What started as a logistics tool designed to track automotive parts along factory assembly lines has become one of the most widely scanned objects in everyday consumer life. QR codes now appear on food packaging, pharmaceutical labels, cosmetics, and household goods - and while brands present them as a convenience feature, the data infrastructure operating behind each scan is more consequential than most consumers realize.
More Than a Shortcut: The Data Layer Behind the Scan
A QR code is, at its most basic, a machine-readable URL printed in black and white. It does nothing on its own. But the moment a consumer scans one with a smartphone, their device is directed to a website - and that journey generates data. Depending on how a company's analytics system is configured, that single scan can reveal the approximate location of the device, the time of scanning, the device type, and the specific product batch linked to the code.
The code itself is not a tracker. The website it points to is where the data collection begins - and that distinction matters, because it places QR codes within the broader architecture of web tracking rather than in a separate, packaging-specific category. Companies can use this scan data to build aggregate pictures of consumer behavior: which products are being engaged with, in which regions, and at what times. That information feeds directly into advertising and marketing decisions.
A further complication arises when brands use third-party QR management platforms. In these cases, a scan does not travel directly to the brand's own website. Instead, it is routed through an external intermediary that may collect and process data under its own terms before passing the user onward. This adds a data-processing layer that most consumers will never be aware of - and one that can be difficult to scrutinize without reading through multiple sets of terms and conditions.
The Consent Problem and the Opacity of the URL
Industry voices differ sharply on how to characterize the privacy risk. Jenny Stanley, managing director at Appetite Creative, and Alice Rackley, CEO at Polytag, both emphasize the voluntary nature of QR engagement. "A QR code is the opposite of covert tracking. It does nothing until a consumer actively chooses to scan it - it's an invitation, not a beacon," Stanley has said. Rackley similarly notes that personal information is only shared when a consumer actively provides it, such as by entering details for a competition or newsletter.
That argument has intuitive appeal but a structural weakness. Tom Sulston, head of Policy at the NGO Digital Rights Watch, points out that the voluntary act of scanning does not resolve the underlying opacity problem: a QR code, unlike a typed web address, does not allow a person to see where they are about to be directed before committing to the action. "People shouldn't click links of unknown provenance," Sulston says, "and this applies to QR codes, too." A printed code on cereal packaging and a malicious code distributed in a phishing campaign are, visually, indistinguishable. That ambiguity is a security vulnerability as much as a privacy one.
Sulston also raises the concern that QR codes can channel consumers into wider web-tracking ecosystems - systems populated by data brokers whose business models depend on accumulating detailed profiles of individuals across multiple online touchpoints. "You could easily imagine insurers being interested in the medical products that a person is looking at on the web," he observes. The concern is not merely theoretical. Once a scan deposits a user onto a webpage, all the standard mechanics of online tracking - cookies, pixels, fingerprinting - can apply.
Regulation, Accountability, and the Gap Between Law and Practice
Frameworks like the General Data Protection Regulation in Europe and the California Consumer Privacy Act in the United States already impose obligations on brands that collect data through QR codes. Under GDPR, the brand functions as the data controller and bears legal responsibility for how data is gathered and used. The principle, as Stanley articulates it, is clear: "Collect only what you need, be transparent about why, and give the consumer real value back."
Polytag, which operates within GS1-approved standards, positions its platform as one that delivers practical consumer value - product information, food safety updates - while keeping data collection proportionate. GS1 is the global standards body that governs product identification systems, and operating within its framework offers a degree of structural accountability that unregulated QR management platforms do not.
But Sulston is unconvinced that company transparency, even when genuine, constitutes an adequate safeguard. The problem, he argues, is systemic: terms and conditions are long and unwieldy, and expecting consumers to read them before scanning a QR code on a cereal box is not a realistic standard of informed consent. Stanley herself acknowledges that industry practice has not kept pace with the regulatory environment. "Standards are moving faster than shared best practice on consent design," she says. "As an industry, we should be doing more - consistent opt-in, plain-language, data-use disclosure, and privacy-by-design with GDPR and CCPA built in from the start, not bolted on."
What Responsible Practice Would Actually Look Like
The technology is not inherently problematic. QR codes can deliver genuine utility - allergen information for consumers with dietary restrictions, recycling guidance, provenance details for ethically minded shoppers. When deployed with strong data governance, they can represent a more transparent form of consumer engagement than the third-party cookie tracking that has dominated digital advertising for years. First-party data collected with explicit consent, limited in scope, and clearly explained is meaningfully different from the surveillance-era approach of passive, invisible tracking.
The gap, however, lies between what responsible deployment looks like and what common practice actually delivers. Without consistent industry-wide standards on consent design, plain-language disclosure, and privacy-by-default configuration, the QR code on a product package remains - for most consumers - a black box. They can choose not to scan it. But if they do, the data journey that follows is largely invisible to them.
The broader implication is that as connected packaging becomes more prevalent, the question of consumer data rights cannot be treated as a secondary concern. The same debates that shaped the regulation of online tracking, social media data harvesting, and behavioral advertising are now arriving, quietly, in the supermarket aisle.
