# QRisk: Think Before You Scan QR codes

Abhishek Kumar Mishra, Guillaume Gagnon, Mathieu Cunche, Sebastien Gambs

► To cite this version:

Abhishek Kumar Mishra, Guillaume Gagnon, Mathieu Cunche, Sebastien Gambs. QRisk: Think Before You Scan QR codes. ARES 2025 - 20th International Conference on Availability, Reliability and Security, Aug 2025, Ghent (BE), Belgium. pp.1-22. hal-04987069v2

HAL Id: hal-04987069

https://hal.science/hal-04987069v2

Submitted on 12 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
QRisk: Think Before You Scan QR codes

Abhishek Kumar Mishra¹[0000-0003-1778-6794], Guillaume
Gagnon²[0009-0007-1717-7418], Mathieu Cunche¹[0000-0002-0066-8612], and
Sebastien Gambs²[0000-0002-7326-7377]

¹ INSA-Lyon, Inria, University of Lyon, CITI Lab., France
{abhishek.mishra, mathieu.cunche}@insa-lyon.fr

² Université du Québec à Montréal, Canada
{gagnon.guillaume.5@courrier.uqam.ca, gambs.sebastien@uqam.ca}

**Abstract.** QR codes are pervasive in modern digital interactions, but despite their convenience, they pose significant privacy risks that are often underestimated. For instance, privacy issues escalate when scanned URLs trigger HTTP redirections involving QR URL shorteners and third-party domains, exposing user data to external entities. However, a comprehensive study of the privacy implications of QR code interactions concerning cookie exploitation and query strings remains lacking in the literature. To address this, we collected a dataset of 860 QR codes over a two-year period from France, China, Austria, India and Canada to analyze the privacy risks associated with QR code usage. We find in this paper titled *QRisk*, that 39.2% of redirected URLs set cookies, including tracking, analytics, and advertising cookies, enabling potential cross-session behavioral profiling. Additionally, over 25% of QR URLs embed query strings that not only contain sensitive user identifiers but also carry information such as location data in them, leading to user profiling and social link inference.

**Keywords:** QR codes, URL shorteners, Privacy, Cookies, URL strings.

# 1 Introduction

Quick-Response (QR) codes have become an integral part of modern digital communication, allowing seamless access to digital information in the physical world [9]. For instance, they are commonly used in various domains, from marketing campaigns to payment systems, and play a pivotal role in bridging physical and digital spaces. In addition, QR codes are closely associated with user smartphones, as they are primarily accessed through mobile devices via the camera app's built-in reader or a dedicated scanning application. This association makes users potentially vulnerable to various privacy breaches.

Indeed, QR codes transform analog interactions, such as ordering at a restaurant, into digital ones, enabling data collection like order histories and contact information [5,21]. More broadly, interacting with QR codes creates a digital trail from everyday movements [1], activities and consumption habits [13]. This can
lead to the vast collection of data on previously untracked aspects of our lives, often without explicit consent [14], thereby posing significant privacy threats.

From a technical point of view, QR codes often contain Uniform Resource Locators (URLs) with query strings (key-value pairs) that enable server-side functionalities like referral tracking and analytics. Potentially, these query strings can carry sensitive information, such as user identifiers, location data and other contextual information. Additionally, although a standalone QR code URL may appear harmless, its risks are magnified when scanned and subjected to a series of HTTP redirections. These chains frequently involve URL shorteners and potential third-party tracking domains, exposing user data to entities beyond their control. This ecosystem can be a fertile ground for tracking cookies and analytics scripts for gathering detailed user behavior profiles.

The security of QR codes has been studied previously, and various attack strategies have been demonstrated [6]. In contrast, the privacy risks associated with specific URL access encoded in QR codes remain largely unexplored in the literature. Indeed, while some studies have explored the risks associated with URL query strings [20] or shorteners [11,12,9] separately, they have not comprehensively examined vulnerabilities specific to QR code interactions from a user-centric perspective. Moreover, they lack privacy threat investigation across diverse geographical locations with various internet regulations.

Our work, titled QRisk, aims at addressing this gap by analyzing the privacy implications of query strings, cookies and redirection chains in QR-scanned URLs across three continents, including heavily censored countries [19] such as China. Our findings highlight significant risks, ranging from invasive tracking to the inadvertent exposure of personal information. In addition to unveiling these privacy risks, one of our objectives is to raise the awareness of stakeholders about the vulnerabilities inherent in QR code practices as well as to encourage users to adopt more secure practices.

In summary, the main contributions of our paper are:

- We investigate the use of URL shortening services (USS) in QR code workflows, demonstrating their role in obfuscating URLs, potentially enabling user profiling and tracking.

- We perform an in-depth examination of cookies set by third parties (USS) during URL redirection chains, categorizing them and identifying highly intrusive ones.

- We investigate query strings in QR-scanned URLs, revealing their widespread use for tracking metrics and location.

- We release a diverse and public dataset <fnref n="3" /> of QR codes, providing a valuable resource for further research into their privacy and security challenges.

<footnote n="3">³ Available at https://www.dev-null.ca/~gg/ARES25/ARES25-QR_Codes.zip</footnote>
The outline of the paper is as follows. First, we introduce the related works in Section 2 and formulate our research questions. Next, we present the required background on QR codes in Section 3 before detailing the QR code dataset that we have collected in Section 4. Then, we investigate the redirections and USS in Section 5 and demonstrate that QR USS does deploy privacy intrusive cookies in Section 6. We then review the privacy implications of URL paths and query strings in Section 7. Finally, we conclude by discussing how the revealed privacy risks could be mitigated and regulated in Section 8.

# 2 Related Work and Research questions

## 2.1 Related Work

The existing literature on the privacy and security challenges of QR codes and their associated workflows can be categorized into three types of studies.

*QR code usage and ecosystem analysis.* To understand the ecosystem of QR code usage, Lerner and collaborators have conducted a large-scale analysis of QR and barcode scans [9,8], uncovering general usage patterns from conventional Web links to emerging applications like Bitcoin wallets. While these studies show the growing ubiquity of QR codes, they have not analyzed the privacy threats posed by URLs and associated metadata.

