QR Code Tracking in GA4: How to Stop Scans From Showing Up as Direct Traffic

By Janae Tanner, VP of Growth and Client Success at Strativera. Janae leads client growth engagements at Strativera, a principal-led growth agency headquartered in Cherry Hill, New Jersey, where every engagement is held to the same standard: marketing activity has to connect to revenue outcomes. The tool review referenced below was conducted by the Strativera RevOps team in August 2026. Published August 2026.

An estimated 102.6 million Americans will scan a QR code in 2026, according to eMarketer’s forecast, up from roughly 89 million in 2022. Marketers responded the way you would expect. Codes now sit on direct mail, packaging, table tents, trade show banners, truck wraps, and business cards.

Here is the uncomfortable part. At most companies, almost none of those scans are attributable. The flyer worked or it did not, and nobody can prove which. The scan happens, the visitor lands on the site, and GA4 files the session under Direct, the bucket where attribution goes to die.

That is not a GA4 bug. It is a tagging failure, and it is completely fixable in about two minutes per campaign. This guide covers the whole system: why scans go dark, the UTM conventions that light them up, the GA4 channel trap that catches even experienced marketers, the print specs that keep codes scannable, and the free tool we built so none of it requires a login, a lead form, or a subscription. Open the free QR code generator with UTM tracking in another tab and build along as you read.

Why QR Scans Show Up as Direct or Unassigned

A QR code is nothing more than a URL rendered as a pattern. When someone scans it, their phone opens that URL in a browser with no referrer. No referrer means GA4 has nothing to classify, so the session lands in Direct, indistinguishable from someone typing your domain from memory.

The only way GA4 can know a session came from a printed code is if the URL itself says so. That is exactly what UTM parameters do. They are small tags appended to the URL that declare the source, medium, and campaign before the visitor ever arrives.

There is a second failure mode that trips up people who already know about UTMs. You can tag a link perfectly and still find the traffic sitting in Unassigned, because GA4 sorts sessions into channels using a fixed, published rule set that you cannot edit. If your utm_medium value does not match any rule, GA4 shrugs and files the session as Unassigned. That trap is the single most common reason tagged QR campaigns still fail, and it gets its own section below.

The Five UTM Parameters, Applied to Print

The parameters themselves are standard. What changes for QR and print is how you use them, because offline placements have no ad platform doing the tagging for you.

Two hygiene rules do most of the work. First, lowercase everything: GA4 is case-sensitive at the data layer, so Email and email report as two different rows and quietly split your numbers. Second, never use spaces; use hyphens. Our QR generator enforces both automatically, because a convention that depends on everyone remembering it is not a convention, it is a hope.

The GA4 Channel Trap: Why utm_medium Is the Dangerous Field

GA4’s default channel definitions are a lookup table Google publishes and you cannot modify. A medium of cpc from a search source lands in Paid Search. A medium of email lands in Email. A medium of qr-scan, qrcode, or QR_Print lands nowhere, and the session reports as Unassigned.

This is why we built the tool with a locked medium dropdown instead of a free-text field. Every option maps to a real GA4 channel rule:

Notice the last row. There is no built-in Print or QR channel in GA4. You have two workable options, and we recommend the first.

Option A, the clean one: build a custom channel group

Use utm_medium=qr everywhere. In GA4, go to Admin, then Data display, then Channel groups. Create a copy of the default group, add a channel named QR / Print with the condition “medium exactly matches qr,” and reorder it above Unassigned. Every report can then be viewed through that channel group, and your offline traffic gets its own named line next to Paid Search and Email. Five minutes, once, per property.

Option B, the pragmatic one: borrow an existing channel

Some teams tag QR scans with utm_medium=referral so the traffic at least lands somewhere visible. It works, but it pollutes the Referral channel and makes year-over-year comparisons murky. Use it only if you have no admin access to create channel groups.

One hard exception

Do not hand-tag Google Ads destination URLs. Google Ads auto-tagging appends a gclid that GA4 prioritizes over manual UTMs, and stacking both can misattribute the click. Manual tagging is for everything auto-tagging cannot see: email, organic social, affiliates, PR, and everything you print.

A Naming Taxonomy You Can Hand to Your Whole Team

The difference between attribution and noise is consistency across every person who ever makes a code. Here is the placement taxonomy we deploy for clients, ready to steal:

Keep utm_medium constant at qr across all of them; that is what your custom channel group keys on. Let utm_source carry the placement type and utm_content carry the specific unit. Then utm_campaign ties everything to the initiative, so one report answers “did the spring mailer work” and a one-click drill-down answers “front panel or back panel.”

The payoff compounds. Run the same offer on a postcard and a table tent with identical campaign values and different sources, and GA4 will tell you the cost per visit of each placement. That is the moment print stops being a faith-based channel.

Why We Did Not Gate This Tool

Strativera is a RevOps and growth agency. Our entire operating thesis is that marketing activity should connect to revenue outcomes, and that broken attribution is where most growth budgets quietly leak. A QR code without UTM tags is a small, perfect example of that leak: real spend, real engagement, zero learning.

So when we built our own generator, gating it behind an email form felt like working against the point. Clean attribution should be the default for everyone, not a lead magnet. The tool is free, unlimited, and runs entirely in your browser. Nothing you type is uploaded, stored, or sent anywhere, there is no watermark, and because the codes are static, they never expire and never depend on our servers.

