UTM parameters are the tags on the end of a web address — ?utm_source=…&utm_medium=…&utm_campaign=… — that tell Google Analytics where a visit came from. A printed QR code needs them more than almost any other channel, because without them every scan arrives looking exactly like someone who typed your address from memory.
This guide covers which tags to use, how to name them so the reports stay readable, and where the tags should live — in the pattern or on the redirect. It is part of the wider guide to tracking QR code scans.
Why QR visits show up as “direct”
When someone clicks a link on a web page, the browser tells the next site where they came from. When a camera app opens a link from a QR code, there is no page to come from, so nothing is sent. Google Analytics files that visit under Direct, beside bookmarks and typed addresses. A poster campaign that works and one that fails look the same there.
UTM parameters fix it by putting the attribution into the address itself. Google Analytics reads them on arrival and reports the visit under the source, medium and campaign you chose.
The five parameters, and what to put in each for print
| Parameter | What it answers | Example for a QR code |
|---|---|---|
utm_source | Where exactly? | metro-poster, table-card, pack-500g |
utm_medium | What kind of channel? | qr (or print, if you keep one medium for all printed matter) |
utm_campaign | Which campaign? | spring-2027 |
utm_content | Which variant? | blue-design, headline-b |
utm_term | Which keyword? (search ads) | Usually left empty for QR codes |
The decision that matters most is what goes in utm_source. Use the placement — the specific poster site, the shelf, the leaflet drop — rather than “qr”. The medium already says it was a QR code; the source is where you want to be able to compare one location against another.
Naming rules that keep the report usable
- Lowercase, always. Google Analytics treats
Posterandposteras two different sources. - Hyphens, not spaces. A space becomes
%20in the report and is easy to mistype. - Write the list down before printing. A shared sheet of allowed sources and campaign names prevents three spellings of the same shop.
- One code per placement. Tags can only tell placements apart if each placement has its own code. Ten posters sharing one code are one row.
Tags in the pattern, or tags on the redirect
There are two ways to get tags onto a QR visit, and they behave very differently once the code is printed.
In the pattern (static code). You paste the full tagged address into a generator. It works, but the long address makes the pattern denser — more, smaller squares, which need a larger print size to scan reliably — and a typo in the campaign name is printed forever. See QR code size for printing for why density matters.
On the redirect (dynamic code). The pattern carries only a short link. The tags are added when the scan is sent on to your site, so the code stays small, and a misspelled tag is a field you correct after printing — the next scan carries the fixed version.
How it works in D-QR
D-QR adds tags at the redirect, which is why they can be changed after printing:
- UTM fields on each code. Source, medium, campaign, term and content are set on the code and added to its destination when it is scanned. They come with the Pro plan.
- UTM presets. Save a set of tags once and pick it when creating a code. A preset only fills tags the code leaves empty, and editing a preset later never rewrites codes already made.
- Campaigns. Group codes into a campaign and give the campaign its tags; every code in it carries them, unless the code sets that tag itself. Campaigns come with the Pro plan, and the campaign report totals scans across its codes.
- Parameter passing. Optionally, a query string the visitor arrived with is kept on the destination too.
Tags already on your destination address are kept as they are unless a tag replaces them, nothing is placed after a # fragment, and only website (and GS1) codes are tagged at all — adding a query string to an email, SMS or WhatsApp code would corrupt the message it opens.
Why the scan count and the sessions never match
Expect your QR scan count to be higher than the sessions Google Analytics reports for the same tags. The two are counted at different moments:
- A scan is counted when the phone requests the short link — before your page loads.
- A session needs the page to load, the analytics script to run and, in much of Europe, the visitor to accept analytics cookies.
Slow mobile connections, people who close the page at once, ad blockers and declined consent all sit in that gap. Bots work the other way: link previews and crawlers can inflate a raw scan count, which is why D-QR counts them separately and leaves them out of the scan totals — see bot filtering. Use the scan count for “did people scan it” and the analytics sessions for “what did they do next”.
A checklist before you print
- One dynamic code per placement.
- Source = placement, medium = qr, campaign = the campaign, all lowercase.
- Scan a proof and check the tags arrive: the address bar on the landing page should show them, and the visit should appear in Google Analytics’ real-time report.
- After launch, compare placements by scans first, then by what those sessions did.
Want to see scans per placement before the analytics even load? QR code tracking shows each code’s scans by day, device and location.