Cookieless Retargeting With QR Codes (2026)

QR-scan retargeting is building an ad audience from people who scanned a dynamic QR code on your packaging, table tent or receipt, rather than from cookies. A scan is a deliberate physical act that passes through a redirect you control, which makes it a durable first-party signal while browser tracking shrinks.

Why is browser-based retargeting shrinking?

Cookie blocking, app permissions and consent banners each remove part of the audience. Nobody can promise what Chrome does next: in April 2025 Google said it would keep its current approach rather than add a standalone third-party cookie prompt. The other trends point one way.

• Safari blocks all third-party cookies by default, and Firefox has blocked known third-party tracking cookies by default since 2019.
• Since iOS 14.5, an app needs the user's permission to track them.
• Under GDPR-style consent regimes, visitors who decline marketing cookies never fire your pixel.

Why is a QR scan a different signal?

A scan is initiated by the person, not dropped on them. They took out a phone and pointed it at your code, and the scan carries offline context: it came from the code at your front desk.

A dynamic code also routes through a redirect URL you control, which is your instrumentation point. One caveat: pixel-based QR retargeting still uses first-party cookies and identifiers, and consent rules still apply on the landing page. It is not tracking-free. The signal source is intentional first-party engagement, which the browser changes above leave alone.

How do scan events and the Conversions API build audiences?

Each scan of a dynamic code can fire a named Meta pixel event, and a Conversions API token sends the same scan server to server. The default event is QRScan; you can choose Lead, Schedule, Purchase or a custom name. Events carry content_name, content_ids and content_category, so each code becomes its own audience.

The server-side event still arrives when an ad blocker or iOS privacy feature drops the browser one, and it is deduplicated against it. Meta's documentation recommends using the Conversions API in addition to the pixel. Pixel events need a Pro plan ($19/mo) or higher; the trial does not include them (see pricing). See the QR code retargeting guide for setup.

How does it compare with other audience sources?

Keep your site pixel. QR scans add the audience your website never sees: the packaging holder, the diner, the trade-show walk-up.

How do you start?

1. Pick one high-traffic touchpoint: packaging, receipts, table tents or an event booth.
2. Create a dynamic QR code with a named pixel event and your Conversions API token. Use a standard event such as Lead if you want Meta to optimize delivery toward scans; a custom event must be wrapped in a custom conversion first.
3. Start collecting early. Meta's documentation says you need a Custom Audience with at least 100 people before you can build a lookalike, and not every scan matches a Meta account.
4. Build three audiences: scanner retargeting, a lookalike seeded from scanners, and an exclusion audience of people already in your store.
5. Name codes clearly, so "Booth-A-Demo" and "Packaging-SKU-12" segment themselves.

Static codes cannot do this: there is no redirect to fire an event. Compare static vs dynamic and read how to track scans to see which placements fill the audience fastest.