*Security mechanisms in QR code scanners.* Securing QR code scanning applications is emphasized by Krombholz and co-authors [7], who propose design recommendations to mitigate phishing attacks. SafeQR [22] leverages APIs like Google Safe Browsing and Phishtank for enhanced detection of malicious URLs. Similarly, Wahsbeh and Luccio [18] offer recommendations for creating applications that are secure, privacy-conscious and user-friendly, demonstrating their approach with BarSec Droid, a prototype Android application adhering to these guidelines. While these works focus on malicious QR codes and scanner vulnerabilities, they do not address privacy risks related to sources like query strings, cookies or redirection behaviors.

*URL query strings and shortening services.* Generic privacy risks of URL query strings and shortening services have been explored by [20,12,11]. Encoding of sensitive data, such as usernames and passwords, within query strings across user-submitted URLs, is highlighted by West [20], who ultimately propose a prototype framework called CleanURL to sanitize URLs. Another work focuses on ad-based URL shortening services, and concludes that the greater risks posed by it to users compared to traditional shortening services are due to the involvement of third-party advertising networks [12]. Finally, Neumann, Barnickel and Meyer [11] have investigated the vulnerabilities of URL shortening services (USS), claiming the leakage of URLs to search engines and also hinting at USS setting long-term cookies, without digging deeper into the nature of these cookies.
All of these studies focus on generic URLs and do not delve into the specific in-depth privacy challenges (i.e., intrusive cookies, URL strings exploited in QR URLs, issues with redirections) associated with QR codes and the services that provide shortened URLs for them. Thus, to the best of our knowledge, QRisk is the first work to investigate such critical aspects of QR code scanning.

## 2.2 Research questions

Based on the results of the literature review, in this work we aim to explore and address critical questions regarding the privacy implications of QR code usage, which we detail hereafter.

$Q_1$ - *Information collected by QR URL shorteners without user consent.* URL shorteners play a central role in QR code workflows by deferring the final destination URL. This layer of re-direction raises significant privacy concerns:

- $Q_{1.1}$ - *Are QR URL shorteners setting cookies?* We investigate if URL shorteners set cookies during the redirection process without consent to gain insights into their role in tracking and profiling users (cf. Section 6.1).

- $Q_{1.2}$ - *What types of cookies are being set?* Cookies vary in purpose, from functional and session-based to tracking and advertising. We identify and classify the types of cookies set by QR URL shorteners to reveal the extent to which they contribute to privacy risks (cf. Section 6.2).

$Q_2$ - *Information collected by the target party:* The end destination of a QR code scan—the landing page (server)—has multiple opportunities to collect user data. This aspect of the workflow leads to the following questions:

- $Q_{2.1}$ - *What mechanisms are employed to transfer information?* Information can be transferred through cookies, URL paths, query strings as well as other techniques during the redirection chain. We investigate these possible mechanisms for assessing the scale of sensitive data inference (cf. Section 5).

- $Q_{2.2}$ - *How prevalent are these mechanisms?* We quantify the frequency of these mechanisms to evaluate how common privacy-intrusive practices are in QR code workflows (cf. Section 6 and 7).

- $Q_{2.3}$ - *What types of data are being transferred?* Data such as user location, session identifiers or demographic information can be encoded in query strings. We analyze the nature of this data and identify scenarios in which it can be exploited to compromise user privacy (cf. Section 7).

## 3 Background on QR codes

Quick-Response (QR) codes are 2-dimensional codes that can be read via the camera, typically from a smartphone. A QR code can encode various types of data, such as digital identifiers, emails, phone numbers or URLs. There exist multiple *versions* of QR codes, corresponding to capacity ranging from 25 up to 4296 characters in version 40 [15].
**URL shortening.** QR codes have a limited capacity that cannot always accom-
modate the needs of the application. Hence, URL Shortening Services (USS) are
regularly used to convert a long URL into a short one that can easily fit in a QR
code. For instance, the service QR-Code-Generator<fnref n="4" /> (affiliated to bit.ly) uses
the domain qrco.de for URL shortening purposes. Other USS, not related to
QR code services, may also be used. QR code services are offered by a number of
companies through both free and paid plans. In addition to the generation and
customization, they usually offer additional services, including dedicated URL
shortening, analytics and reporting, as well as dynamic link management.

In the situation in which a URL is encoded, QR codes are used according to
the following model described in Figure 1. First, a QR code is scanned by the
smartphone of a user and the browser on the smartphone then opens the URL
and retrieves the landing page. A URL shortening may be involved, in which
case the browser will first contact the USS, which will redirect the browser to
the landing page. In practice, additional redirection may occur on the website
as well as on the USS.

<figure><img src="image_2.png" /><figcaption>Fig. 1: Process of scanning a QR code to access a URL, with and without a URL shortener.</figcaption></figure>

4 QR code dataset

*Collection.* We have collected the dataset from QR codes displayed in the wild in public places across France, China, Austria, India and Canada over a two-year period (January 2023 – December 2024). It encompasses diverse real-world settings such as restaurants, bus stops, malls, public transport hubs, academic complexes and supermarkets as shown in Figure 2.

After de-duplication and filtering out invalid entries, non-functional URLs, and corrupted codes, the curated resulting dataset contains 860 unique QR codes. Due to the diversity of locations used for the collection, we believe that this dataset captures diverse user experiences and privacy implications.

<footnote n="4">⁴ https://www.qr-code-generator.com/</footnote>
<figure><img src="image_3.png" /><figcaption>Fig. 2: Illustration of collected QR codes in various contextual scenarios across diverse geographic locations.</figcaption></figure>

*Characteristics.* Table 1 outlines the key features of our dataset, highlighting how QR codes predominantly contain URLs (> 93%). First, we can also observe a strong adoption of secure protocols, with 81% of URLs using https, and a wide range of URL lengths, ranging from a minimum of 12 characters to a maximum of 203, with an average length of 45 characters. To analyze the diversity of remote content types when accessing a URL, we extract the Content-Type header from HTTP responses. Most URLs point to web content, while static files like PDFs are also present, reflecting a broad mix of applications. The dataset further showcases diverse top-level domains (TLDs), with .com, .fr, .de and .cn being the most common among the top 10, underscoring the breadth of QR code use cases across various contexts.

