QR code scan data: what our logs show
Every Scanlo code logs every hit. This page publishes what those logs say, with the sample size, the method and the limits next to each figure. The sample is small, and we would rather show one number that holds than five that describe a single business.
Measured October 19, 2026. Updated monthly, including when a figure moves against us.
Your real scan count, without the 45% padding
115
scans by real people
52
other hits a plain counter would add, 31.1% of the total
Sample: 52 of 167 hits on 16 codes from 15 business accounts, July 26, 2026 to October 19, 2026.
Most of the gap is a good sign: your link being shared by text. 75.0% of those extra hits are Apple Messages drawing a preview card when the link is pasted into a text. It is not a scan, but it is someone passing your code on.
One business's payment hub carries most of the traffic, so we checked whether it drives the figure. Without that code the share is 33.3% (23 of 69). The finding does not depend on one customer.
Everything in the gap:
Link previews in Apple Messages
39 hits, 75.0% of the gap
- When someone pastes a link into a text, the sender’s phone fetches it to draw the preview card. These arrived from home and mobile networks such as Comcast, AT&T, Verizon and T-Mobile, not from data centers, on 3 codes from 3 businesses.
Google Read Aloud
8 hits, 15.4% of the gap
- Google’s text-to-speech fetcher, on one code, over five days in September.
Microsoft cloud link scanners
5 hits, 9.6% of the gap
- Requests from Microsoft’s network (AS8075), the kind of check an email security filter runs on a link before the recipient sees it.
Why it matters
If you are deciding where a code works, the number you want is people. A counter that counts every request would have shown these businesses 45.2% more scans than people made, and a placement that gets shared a lot would look busier than it is. A filter that only looks for data-center traffic would not fix it either: a Messages preview comes from an ordinary phone on an ordinary network, so it takes the user agent to tell it apart.
Every hit is logged on every plan, and the redirect never waits for any of this. Free shows every hit in one total. Standard's scan analytics split people from previews and bots, so the count you act on is the real one.
One payment hub, followed for a month
A single case, not an average. A service business in the United States put up one payment hub with 2 payment apps on September 14, 2026.
- Scans by people
- 69
- on 19 different days
- Taps on a payment app
- 42
- 60.9% of scans
- Hits that were not people
- 29
- 21 of them Messages previews
The Messages previews mean the hub's link was being sent around by text, not only scanned at the counter. We do not quote this tap rate as typical: the other 5 hubs in the sample had 10 taps from 29 scans between them, too few to call a rate.
What we are not claiming
These are figures our logs could produce and that we are choosing not to publish yet, with the reason for each.
That a QR code raises reviews, bookings or payments by any percentage.
We see the scan and, on a hub, the tap. What happens after that on Google, PayPal or a booking page is not visible to us, so any uplift figure would be invented.
A typical tap rate for hub pages.
One hub carries 69 of the 98 hub views in the sample. Its rate and the rest's are far apart, and a blended figure would describe neither.
How many codes end up in real use.
12 of the 13 codes that were ever scanned got their first scan within 10 minutes of being created. That is the owner trying it, not a customer, so "scanned at least once" overstates real placement. Only 1 code was scanned on 3 or more different days.
iPhone versus Android share, or the best day and hour to be scanned.
Both are dominated by one business’s customers, and we store no time zone for a scan, only a country.
How we count
- A hit is any request to a code's short link: a camera scan, a tap on a website embed, or a preview fetch. A scan by a person is a hit that passes the bot checks below.
- A hit is non-human when its user agent is on the open-source isbot list of crawlers and preview fetchers, or when it comes from a data-center network such as AWS, Google Cloud or Azure.
- Safari and mobile browsers arriving from Cloudflare or Akamai count as people, because that is where iCloud Private Relay and the WARP app send ordinary phone traffic. We found and fixed this in October 2026: 4 scans from real iPhones and Macs had been counted as bots, and the figures above use the corrected rule.
- Our own test accounts are excluded, as are scans from Poland, where Scanlo is run and where those scans were the founder checking codes rather than customers using them. 13 codes in the sample have been scanned by a person at least once.
- We never store a scanner's IP address. Country and network are read at the edge and the address is discarded, so nothing here can identify a person. More in our privacy approach.
You can reuse these figures with a link back to this page, under CC BY 4.0.
Questions about a figure, or want the numbers for a story? Write to us via the contact page.