How to Track QR Code Scans in Google Analytics 4

The two-layer architecture

An example destination:

https://example.com/menu?utm_source=offline&utm_medium=qr&utm_campaign=spring_menu&utm_content=richmond_table_14

Nobody sees that URL. The printed artwork encodes the short redirect, so the parameters can be long and descriptive without making the QR pattern denser or harder to scan.

What GA4 actually measures, and where it starts

Worth being blunt about, because almost every “GA4 is under-reporting my QR codes” conversation starts here: GA4 never sees the scan. It has no visibility of a camera recognising a pattern. It starts existing much later in the chain, and everything before that point is invisible to it by construction.

A person can be recognised by the camera and never tap. They can tap and close the tab before the page loads. Consent tooling, a blocker, a dead zone or a slow page can all end the journey between box three and box six. That is why:

Decide the naming convention before you print

The most common GA4 mistake is not a missing parameter. It is three people using qr, QR and print for the same thing, and someone spending a day cleaning it up in a spreadsheet six weeks later.

Being precise about what is and is not recoverable here matters, because the two halves behave differently. A dynamic QR code’s destination stays editable after printing, and so do the UTM parameters attached to it — you can fix a convention at any point, and every scan from then on arrives under the corrected names. What no product can do is go back and rename the sessions GA4 already filed. Those months stay split across whatever names were in use at the time.

So the cost of deciding late is not a reprint. It is a gap in the record. Pick once, write it down, and apply it to every destination in the batch:

One consequence is worth knowing before you commit: a custom value such as utm_medium=qr may not match any of GA4’s default channel rules, so the traffic can appear under Unassigned even when Session source / medium shows your values correctly. That is a labelling problem with a proper fix, and it is covered below — it is not a reason to pick a dishonest medium.

QR UTM Campaign Builder

Build the tagged destination for one printed placement. Source and medium start on the convention above; everything stays editable, and any query parameters your URL already carries are preserved.

Setting it up, step by step

1. Confirm GA4 is already working on the destination site

   Open the page and check the property is receiving ordinary web activity. Do this first — otherwise you will spend an afternoon blaming QR attribution for a missing tag.

2. Build the tagged destinations

   One row per placement, each with the same campaign and a distinct utm_content. A spreadsheet is the right tool here: it is easy to see at a glance whether the taxonomy was applied consistently.

3. Create the dynamic codes from that list

   Paste or upload the CSV so each tagged URL becomes the destination of one managed code. The parameters live in the destination, not in the printed pattern.

4. Scan one before printing anything

   On a real phone. Confirm the redirect resolves, the final URL loads, the parameters survived the redirect, and GA4 registered the session.

   Parameters surviving the redirect is the step people skip and the step that most often breaks.

5. Verify traffic-source reporting in GA4

   Check Traffic acquisition, or build an exploration on the session-scoped source, medium, campaign and content dimensions. Be explicit about whether you are looking at user-, session- or event-scoped dimensions; they will not agree, and that is by design.

   Because a QR campaign is manually tagged, the fastest place to confirm the values is GA4’s Manual report, which exists specifically for manually tagged traffic. The dimensions to read there are named:

   • Session manual source
   • Session manual medium
   • Session manual campaign name
   • Session manual ad content — where your utm_content placement lands

   Read the raw dimensions before you judge the channel label. Session source / medium can be perfectly correct while the default channel group still reads Unassigned — see the section below.

6. Print a physical proof and scan that

   At final size, from the distance people will actually stand. A browser test proves the tagging; only the printed proof proves the deployment.

A reusable template for a QR campaign

Sixty codes across three stores, one campaign called summer_combo_2026. Every destination shares the source, medium and campaign; only the content changes:

Now GA4 can report the campaign as one thing and still break it down by placement, while VastQR reports which individual code was scanned. Two systems, one taxonomy, no conflict.

Separating placements without wrecking your reports

There are two strategies, and only one of them scales.

Unique utm_content — use this by default

Right whenever the placements belong to the same campaign. The campaign stays legible and the detail is still there when you want it.

Unique campaign names — only for genuinely separate campaigns

Right when the placements have different objectives and different owners. Wrong as a way of separating three hundred table cards, which turns the campaign report into a directory.

