From Grok:
When you scan a restaurant QR code (like the one on the Pizza Hut menu directing you to current prices), you’re not just viewing a menu — you’re triggering a web request that lets the restaurant (and often third-party tech providers) collect various data about you and your behavior.746
Here’s a breakdown of the main types of data involved:
1. Basic data collected automatically on every scan (even if you just view the menu)
This happens the moment your phone loads the linked page — no login or ordering required:
•Scan metadata: Exact timestamp, which specific QR code you scanned (many are table-specific, so they know your table/section), and scan volume trends (e.g., how many people scanned today).48
•Device and technical info: Your device type (iPhone/Android), operating system, browser, and screen size (via the “user-agent” string your phone sends).
•IP address and approximate location: Reveals your city/region and internet provider; sometimes more precise if the code is geofenced to the restaurant.
•Basic behavior tracking: Which menu sections you scroll to, items you view longest, popular categories, and time spent on the page.448
Many systems route through a third-party tracking server first (dynamic QR codes), which logs this as “analytics” for the restaurant’s dashboard.36
2. Interaction and order data (if you browse, add items, or order)
•Detailed menu analytics: Which specific items get the most views vs. orders, modifications/customizations, conversion rates (e.g., viewed → ordered), and patterns like “appetizer X leads to main Y.”49
•Order specifics (common for full QR ordering systems): What you ordered, when, table number, price, any special requests, and total.
•Timing and context: Peak scan times, language chosen, or device preferences.
Restaurants use this to tweak menus dynamically (e.g., why prices aren’t printed — they can update them instantly and see real-time popularity).1
3. Personal/identified data (if you go further)
•If you sign up for loyalty, enter contact info, or place an order: Name, phone number, email, payment details (processed via their system), and dining history/preferences.
•Over time with repeat visits (especially if linked to an account): Visit frequency, average spend, favorite items, and a customer profile for personalized recommendations or marketing.49
•Some systems integrate with POS tools like Toast or Square, pulling this into the restaurant’s CRM.
4. Advanced tracking (often via third-party QR/menu providers)
Many restaurants use platforms (e.g., Toast, specialized QR services like those from Flowcode/Uniqode-style tools, or custom ones) that add:
•Device fingerprinting: A unique “ID” for your phone based on its settings/hardware combo (even without cookies).
•Cookies, advertising ID, and behavioral profiling: Tracks you across sites/apps; can link this restaurant visit to your broader online activity (e.g., ads you see later).
•Inferred demographics: Age group, gender, interests (estimated from behavior or cross-referenced data).4647
These providers often share/sell anonymized or aggregated versions of the data with advertisers, analytics firms, or partners. The restaurant gets useful dashboards; the platform gets richer tracking.
In short: A simple scan gives the restaurant (or its tech partner) mostly anonymous usage stats your device footprint to understand “how guests behave here.” Going deeper (ordering/contact) turns it personal. Compared to a printed menu, this is far richer data — which is exactly why chains like Pizza Hut push QR codes: cheaper than reprinting menus valuable insights for pricing, layout, and marketing.15
Privacy note: You can often view basic menus without much input, but full systems encourage more. Using airplane mode a privacy browser, or asking for a physical menu/alternative, limits exposure — though many places now rely on QR for dynamic pricing.