | Privacy Level | Description |
|---|---|---|---|
| **Email** | string | Personal | Email address provided through form submission |
| **Phone** | string | Personal | Phone number provided through form submission |
| **First Name** | string | Personal | First name provided through form submission |
| **Last Name** | string | Personal | Last name provided through form submission |
| **Custom Attributes** | Struct | Personal | Any additional form fields or custom data provided by the visitor |

Form answers are stored as visitor attributes at every collection level and may be summarized by OpenAI.

### Data collection level comparison

Set the level for the workspace or per link. A workspace with no setting uses None.

| Data Category | None | Basic | Advanced |
|---|---|---|---|
| **Scan time, link, destination** | ✓ | ✓ | ✓ |
| **Workflow steps** | ✓ | ✓ | ✓ |
| **`linkbreakers.browser` cookie (returning browser)** | ✓ | ✓ | ✓ |
| **IP address** | ✗ | ✓ | ✓ |
| **User agent, device type, brand and model** | ✗ | ✓ | ✓ |
| **Browser and OS with versions** | ✗ | ✓ | ✓ |
| **Language and time zone** | ✗ | ✓ | ✓ |
| **Country, region, city** | ✗ | ✓ | ✓ |
| **ISP and ASN** | ✗ | ✓ | ✓ |
| **Screen size and ratio** | ✗ | ✗ | ✓ |
| **Hardware details (GPU, memory, CPU cores)** | ✗ | ✗ | ✓ |
| **Touch support** | ✗ | ✗ | ✓ |
| **Network information (connection, bandwidth, RTT)** | ✗ | ✗ | ✓ |

## Accuracy limits to understand

- **Location is approximate**: it comes from the IP address and is typically city-level at best. GPS is not collected.
- **Returning visitors rely on a cookie**: the `linkbreakers.browser` cookie can under- or over-count on shared devices, private browsing or when cookies are cleared.
- **VPNs reduce geo accuracy**: scans still count but location may be off.

## Technical and device data collection

### Device and browser information

Operating system data reveals whether visitors use iOS or Android devices, helping optimize mobile experiences for your actual audience. Understanding OS distribution helps prioritize development efforts and ensure compatibility across the platforms your customers actually use.

Browser information shows whether visitors scan and continue browsing in Safari, Chrome, or other mobile browsers. Browser data helps optimize web experiences for the applications your audience prefers and identify potential compatibility issues.

Actor detection separates the hardware from the entity behind the request. This helps distinguish real human visitors from crawlers and AI agents, so reporting, routing, and attribution stay cleaner when non-human traffic reaches a QR code or short link.

Screen resolution and device specifications reveal whether visitors use flagship smartphones with large screens or older devices with different capabilities. Device specifications help optimize visual design and user interface elements for the devices your audience actually owns.

Network connection data shows whether visitors scan while connected to WiFi networks or using cellular data. Connection information helps optimize page loading speeds and content delivery for the network conditions your audience typically experiences.

### Location and geographic intelligence

IP geolocation provides approximate location data, offering country, regional and city-level insights. IP-based location helps understand audience distribution and market penetration. Linkbreakers does not collect GPS coordinates.

Network provider intelligence captures Internet Service Provider (ISP) names and Autonomous System Numbers (ASN) from IP addresses. ISP data identifies which telecommunications companies your visitors use, while ASN reveals the specific network routing entities. This information helps detect corporate networks, educational institutions, cloud services, VPN usage, and hosting providers, valuable for B2B lead qualification, security analysis, and understanding whether visitors are engaging from business or residential contexts.

Time zone information helps understand when audiences in different regions are most active and responsive. Time zone data supports global campaign optimization and scheduling for maximum engagement effectiveness.

### Temporal and behavioral patterns

Scan timing data captures exactly when visitors engage with QR codes, revealing daily patterns, peak activity periods, and audience behavior rhythms. Timing insights help optimize campaign scheduling and resource allocation for maximum impact.

Return visit behavior identifies visitors who engage multiple times, indicating sustained interest and relationship development potential. Repeat engagement patterns help identify high-value audience segments for focused attention.

Workflow tracking follows visitors through the steps of your Linkbreakers workflow, from the scan to the step where they leave. Pathway data reveals optimization opportunities and measures the effectiveness of different conversion designs.

## Visitor identification

### Returning visitor recognition

The first-party `linkbreakers.browser` cookie, set on the link's domain for one year, lets Linkbreakers recognize a browser that scans again. Device identifiers are derived from it per workspace. This is not fingerprinting, and the cookie is not used for advertising.

### Identification through forms

Email capture through forms provides direct visitor identification when individuals willingly share contact information. Email collection enables ongoing communication and relationship development with engaged prospects.

Survey-style forms capture visitor characteristics and preferences through voluntary answers. Form data provides qualitative insights that complement scan analytics.

## Privacy compliance and data governance

### Legal requirements and regulations

With [eight new U.S. state privacy laws taking effect in 2025](https://www.lexology.com/library/detail.aspx?g=fe9e7b45-fbbf-4906-972f-9d541f5516d1), and GDPR fines reaching EUR 20M or 4% of global revenue for non-compliance, businesses must prioritize privacy-compliant data collection strategies to avoid substantial financial penalties.