<table><caption>Table 1: Characteristics of the QR Dataset</caption><thead><tr><td>Feature</td><td>Description/Statistics</td></tr></thead><tbody><tr><td>Number of QRs</td><td>860</td></tr><tr><td>Countries</td><td>France (721), China (60), Austria (58), India (15), and, Canada (6)</td></tr><tr><td>Collection Period</td><td>Jan. 2023 – Dec. 2024</td></tr><tr><td>HTTPS Usage</td><td>81%</td></tr><tr><td>Average URL Length</td><td>45 characters</td></tr><tr><td>Shortest URL Length</td><td>12 characters</td></tr><tr><td>Longest URL Length</td><td>203 characters</td></tr><tr><td>Content Types</td><td>web, plain-text, PDFs</td></tr><tr><td>Top 10 TLDs</td><td>.com, .fr, .de, .cn, .co, .link, .org, .to, .me, .gouv.fr, .eu</td></tr></tbody></table>
**QR code capacity utilization.** Figure 3 presents the distribution of URL lengths, with the objective of illustrating the fraction of each QR code's total capacity that is used, along with the necessity of using USS. Vertical lines denote the capacity of various QR code versions. The plot reveals that version V4 or lower suffices for 85% of the QR codes. This suggests that QR codes are often not optimized for storage efficiency, as even higher-capacity versions such as V29 and above are either completely unused or significantly underutilized. This observation contradicts the assumption that USS is required due to URL length constraints. While the use of USS may be motivated by other reasons (analytics, dynamic link, etc.), due to the privacy and security risks associated with USS [12], URL shortening only for capacity reasons should be avoided.

<figure><img src="image_4.png" /><figcaption>Fig. 3: Cumulative distribution function (CDF) of URL lengths in the analyzed QR codes, overlaid with capacity limits of selected QR code versions (byte mode, level L error correction, UTF-8 encoding).</figcaption></figure>

**Unresolvable QR codes.** Figure 4 presents an analysis of various failure modes encountered when attempting to resolve URLs encoded within QR codes. These categories include *Connection Timeout*, *Failed to Establish Connection*, *SSL Certificate Failure*, and *Redirection Issues*. Among these, connection failures and timeouts are observed to be the most frequent errors, suggesting that a notable fraction of QR codes point to unavailable or misconfigured web resources at the time of our access. SSL certificate failures indicate the presence of expired or untrusted certificates, which may compromise the security of interactions initiated through QR scans. The occurrence of redirection issues highlights cases in which excessive or broken redirections hinder access to the intended content. These results underscore potential usability and security concerns associated with QR code scanning, reinforcing the need for caution when interacting with encoded URLs.
<figure><img src="image_5.png" /><figcaption>Fig. 4: Error in fetching encoded URLs</figcaption></figure>

# 5 Redirections and USS

Redirection is a common mechanism in USS, in which a user is directed from a shortened URL to its destination URL. Analyzing redirections provides insights into user navigation patterns and potential privacy concerns.

## 5.1 Redirection

We explore three key metrics related to redirection: the proportion of URLs that involve redirection, the distribution of redirection type and the cumulative distribution function (CDF) of redirection chain lengths.

First, approximately 55% of the URLs exhibit at least one redirection, indicating that a majority of the shortened URLs require additional hops to reach their final destinations. Second, we have analyzed the distribution of redirection types, as shown in Figure 5a. The majority of redirections are HTTP 301 (i.e., Moved Permanently) responses, accounting for close to 60% of the total redirections while HTTP 302 (Found) responses follow at around 40%. This distribution suggests that most redirections (301) are designed to be persistent.

Finally, the CDF of redirection chain lengths, depicted in Figure 5b, provides insight into the depth of redirection paths. The result shows that 60% of URLs involve only one redirection, while 40% require two or more redirections. Notably, 10% of URLs undergo three or more redirections, which may heighten privacy risks due to users' navigation paths passing through multiple intermediate domains, particularly when managed by distinct entities. This is particularly concerning as it can lead to increased exposure of user data to multiple parties, potentially without the user's knowledge or consent.

## 5.2 Top Providers

Identifying popular QR code generators and providers is crucial to understanding the USS ecosystem within QR codes. In particular, we examine the reuse of domain names across different QR codes, as illustrated in Figure 6.
<figure><img src="image_6.png" /><figcaption>Fig. 5: HTTP redirections in QR URLs.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 6: Reuse of domain names across different QR codes.</figcaption></figure>

Our findings highlight a diverse set of top domains frequently associated with QR codes, indicating their widespread adoption and reuse. These include dedicated QR code providers like qrco.de, eqrcode.co, qrcode.link, me-qr.com and vqr.vc, as well as general-purpose URL shorteners such as bit.ly. These domains dominate the QR USS landscape, with significant reuse across different QR code deployments.

In addition to dedicated providers, search engines and social networks also play a role in this space. For instance, we also notice in our dataset that google.com is occasionally used for URL shortening. Social network platforms like facebook.com, youtu.be and instagram.com sometimes provide short URLs and QR codes to facilitate content sharing. These cases complement the activities of specialized QR code generators and emphasize the multi-faceted nature of URL shortening in the QR code ecosystems. In the next section, we will be specifically focusing on dedicated QR USS.
# 6 Cookie exploitation by QR USS

The use of cookies in USS linked to QR codes poses significant privacy risks, particularly due to their involvement as a third party. These services can set cookies during redirection, often collecting user data without explicit consent. Domains frequently involved in redirections could use tracking and analytics cookies to monitor user behavior, including link clicks, browsing patterns and locations.

