Writing a consent note people actually read
A consent note beside a QR code has about five seconds to earn its place. The visitor is standing up, possibly in a queue, deciding whether to point their phone at a pattern they cannot read. If the note is a dense paragraph of legal language, it will be ignored — and a note that is ignored protects nobody. The note that works is short, concrete, and honest: what scanning does, what data it collects, how long the data is kept, who to contact, and the fact that scanning is optional.
Concreteness is the difference between a note that informs and a note that decorates. "We may collect certain information to improve your experience" informs nobody. "Scanning opens our feedback form. We collect your answers, the time of submission, and device type, and we keep them for 30 days" tells the visitor exactly what they are agreeing to. Name the data. Name the retention. Name the contact. If you cannot name them, you do not yet understand your own data flow well enough to ask for consent — go and find out before printing the code.
Retention deserves its own honesty. Every organisation has data it keeps "just in case" with no deletion date, and every such pile is a future incident. Picking a real retention period — session, 30 days, 12 months, until withdrawn — forces the useful conversation about why the data is kept at all. Shorter is usually better, both for privacy and for the team that has to secure the data. If the answer is "we keep it forever because we always have," that is a policy decision worth revisiting, not a default worth defending.
The note must also say what happens if the visitor does not scan. "Ask staff for the same information in another form" is a small sentence with a large effect: it tells visitors the code is a convenience, not a gate. People who cannot scan — dead battery, no phone, no signal, no desire — still deserve the service. A QR code that is the only route to a menu, a form, or a ticket is not a convenience; it is a barrier, and no consent note can fix that.
Finally, remember that the note is a summary, not a substitute. Your full privacy policy must still exist, and the note should link to it. The note's job is to let a standing visitor make an informed choice in seconds. The policy's job is the detail. And the strongest test of both is simple: would you be comfortable if the visitor read the note, understood it fully, and still chose to scan? If the answer is yes, the note is doing its job.