What Hides in a URL's Parameters
A QR destination is rarely just a page address. Campaign links carry utm_source, utm_medium, and utm_campaign so marketers can attribute scans; ad links carry click IDs such as gclid or fbclid so platforms can match the visit to an ad. Those are normal for marketing, but the same mechanism can carry far more sensitive cargo: an email address, a name, a phone number, or a session token, all sitting in plain text in a link that anyone can photograph, forward, or find in a server log.
Why personal data in a URL is a problem
URLs are logged everywhere: by the browser history, by analytics tools, by proxies, and by any site the link passes through. A password-reset token or a session ID in a URL can be replayed by anyone who copies it. An email address in a URL turns a printed poster into a list of addresses for whoever photographs it. The fix is structural: never put personal data in a QR destination. Use a short random reference and look the details up server-side after the scan.
What to do with the audit result
- Tracking-only parameters: keep them if the campaign needs attribution, and document them.
- Personal-data parameters: remove them and re-issue the code.
- Long identifier-shaped values: check whether they identify a person or session; if so, replace them with an anonymous reference.
- After fixing the URL, regenerate the QR code — the printed code still carries the old parameters.