<figure><img src="image_8.png" /><figcaption>Fig. 7: Number of instances that top redirectors set cookies.</figcaption></figure>

## 6.1 Cookies in Redirections

Cookies' potential for misuse raises significant privacy concerns, especially when they collect data without users' explicit consent. Our analysis reveals that 39.2% of URLs with external redirections set cookies, potentially involving third-party domains that engage in tracking and analytics. Top redirectors using cookies (see Figure 7) include prominent domains like `qrcode.co`, `eqrco.de`, `google.com`, `bit.ly` and `qrcode.link`, which leverage cookies for a variety of purposes, which we investigate in Section 6.2. Social networks and content-sharing platforms such as `instagram.com`, `whatsapp.com`, and `linktr.ee` also integrate cookies into redirection chains.

An analysis of individual cookie usage by top redirectors (Figure 8) reveals that certain redirection domains consistently set cookies in 100% of their QR services. Domains such as `qrcode.link`, `eqrco.de`, `eqrcode.co`, `linktr.ee`, `bit.ly`, `helloasso.com`, `youtu.be` and `google.com` exemplify this trend. This uniform behavior underscores their reliance on cookies as a mechanism for enabling functionalities like session tracking, personalization and data collection.
<figure><img src="image_9.png" /><figcaption>Fig. 8: Individual cookie usage by top redirectors.</figcaption></figure>

## 6.2 Classifying Cookies Set by QR USS

Inspired by prior work [2,10], we have used Cookiepedia [16] as a key resource for classifying cookies. Cookiepedia is a comprehensive database of cookies maintained by the Consent Management Platform (CMP) OneTrust [4,2]. Table 2 lists potentially intrusive cookies (analytics/advertising/tracking) classified by Cookiepedia.

<table><caption>Table 2: Intrusive (tracking/advertising/analytics) Cookies collected by QR USS [16].</caption><thead><tr><td>Cookie Names</td></tr></thead><tbody><tr><td>NID, dwanonymous_7ad186a87c92467d3c0495460d6555fc, fbp, mgrefby, equid, SS, AS, SP, dwac_10e76b50b2189fd2b0a7ed1e4f, VISITOR_INFO1_LIVE, mgref, _wpdm_client, G</td></tr></tbody></table>

Targeting/advertising/analytics cookies. We found 13 targeting/advertising cookies set by QR USS. By tracking activities across multiple QR scans, these cookies may enable advertising networks to understand shopping habits, interests and preferences. In the following, we highlight some of the notable cookies and their purposes mentioned in Cookiepedia:

- VISITOR_INFO1_LIVE, monitors YouTube video interactions on external sites, influencing video recommendations and optimizing ad placements tailored to user engagement.

- SP, associated with event-booking, collects click data to enhance advertising campaigns across multiple platforms, ensuring the effectiveness of ad delivery strategies.
- dwanonymous_7ad186a87c92467d3c0495460d6555fc, tracks anonymous in-
teractions for dynamic ad targeting, analyzing patterns without directly
identifying users.

- dwac_10e76b50b2189fd2b0a7ed1e4f, collects data on user navigation and
interaction to fine-tune real-time ad targeting and personalization.

- cquid, supports advanced ad delivery by identifying user sessions and linking them to ad content most likely to drive engagement.

- _wpdm_client, facilitates tailored advertising by tracking interactions with dynamic web content.

- mgref, tracks referrer information to analyze the origin of user traffic, such as from websites, ads or social media campaigns, enabling precise attribution of ad performance.

- mgrefby, captures intermediate interactions to provide a detailed view of multi-step browsing paths, enhancing the granularity of campaign evaluations.

- SS (Session Source), gathers session data in real-time, including clicks and page visits, allowing advertisers to dynamically adjust campaigns to reflect user behavior.

The integration of these cookies within QR USS poses serious privacy chal-
lenges, as they can aggregate data across platforms to build detailed user profiles.
Furthermore, there is no consent collection nor information of the user, which
prevents the exercise of user rights with respect to privacy, in contrast to other
online situations.

***Extended Cookie Analysis.*** We identify 22 out of 89 cookies that are not included in the **Cookiepedia** classification in Table 2 and are labeled as *unclassified*. We start by still using **Cookiepedia** insights to dive into four key aspects of such cookies to know their prevalence: i) the host domains setting such cookies, ii) the websites reporting them as third-party cookies, iii) the websites reporting them as persistent cookies and iv) the websites reporting them as session cookies.

Figure 9 provides a distribution of the above four key attributes. The figure reveals that these unclassified cookies exhibit diverse behaviors in terms of their presence across different domains and classifications. The first plot illustrates that while most cookies are confined to a small number of host domains, a few are widely distributed, spanning nearly 300 domains. The second and third plots highlight that these unclassified cookies are frequently observed as third-party and persistent cookies, with some instances exceeding 1000 occurrences. The final plot shows that session cookies, which typically exist only for a single browsing session, have a significantly higher number of occurrences, with some appearing in over 6000 instances. This suggests that these unclassified cookies may be extensively used for tracking purposes, particularly through session-based mechanisms, reinforcing the need for further investigation into their role and privacy implications.
<figure><img src="image_10.png" /><figcaption>Fig. 9: Characteristics of unclassified cookies.</figcaption></figure>

Moreover, an extended investigation revealed that among these *unclassified* cookies are the tracking cookies _bit_<fnref n="5" /> from Bitly, which stands out for monitoring interactions with shortened URLs, such as clicks and timestamps, potentially uncovering behavioral patterns. On the advertising front, cookies like _adsStatData_<fnref n="6" /> and _trackingId_<fnref n="7" /> enable targeted advertising by assigning unique user identifiers and tracking ad performance. Given the large lifetimes of several other cookies (see next section) like _qB_, _msv4_idCookieUser_, _qrm_ and _QoSID_, their classification as an intrusive cookie looms large.