GDPR requires a lawful basis for processing personal data, such as consent or legitimate interest, and clear privacy notices explaining data usage. European regulations mandate visitor control over their data and the right to request deletion.

CCPA compliance provides California residents with rights to know what data is collected, request deletion, and opt out of data sharing. Clear privacy policies and user control mechanisms ensure regulatory compliance.

COPPA requirements apply when collecting data from children under 13, requiring parental consent and additional privacy protections. Age-appropriate data practices ensure compliance when targeting family audiences.

International privacy laws vary by jurisdiction and require understanding of local requirements for data collection and processing. Global compliance strategies ensure legal operation across different markets.

### Consent management strategies

Transparent consent requests explain exactly what data will be collected and how it will be used. Clear communication increases consent rates while ensuring visitors make informed decisions about data sharing.

Granular consent options allow visitors to choose which types of data they're comfortable sharing. Selective consent respects visitor preferences while enabling valuable data collection from willing participants.

Consent withdrawal mechanisms enable visitors to revoke permissions and delete their data on request. Easy withdrawal processes build trust while maintaining compliance with privacy regulations.

Value exchange clarity explains what benefits visitors receive in exchange for data sharing. Clear value propositions increase consent rates and build positive relationships with your audience.

### Data minimization and security

Purpose limitation ensures collected data is only used for stated business purposes. Clear purpose boundaries build trust and ensure ethical data handling practices that maintain visitor relationships.

Data retention policies define how long visitor information is stored and when it will be deleted. Reasonable retention periods demonstrate responsible data handling while enabling valuable analysis.

Security measures protect collected data against unauthorized access or breaches. Strong security practices maintain visitor trust while ensuring business data protection and regulatory compliance.

Anonymization processes remove personally identifiable information while preserving valuable analytics insights. Proper anonymization enables valuable analysis while protecting visitor privacy.

:::register-linkbreakers-banner {"eyebrow":"Try Linkbreakers","headline":"Collect rich data from every QR code scan","description":"Linkbreakers captures device info, IP-based location and workflow steps, with a data collection level you choose for each link.","ctaHref":"https://app.linkbreakers.com/workspace/sign-up/wizard?ref=help-overview-data"}:::

## Linkbreakers data collection capabilities

### Comprehensive visitor analytics

The [Linkbreakers platform](https://app.linkbreakers.com/workspace/dashboard/visitors) collects detailed visitor data including device information, location intelligence, behavioral patterns, and engagement metrics. Data collection levels let you balance business intelligence with visitor privacy.

Real-time data processing ensures visitor information is immediately available for analysis and optimization. Instant data availability supports tactical decision-making and enables rapid response to performance changes or opportunities.

Geographic intelligence captures approximate, IP-based location at the Basic and Advanced levels. Location insights help optimize placement strategies and understand market penetration.

Device analytics reveal audience technology preferences and capabilities, helping optimize user experiences for actual visitor characteristics. Device data supports technical optimization and ensures compatibility across audience preferences.

Workflow tracking shows which steps visitors reach and where they leave. These insights help optimize customer experiences and identify high-value audience segments.

### Privacy controls

The None collection level records scans without IP addresses or device details, for campaigns that do not need them. Lowering the level applies to future scans only.

Data is kept for as long as your workspace exists. There are no automated retention periods, so delete data you no longer need.

Export and deletion tools let you answer visitor requests: export events and visitors as CSV, edit visitor attributes, or delete a visitor profile. Deleting a profile keeps its scan events and devices, unlinked from the profile.

### Integration and automation capabilities

[CRM integration](https://linkbreakers.com/help/api) enables visitor data to enhance existing customer profiles when visitors provide consent for identification. Integration provides comprehensive customer understanding across all touchpoints.

[Webhook notifications](https://app.linkbreakers.com/workspace/dashboard/developers/webhooks) enable real-time data streaming to business systems. Integration ensures visitor data immediately enhances business processes.

Custom event tracking captures specific business outcomes that align with organizational objectives. Custom tracking ensures data collection focuses on metrics that matter for business success rather than generic analytics.

Automated data processing transforms raw visitor data into actionable insights without manual analysis. Automation ensures timely business intelligence while reducing operational overhead and analysis complexity.

## Frequently Asked Questions

### What personal data can I legally collect from QR code scans?

It depends on your lawful basis and your visitors' countries. IP addresses, cookie identifiers and device details are personal data under GDPR, so you need a lawful basis and a clear privacy notice even without forms. Use the None collection level when you only need basic scan counts.

### How accurate is location data from QR code scans?

Location comes from the IP address and is typically accurate to the country or region, and sometimes the city. Linkbreakers does not collect GPS. VPNs and mobile networks can make the location less accurate.

### Can I track visitors across multiple QR code scans?

Yes. The first-party `linkbreakers.browser` cookie recognizes a browser that scans again, at every collection level. Check whether your use of this cookie requires consent under the ePrivacy rules in your visitors' countries.

### What's the difference between anonymous and identified visitor data?

Unidentified data covers scans and devices without contact details, but it can still be personal data because it includes cookie identifiers and, at Basic and Advanced, IP addresses. Identified data includes contact information visitors type into your forms and enables ongoing relationship development. Both types provide valuable business intelligence for different purposes.