When GA4 says Direct, or says Unassigned

These are the two reports that send people looking for a broken QR code, and they mean opposite things. One says the campaign data never arrived. The other says it arrived and Google did not recognise the category you put it in. Fixing the second the way you would fix the first will corrupt your reporting.

Direct means the parameters did not survive

For a QR campaign, that usually has one of four causes: the printed destination never carried parameters; a redirect somewhere in the chain stripped them; the final landing URL lost them before GA4 read the page; or the session started without any attribution information to work from.

This is why the pre-print test has to inspect the final landing URL rather than simply confirm the code opens something:

Unassigned means the tags worked and the label did not

GA4’s default channel group is a fixed set of classification rules. A medium like qr can be exactly right for your own taxonomy and still match none of them. What you see then is:

Session source / medium      = offline / qr
Session default channel group = Unassigned

The attribution is correct. Only the label is missing. Diagnose in this order and you will not confuse the two cases:

1. Check Session source / medium

   If it reads offline / qr, your parameters arrived. Stop suspecting the QR code.

2. Check the campaign dimensions

   Session campaign and the manual content dimension should carry the names you defined before printing.

3. Confirm the values survived the redirect

   Open the short link yourself and read the address bar on the landing page.

4. Only now look at the channel group

   If steps one to three are correct, what you have is a classification problem, and it is fixed in reporting rather than in tagging.

Why redirect counts and GA4 sessions never match

Between a scan and a GA4 session there are seven things that have to happen: the camera recognises the code, the person taps the link, the redirect receives the request, the browser follows it, the destination begins loading, the GA4 tag executes, and consent and browser settings permit measurement. Any of them can fail independently.

Divergence is therefore expected. What matters is that each system is internally truthful about what it measured.

Automation is a large part of that gap. VastQR counts recognised automated requests in its default All events view and reports the classified share, and offers an Exclude classified automated view when you want the period recalculated without them. Neither view is a verified-person count — the classifier only sees what announces itself — but having the figure in front of you is what makes the difference between the two systems explainable.

Do not demand equality between the two. Demand that you can explain the gap.

What actually counts as a scan →

What happens to attribution when you edit a live destination

A dynamic code lets you change the destination after printing, which creates a reporting decision most guides skip.

• Same campaign, page moved: keep the taxonomy identical. Changing it splits one campaign into two for no analytical reason.
• New campaign entirely: update the parameters along with the destination, because the old campaign name no longer describes what the visitor is seeing.

Either way, write down the date. The parameter change applies to traffic from that moment on; the sessions GA4 already recorded keep the names they were filed under. A before-and-after comparison that silently spans both is worse than no comparison.

GA4 does not make a static code dynamic

You can put a tagged URL inside a static QR code and measure the resulting website traffic in GA4. That is genuinely useful, and it is why the claim “static QR codes cannot be tracked” is wrong.

What GA4 does not give the static code:

• an editable destination;
• a managed redirect;
• a pause state;
• a library of codes to manage;
• a scan count for the code itself, as opposed to a session count for the page.

That is the exact line between website attribution and dynamic QR operations.

What redirect-level QR tracking shows →

Frequently asked questions

Sources

• Google Analytics Help — URL builders: collect campaign data with custom URLs
• Google Analytics Help — Traffic-source dimensions, manual tagging and auto-tagging
• Google Analytics Help — the Manual report for manually tagged campaigns
• Google Analytics Help — Analytics dimensions and metrics
• Google Analytics Help — Understand (direct) / (none) traffic
• Google Analytics Help — Default channel group
• Google Analytics Help — Tagging best practices to avoid unassigned, (not set), and direct traffic
• Google Analytics Help — Custom channel groups

Related guides

• QR Code Tracking for Dynamic QR CodesPer-code scan attribution, with the coverage and bot context left visible.
• QR Scan Analytics: Bots, Crawlers and What a “Scan” Really MeansA scan event is not a person, and a coverage gap is not a zero.
• How to Create Bulk QR Codes from Excel or CSVA spreadsheet with 300 rows is not 300 production-ready QR codes.