## 6.3 Cookie Lifetimes

We analyze the lifetimes of all the above-identified potentially intrusive cookies to understand the duration of data collection. Figure 10 illustrates the distribution of privacy-intrusive cookies' lifetimes in days. Results show that intrusive cookies persist way beyond a single browsing session, with more than 95% of cookies lasting between 30 and 7300 days. This indicates QR USS sets cookies potentially enabling the construction of detailed user profiles over extended periods. Among all cookies, COMPASS stands out with a lifetime of less than a day, suggesting that it is primarily used for session-based tracking. In contrast, QoSID cookies persist for 2315 days, while qrm, msv4_idCookieUser and qB last respectively for 3650, 4166 and 7300 days, indicating long-term tracking capabilities. In comparison, we observed that more than 27% of cookies that are not classified as privacy-

<footnote n="5">⁵ https://bitly.com/pages/privacy</footnote>

<footnote n="6">⁶ https://me-qr.com/privacy-policy</footnote>

<footnote n="7">⁷ https://www.facebook.com/privacy/policy</footnote>
intrusive by Cookiepedia expire when the browser is closed or have a lifetime
of less than a day.

<figure><img src="image_11.png" /><figcaption>Fig. 10: Lifetimes of intrusive cookies (in days).</figcaption></figure>

6.4 Set-Cookie Prevalence Across Geographic Locations

<figure><img src="image_12.png" /><figcaption>Fig. 11: Variance of set-cookies across geographic locations.</figcaption></figure>

Figure 11 illustrates the distribution of websites that actively set cookies across different geographic locations from which the QR codes were collected. The results reveal notable differences in cookie-setting behaviors among countries. Austria and Canada exhibit a relatively higher prevalence of websites that set cookies, whereas Canada, China and India also show higher percentages. These variations can be attributed to differences in privacy regulations, enforcement levels and common industry practices. The elevated presence of set cookies may be influenced by factors such as the widespread use of analytics and tracking services. The results indicate that user privacy experiences may vary
substantially depending on geographic location, reinforcing the need for a global
perspective on cookie regulation and enforcement.

# 7 Privacy Implications of URL Path and Query Strings

Independent of the resource they point to, QR codes are often associated with a
specific context. Information related to this context can be transmitted to web
servers through the URL associated with the QR code. The USS may also have
access to this information, though it is unclear whether they process it. Such
contextual information is typically encoded via the Query String part of the
URL (e.g., the URL path can also be used for this purpose). In our analysis,
we found that 25.7% of the URLs contained query parameters, increasing even
more when also taking into account those hidden behind URL shorteners and
redirections, indicating their significant presence in QR code usage.

Table 3 provides an overview of the most frequent query parameters extracted
from URLs embedded in QR codes. These query strings often encode metadata
related to marketing campaigns (utm_source, utm_campaig n, utm_medium), user
identifiers (id, token, cid), payment information (pa, pn, mc) and other con-
textual data such as session details, venue and timestamps. The presence of
structured tracking parameters suggests a significant potential for user profiling
and behavioral tracking across multiple web domains. Notably, the high occur-
rence of payment-related identifiers indicates that QR codes are increasingly
used in financial transactions, raising concerns regarding potential data expo-
sure and security risks. In the following, we perform a detailed analysis of the
privacy threats posed by these query strings, investigating their implications for
user tracking, data retention and third-party sharing mechanisms.

## 7.1 Privacy Implications

A manual analysis of the dataset uncovered a number of data items transferred
via query string parameters. Representative examples are presented in Tables 4, 5
and 6. In the following, we review those items as well as some personal informa-
tion that can be inferred from them.

*Generic user profiling.* Query parameters embedded in QR codes can reveal various types of personal information that could be exploited for user profiling. Beyond consumption habits, QR codes can also be linked to medical contexts. For instance, QR codes associated with clinical trials may contain parameters disclosing the *medical center* conducting the research and the *trial date* (see Table 4). Additionally, event-related QR codes often include details about *time*, *venue*, and *session types*, allowing organizations to track attendance patterns and user interests in specific topics. Even seemingly minor details, such as a *flyer ID*, can be leveraged to infer which promotional materials a user has interacted with, along with the location.
<table><caption>Table 3: Most frequent query strings</caption><thead><tr><td>Query</td><td>Count</td><td>Examples of values</td></tr></thead><tbody><tr><td>utm_source</td><td>35</td><td>seatbackad, AfficheVitrine, INSA, akilux, QR code, QR-code, qr, VersionFemina, affichage, lbpcatcadeau, QR Code, qr_code, affiche, tag2d, maline, print, Print</td></tr><tr><td>utm_campaign</td><td>25</td><td>Bien, fermeture-covid, op12-aout-2023, jeu-rugby, carrefour, 2023_03_01_Aidants_VersionFemina, work_info, b.nouveau_programme_de_fidelite.2024-01-31 Epigenetic, ZT, QR-code-revetsens, akilux-21-22, vuelingsyteng, store4574, INSA PARTNERSHIP FRA TutRecruit, francais-parlent-anglais</td></tr><tr><td>utm_medium</td><td>25</td><td>ooh, qrcode, akilux, QR code, qr, Vitrophanie, Display_Branding, informative_sign, affichage, Print, metro, QRcode, stopper, Partnership</td></tr><tr><td>id</td><td>14</td><td>com.freetnessenergy, 100057276736505, CNU85387, 5d985bd8-1a52-49c4-b177-a3186016aa0a, 1394140769041321986, CNU66119, 100087057884876, 192189, com.keolis.ruban, 61153, prod.maasify evian, 61553441277844</td></tr><tr><td>r</td><td>10</td><td>qr</td></tr><tr><td>pa</td><td>9</td><td>Q751854265@ybl, gpay-11240877578@okbizaxis, paytmqr1w14125ijv@paytm</td></tr><tr><td>pn</td><td>9</td><td>PhonePeMerchant, Paytm, Google Pay Merchant</td></tr><tr><td>mc</td><td>5</td><td>5399, 0000</td></tr><tr><td>utm_content</td><td>5</td><td>Presse, iledefrance, 2557, NW_zt, revetsens</td></tr><tr><td>purpose</td><td>4</td><td>00</td></tr><tr><td>token</td><td>4</td><td>q1ZKLUvNK4nPTFGy...</td></tr><tr><td>cid</td><td>4</td><td>B2010120080300323, B64105231128C2999, B72106230517A0809</td></tr><tr><td>table</td><td>4</td><td>438, B02, 506, T5</td></tr><tr><td>COUNTRY</td><td>4</td><td>1</td></tr><tr><td>questlist</td><td>4</td><td>COUNTRY;CDPF;SOURCE</td></tr><tr><td>CDPF</td><td>4</td><td>31122, 32048, 17501</td></tr><tr><td>mode</td><td>4</td><td>02</td></tr><tr><td>starts_at_from</td><td>3</td><td>2024-09-08 08:00:00, 2024-09-10 08:00:00, 2024-09-10 12:30:00</td></tr><tr><td>day</td><td>3</td><td>2024-09-07</td></tr><tr><td>days</td><td>3</td><td>2024-09-10, 2024-09-08</td></tr><tr><td>cu</td><td>3</td><td>INR</td></tr><tr><td>contentsessiontype_ids</td><td>3</td><td>7585</td></tr><tr><td>order</td><td>3</td><td>room title</td></tr><tr><td>filterbox</td><td>3</td><td>true</td></tr><tr><td>ends_at_to</td><td>3</td><td>2024-09-10 09:30:00, 2024-09-08 09:30:00, 2024-09-10 14:00:00</td></tr><tr><td>timezone</td><td>3</td><td>false</td></tr><tr><td>room_ids</td><td>3</td><td>8374,8373</td></tr></tbody></table>