Before writing that positioning down, we pressure-tested it. In August 2026 our RevOps team reviewed 13 popular free QR generators and UTM builders, and independent industry comparisons published this year document the same patterns we saw.

• The household names gate the useful parts. Independent 2026 testing by QR industry publications (EZQR, QRForever, QR-Verse, and QRLynx each published tested comparisons) reports that Bitly’s free tier brands most codes and can deactivate them on downgrade, Flowcode watermarks free codes and has removed codes when subscriptions lapse, QR Tiger’s free dynamic codes carry scan caps and its SVG export moved behind the paywall in 2026, and Uniqode offers a trial rather than a free tier, with codes that expire.
• The genuinely free generators skip attribution. QRCode Monkey, the most generous no-signup option, produces excellent static codes with no watermark but has no UTM builder at all. Canva and Adobe Express make basic codes inside a design workflow, again without campaign tagging.
• A few ungated UTM-plus-QR utilities do exist, and credit where it is due: they are a step up from nothing. But every one we reviewed accepts free-text UTM values, which is precisely how campaigns end up in Unassigned. As of our August 2026 review, we could not find another free, no-signup tool that validates utm_medium against GA4’s default channel definitions before generating the code, enforces lowercase and hyphenation, and pairs it with print-spec SVG export. If one exists, we would genuinely like to see it. The category needs more of this, not less.

That last capability is the whole reason the tool exists. Anyone can append text to a URL. Appending text that GA4 will actually classify is the part people get wrong, and the part a tool should make impossible to get wrong.

Build a tracked code in about two minutes. No signup, no email, nothing stored.

Open the free QR code generator

Static Codes, Dynamic Codes, and the Honest Tradeoff

Most paid QR platforms sell dynamic codes. The code points to a short redirect URL on the vendor’s server, which forwards to your destination. That architecture is why those platforms can offer scan counts and post-print editing, and it is also why free tiers expire: when the redirect stops being paid for, the printed code dies. Multiple 2026 comparisons document consumer complaints about exactly this failure.

Our tool generates static codes. The full tagged URL is encoded directly in the pattern. The advantages are permanence (nothing to expire, no vendor in the path), privacy (no third party logging every scan), and zero cost forever. The honest tradeoff is that a static code cannot be re-pointed after printing, and scan analytics live in GA4 rather than in a per-code dashboard.

If you need post-print flexibility, there is a middle path we use for clients: encode a short URL on a domain you control (a WordPress redirect plugin such as Pretty Links works fine) with the UTM tags on the final destination. You keep the ability to change where the code lands, and the only vendor dependency is you.

From Download to Design: Getting the Code Into the Real World

The tool exports two formats, and choosing correctly is the difference between a crisp banner and a blurry one.

SVG is the print format. It is vector, meaning it scales from business card to billboard with zero quality loss, and it is what print vendors and designers expect. It drops straight into Canva (Uploads, then drag it onto your flyer, menu, or postcard), Figma, Adobe Illustrator, and Affinity. Because our SVG is a true vector with the quiet zone baked in, you can scale it to any final size inside your design file without regenerating anything.

PNG covers screens. Slide decks, email signatures, digital menus, lobby displays. The tool exports at four sizes matched to use case, from 300 px for screens up to 2000 px for large format, so a raster workflow still has the pixels it needs at 300 DPI.

A few print rules the tool already follows, worth knowing so you can defend them to a designer or a vendor:

1. Size by the 10:1 rule. Minimum code width is the expected scan distance divided by 10, as mapped above.
2. Never print below 2 cm, whatever the resolution. Phone cameras start failing on smaller codes.
3. Dark code on a light background, always. Cameras read luminance, and inverted light-on-dark codes fail on a meaningful share of devices. Brand colors are fine as long as contrast stays high.
4. Protect the quiet zone. The blank margin around the code is part of the spec, not empty space for a designer to reclaim. It is baked into the export; never crop it.
5. Match error correction to the environment. The tool defaults to M (15%) for print. Step up to Q or H for packaging, outdoor placements, or anything that will get scuffed.
6. Test before the print run. Scan the exported file at final size on at least two phones, one iPhone and one Android, in the lighting where the code will actually live. Then click through and confirm the tagged URL loads with its parameters intact.

That last check matters more than people expect. Some redirect and shortener configurations strip query parameters. Scan, land, and verify in GA4’s Realtime report that the session shows your source and medium before you approve the proof.

Reading the Results in GA4

Once tagged codes are in the wild, the data shows up in three places:

• Reports, then Acquisition, then Traffic acquisition, viewed with your custom channel group selected. Your QR / Print channel gets its own row with sessions, engagement, conversions, and revenue.
• Session source / medium as a secondary dimension breaks the channel down by placement, which is where the postcard-versus-table-tent answer lives.
• Explorations let you build a free-form table of campaign by content, which turns a multi-placement campaign into a ranked list of what earned its ink.

Two closing measurement notes. First, expect undercounting rather than overcounting: a QR-tagged session is close to certainly a scan, but some scanners and in-app browsers mangle parameters, so treat the number as a floor. Second, if you run enough offline volume to care about cost reporting, the tool supports utm_id, which is the join key GA4 uses to import non-Google cost data. Tag with it from day one and you will not have to reprint anything when your reporting matures.