QR Code Retargeting: Fire a Meta or Google Pixel When Someone Scans

'Fire a pixel when someone scans a QR code' sounds simple, but the mechanics matter — get them wrong and your audience is half-empty or your scan feels slow. Here's how a QR retargeting pixel actually works, plain and clear.

1. The scan hits your dynamic short link, which resolves the code and checks whether retargeting is enabled and the visitor isn't region-gated.
2. If eligible, instead of redirecting straight to the destination, the visitor is sent to a tiny hand-off page that renders in the browser.
3. That page loads your Meta pixel and Google tag and fires the event. The browser pixel sets a first-party cookie — the thing that makes this visitor retargetable later.
4. In parallel, a server-side event is sent to Meta's Conversions API and Google's Measurement Protocol, carrying the same event ID as the browser event.
5. The hand-off page forwards to the real destination after a few hundred milliseconds — the customer reaches the menu or page they wanted, barely noticing.
6. Meta matches the browser and server events by event ID and de-duplicates them, so the visitor is counted once whether or not their browser blocked the pixel.

Retargeting works because the pixel drops a first-party cookie in the visitor's browser and ties it to their ad-platform identity. Without that cookie, you have an anonymous event but no one to retarget. This is why the hand-off page matters: it's the only moment the browser executes the pixel and sets that cookie. A bare redirect skips it entirely, which is why naive QR 'tracking' never builds a usable audience.

On mobile — where every scan happens — a large share of browsers restrict or block third-party pixel behavior. If you rely on the browser pixel alone, those visitors silently never enter your audience. The server-side event (Conversions API for Meta, Measurement Protocol for Google) is sent from the edge, not the browser, so it isn't blocked. Sharing one event ID across both lets the platform de-duplicate, giving you maximum coverage with no double-counting.

Firing a tracking pixel is processing personal data. The safe default is to region-gate: don't fire for EU/EEA/UK visitors unless you have consent. Beyond that, disclose your tracking and remember you're the data controller for the audience you build. The mechanics above are powerful precisely because they work — so use them deliberately and within the rules.