QR codes found on product packaging frequently contain *product identifiers* or *descriptive details*, revealing specific consumption behaviors (see toothpaste and liquor entries in Table 4). Similarly, QR codes in print advertisements may include query parameters identifying *the publication source and issue number*, thereby exposing *reading habits and preferences* (see magazine entries in Table 4). These findings highlight how query parameters in QR codes serve as *silent carriers of personal information*, emphasizing the need for stricter privacy considerations when embedding tracking elements in consumer-facing QR campaigns.

*Location data.* Query string parameters embedded in QR codes often contain location-related information, allowing third parties to infer a user's whereabouts. In some cases, these parameters provide *coarse-grained geographical details*, such as a *region* or a *postal code*, revealing the general area in which the QR code was
<table><caption>Table 4: Generic profiling through query string parameters from QR codes.</caption><thead><tr><th>Information</th><th>Query String</th><th>Notes</th></tr></thead><tbody><tr><td>Medical information</td><td>cid=qr%3ANucleus Global%3Aresp iratory%2Fonging-clinical- trials%3A29_07_2024%3ALanding Page</td><td>Center and date of the clinical trials</td></tr><tr><td>Event tracking</td><td>'contentsessiontype_ids': ['7585'], 'starts_at_from': ['2024-09-10 08:00:00'], 'ends_at_to': ['2024-09-10 09:30:00'], 'room_ids': ['8374,8373], 'grade': ['1'], 'filterbox': ['true'], 'legendbox': ['false'], 'timezone': ['false'], 'days': ['2024-09-10'], 'day': ['2024-09-07'], 'viewType': ['list'], 'segment': ['poster'], 'segmentname': ['Abstract Sessions'], 'order': ['room title']</td><td>Time and venue of the event.</td></tr><tr><td>Flyer ID</td><td>'flyerCode': ['bonapp106ja983'], 'redirectURL': ['https://bit.ly/3A3SIG6']</td><td>ID of the information flyers.</td></tr><tr><td>Toothpaste</td><td>qrcode=onpack&utm_source=PackSecondary&utm_medium=QR&utm_campaign=Alma-BH0437-BE-FR&utm_content=Sustainability&Purpose-BOP&amp;u tm_term=I8_White&amp; evt_product_id=VyeH9t7wKCVgaUxT dnYAwbab&amp;evt_implicit_scan_id=VET5myhUd9 CPr2e2GBYAUkhr</td><td>Name (Signal Integral 8 white) and identifier of the toothpaste</td></tr><tr><td>Liquor</td><td>utm_source=onpack&utm_medium=qr&utm cam paign=get-27&utm_content=70cl-SEU</td><td>Name of the liquor and size of the bottle</td></tr><tr><td>Cheese</td><td>utm_source=pack&utm_campaign=camembert&amp; tm_source=QR_CODE</td><td>Type of cheese</td></tr><tr><td>Name of the magazine and issue</td><td>utm_source=Presse&utm_medium=QRCODE&amp;ut m_campaign=LEGS24&utm_content= Divertol1+S2+24</td><td>Name of the magazine and issue (2nd semester 2024)</td></tr><tr><td>Name of the magazine and issue</td><td>utm_source=FEMINA-OCT&utm_medium=QR CODE&amp;utm_campaign=24LEGS&amp;utm_content=P RESSE</td><td>Name of the magazine (Femina) and issue (October)</td></tr></tbody></table>

<table><caption>Table 5: Location inference through query string parameters from QR codes.</caption><thead><tr><th>Information</th><th>Query String</th><th>Notes</th></tr></thead><tbody><tr><td>Region</td><td>v=iledefrance-affichage&utm_source=affichage&amp;ut m_medium=metro&amp;utm_campaign=français-parlen t-anglais&amp;utm_content=iledefrance</td><td>Region Ile de France</td></tr><tr><td>City</td><td>CD_ACCESS=NF8E4X&amp;CP=35300&amp;QR=1&amp;utm source=lbpcatcadeau&amp;utm_medium=qrcode</td><td>Postal code</td></tr><tr><td>Train station</td><td>uicDeparture=8738249</td><td>Train station identifier</td></tr><tr><td>Store</td><td>store=store4574&amp;utm_campaign=store4574</td><td>Store identifier</td></tr><tr><td>Restaurant venue and table</td><td>restaurant=K0076&amp;table=T5&amp;terrace=false&amp;to ken=6A5D2166CB73A75F34141DC991350B2C</td><td>Restaurant identifier and table identifier.</td></tr><tr><td>Points of interest</td><td>'continue': [placeid=ChIJo82WsnB9EcRj og UKxUEHhg&source=g.page.m.rc. &laa =merchant-web-dashboard-card]</td><td>Unique location ID</td></tr><tr><td>GPS coordinates</td><td>country=FR&articleId=IN7017&amp; lat=48.73085021972656&amp; lon=2.174370050430298</td><td>Latitude and longitude</td></tr></tbody></table>

scanned (see Table 5). Additionally, store identifiers and train station references can be leveraged to infer visits to specific commercial venues or transportation hubs. These identifiers serve as digital breadcrumbs that, when combined with other contextual data, can contribute to behavioral profiling.

