Consent

Consent is the process of obtaining explicit permission from the data subject (the user) for the collection / processing / use of personal data. The GDPR requires consent that is "freely given, specific, informed, and unambiguous". Under Japan's Act on the Protection of Personal Information as well, notification of the purpose of use and the consent of the individual are the general rule.

There are several situations in QR code operations where consent is needed. The first is the collection of scan logs. When the access logs of a dynamic QR code contain IP addresses or location information, these may count as personal data, so they need to be disclosed in the privacy policy. The second is setting cookies. When a QR code's landing page sets tracking cookies, users in the GDPR region need a consent banner beforehand.

The third is the collection of email addresses and phone numbers. When you have users enter personal data into a form at a QR code's link destination, a clear statement of the purpose of use and a consent checkbox are needed. You cannot treat "scanned the QR code = gave consent". Scanning is an act of accessing information, and it is a separate act from consenting to data collection.

The UX design of consent is also important. Simply making users read lengthy terms of use cannot be called genuine consent. A design is required that briefly explains the types of data collected, the purpose of use, and whether data is provided to third parties, so that users can consent after understanding.