Beyond regional and commercial location data, query parameters may also expose *precise location details*. This includes parameters containing *GPS coordinates*.
*dinates*, allowing the tracking of exact user movements or *unique place identifiers* associated with points of interest (e.g., restaurants and review pages). The presence of restaurant-specific table numbers further suggests the capability to monitor *in-store seating preferences*. Consequently, if users open these QR codes on-site (as is typically the case), external parties can correlate location data with * timestamps* to reconstruct detailed visit timelines, raising significant privacy concerns. Hereafter, we discuss in detail the extended version of this threat.

*Social link inference.* Location-specific QR codes could potentially be leveraged to infer social links between users, as spatio-temporal coincidence [3] (being in the same place at the same time) is a strong indicator of social ties. For instance, in some restaurants, QR codes provided to access the menu and place orders are specific to the venue and the table: https://restaurant.com/restaurants/564/commander/eat_in?table=506.

A group of people dining together would access this QR code at approximately the same time, revealing that they are all seated at the same table and, therefore, part of the same social group (see Figure 12). Although we found no indication that such an inference is currently being performed, we observed that the underlying information is readily available in many cases, as these table-specific QR codes are commonly used by major fast-food restaurant chains.

<figure><img src="image_13.png" /><figcaption>Fig. 12: Scanning a QR code to access the menu at a restaurant can reveal that two persons are dining together.</figcaption></figure>

*Other privacy leaks.* Beyond user profiling and location inference, QR code query strings may also expose *sensitive security-related information*. Notably, some URLs contain *API keys* or *authentication tokens* embedded directly within the request parameters (see Table 6). These keys, if leaked or intercepted, could allow unauthorized access to protected resources, potentially leading to data breaches or system compromises. The presence of authentication keys further exacerbates
security risks, as malicious actors could exploit them to impersonate legitimate users or access restricted services. Additionally, query strings reveal *application identifiers* used for tracking and analytics. These identifiers allow third parties to monitor user interactions across different digital platforms, facilitating targeted marketing and behavioral profiling.

<table><caption>Table 6: Other leaks.</caption><thead><tr><th>Information</th><th>Query String</th><th>Notes</th></tr></thead><tbody><tr><td>API key</td><td>'RATE': ['gQpFZIioRDSOCYMoeFLY5Kbo3D119QuZ']</td><td>Security threat</td></tr><tr><td>Auth key</td><td>'fiche_type': ['publique'], 'lang': ['fr'], 'idann': ['26472'], 'internal': ['1'], 'idag': ['1'], 'authKey': ['ab7127222e4ac2f3d0fdc7a8e8486f4f']</td><td>Security threat</td></tr><tr><td>Application ID</td><td>'appId': ['3'], 'campaignId': ['1699281368256960'], 'utm_source': ['cobranding'], 'utm_campaign': ['vpfr-migration-1223'], 'utm_medium': ['cobrandingnoel']</td><td>User-analytics</td></tr></tbody></table>

## 7.2 Encoded and Non-Human-Readable Parameters

The previous cases were identified because the data was in plaintext and understandable. However, other parameters may carry similar information in an encoded or non-human-readable format, which can be associated with contextual information by the website owner. Our dataset includes 38 QR codes in which the URL contains an alphanumerical identifier of at least 6 characters<fnref n="8" />. However, we were unable to determine whether these were used to convey context information. Thus, the cases identified in Section 7.1 should be considered as the visible part of the iceberg.

## 7.3 Query Strings across Countries

Figure 13 presents the distribution of query strings embedded in QR code URLs across different geographic locations. The variation in the presence of query strings suggests differences in how QR codes are generated and utilized globally. Notably, India exhibits the highest proportion of URLs containing query strings, surpassing 60%, highlighting a high potential for embedding tracking or identification parameters. China also shows high levels, with approximately 40% of QR codes embedding such parameters. In contrast, France, Canada, and Austria have significantly lower occurrences, suggesting a lesser reliance on query-based tracking in QR-linked services.

<footnote n="8">⁸ Examples of identifiers: utm\_campaign=042022\_media\_mdlz\_ritz, token=cd0d80288ae42eef94b4132d982064e9d7f37834,products\_id=51658860, id=1730457376655-ddaf88af-1fe6-4f5b-b657-6426c82d4ce3, scenario\_uid=11f23a77f5a8a186f444</footnote>
<figure><img src="image_14.png" /><figcaption>Fig. 13: Variance of present query strings across geographic locations</figcaption></figure>

However, these discrepancies must be interpreted with caution, as the dataset
exhibits sampling biases, particularly the over-representation of French QR codes
and the limited number of samples from certain countries such as India (only
15 codes). Addressing this imbalance will require a more representative and
geographically diverse dataset, which we leave as future work. The presence of
query strings in QR codes has already raised privacy concerns, underscoring the
necessity for location-specific privacy considerations when assessing QR code-
related risks.

# 8 Discussion and Conclusion

*Discussion.* Tech-savvy users might attempt to assess potential privacy risks by inspecting the URL embedded in a QR code before scanning it. However, problematic parameters may be concealed through obfuscation or only become visible further in the redirection chain (e.g., after passing through a USS). Thus, users are often unaware of the usage of information. Addressing this issue requires better disclosures and mechanisms for informed user consent.

Another challenge is due to the role of USS providers as third parties in the
data collection process. These intermediaries are often not explicitly mentioned
in privacy policies, leaving users unaware of their involvement. This omission
complicates accountability, and it has already been shown that many privacy
policies fail to account for such third-party roles [17]. Regulations need to en-
sure that USS providers are clearly identified in policies. While laws like the
General Data Protection Regulation (GDPR) emphasize transparency and con-
sent, they do not specifically address the unique privacy risks associated with
QR codes and USS. To mitigate the risks of unauthorized data collection and
profiling, policymakers should consider updating existing frameworks to encom-
pass emerging technologies, and service providers must proactively inform and
protect users.

*Conclusion.* This paper provides a comprehensive analysis of the privacy risks associated with QR code usage and URL shortening services (USS). Our study
leverages a unique and diverse dataset of 860 QR codes collected over two years, highlighting real-world practices across multiple domains, regions, and internet regulations. Unlike prior work, we examine the interplay between QR codes, USS and tracking mechanisms, uncovering significant risks such as invasive behavioral profiling and geolocation tracking. Our findings reveal the significant presence of tracking/advertising/analytics cookies set in redirected URLs. Moreover, we find that URLs embed sensitive data like user identifiers and location data in the query strings, enabling user profiling and social link inference.

**Acknowledgements** Sébastien Gambs is supported by the Canada Research Chair program and a Discovery Grant from NSERC. The authors also acknowledge support from Inria, PEPR IPOP, and ANR GTTP projects.

## References

1. Bernholz, L.: Philanthropy and Digital Civil Society: Blueprint 2022 (Dec 2021), https://pacscenter.stanford.edu/publication/philanthropy-and-digital-civil-society-blueprint-2022/

2. Bollinger, D., Kubicek, K., Cotrini, C., Basin, D.: Automating cookie consent and {GDPR} violation detection. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 2893–2910 (2022)

3. Crandall, D.J., Backstrom, L., Cosley, D., Suri, S., Huttenlocher, D., Kleinberg, J.: Inferring social ties from geographic coincidences. Proceedings of the National Academy of Sciences 107(52), 22436–22441 (Dec 2010). https://doi.org/10.1073/pnas.1006155107, https://www.pnas.org/doi/10.1073/pnas.1006155107, publisher: Proceedings of the National Academy of Sciences

4. Hils, M., Woods, D.W., Böhme, R.: Measuring the emergence of consent management on the web. In: Proceedings of the ACM Internet Measurement Conference. pp. 317–332 (2020)

5. Hunter, T.: QR codes are a privacy problem — but not for the reasons you’ve heard. Washington Post (Oct 2021), https://www.washingtonpost.com/technology/2021/10/07/are-qr-codes-safe/

6. Kieseberg, P., Leithner, M., Mulazzani, M., Munroe, L., Schrittwieser, S., Sinha, M., Weippl, E.: Qr code security. In: Proceedings of the 8th International Conference on Advances in Mobile Computing and Multimedia. pp. 430–435 (2010)

7. Krombholz, K., Frühwirt, P., Rieder, T., Kapsalis, I., Ullrich, J., Weippl, E.: QR Code Security – How Secure and Usable Apps Can Protect Users Against Malicious QR Codes. In: 2015 10th International Conference on Availability, Reliability and Security. pp. 230–237 (Aug 2015). https://doi.org/10.1109/ARES.2015.84

8. Lerner, A.: Measuring and Improving Security and Privacy on the Web: Case Studies with QR Codes, Third-Party Tracking, and Archives. Ph.D. thesis, University of Washington (Aug 2017)

9. Lerner, A., Saxena, A., Ouimet, K., Turley, B., Vance, A., Kohno, T., Roesner, F.: Analyzing the use of quick response codes in the wild. In: Proceedings of the 13th annual international conference on mobile systems, applications, and services. pp. 359–374 (2015)
10. Munir, S., Siby, S., Iqbal, U., Englehardt, S., Shafiq, Z., Troncoso, C.: Cookiegraph: Understanding and detecting first-party tracking cookies. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp. 3490–3504 (2023)

11. Neumann, A., Barnickel, J., Meyer, U.: Security and privacy implications of url shortening services. In: Proceedings of the Workshop on Web 2.0 Security and Privacy (2010)

12. Nikiforakis, N., Maggi, F., Stringhini, G., Rafique, M.Z., Joosen, W., Kruegel, C., Piessens, F., Vigna, G., Zanero, S.: Stranger danger: exploring the ecosystem of ad-based url shortening services. In: Proceedings of the 23rd international conference on World wide web. pp. 51–62 (2014)

13. Rotsios, K., Konstantoglou, A., Folinas, D., Fotiadis, T., Hatzithomas, L., Bout-souki, C.: Evaluating the Use of QR Codes on Food Products. Sustainability 14(8), 4437 (Apr 2022). https://doi.org/10.3390/su14084437, https://www.mdpi.com/2071-1050/14/8/4437

14. Smith, J.J.: Corporate tips: Are QR codes problematic from a Privacy Law standpoint? (Oct 2021), https://www.lexology.com/library/detail.aspx?g=fe9e7b45-fbbf-4906-972f-9d541f5516d1

15. Tiwari, S.: An introduction to qr code technology. In: 2016 International Conference on Information Technology (ICIT). pp. 39–44 (2016). https://doi.org/10.1109/ICIT.2016.021

16. Trust, O.: Cookiepedia. https://cookiepedia.co.uk (2024), accessed: 2024-11-13

17. Utz, C., Amft, S., Degeling, M., Holz, T., Fahl, S., Schaub, F.: Privacy rarely considered: Exploring considerations in the adoption of third-party services by websites. arXiv preprint arXiv:2203.11387 (2022)

18. Wahsheh, H.A.M., Luccio, F.L.: Security and Privacy of QR Code Applications: A Comprehensive Study, General Guidelines and Solutions. Information 11(4), 217 (Apr 2020). https://doi.org/10.3390/info11040217

19. Warf, B.: Geographies of global internet censorship. GeoJournal 76, 1–23 (2011)

20. West, A.G., Aviv, A.J.: On the privacy concerns of url query strings (2014)

21. Woo, E.: QR Codes Are Here to Stay. So Is the Tracking They Allow. The New York Times (Jul 2021), https://www.nytimes.com/2021/07/26/technology/qr-codes-tracking.html

22. Yao, H., Shin, D.: Towards preventing QR code based attacks on android phone using security warnings. In: Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security. pp. 341–346. ASIA CCS ’13, Association for Computing Machinery, New York, NY, USA (May 2013). https://doi.org/10.1145/2484313.2484357