Clicks Before Commerce: Auditing the Real Yield of QR Codes in UK Mailpacks

QR codes now appear on envelopes, inserts, door drops and reply cards with the regularity of a postage mark. Their appeal is understandable: they promise a clean digital trail from a physical mailpack to a measurable action. Yet many UK marketers treat the scan itself as the response. That is a category error. A scan proves that a recipient lifted a phone, framed a code and followed a link. It does not prove that the mailpack produced a sale, a qualified lead or even a genuinely interested prospect. As mailers enter the 2026 planning cycle, the commercial question is not whether QR codes can be tracked. It is whether they are being tracked in a way that survives scrutiny.

Why a scan is an intermediate event

A scan sits early in the response chain. It is closer to a door opened than a conversation started. The recipient may be curious, bored, checking a competition, testing whether the code works or looking for a phone number. Some will arrive on the landing page and leave within seconds. Others will scan in a busy kitchen, lose signal, or abandon a form that asks for too much. If the reporting dashboard counts all of these as response, the campaign will look healthier than it is and the next mailpack will be planned on a false reading.

The distinction matters most when QR codes are compared with other response routes. A printed phone number, a freepost address and a QR code may all generate activity, but they do not carry the same intent. A coupon returned by post usually represents a deliberate act. A scan may represent a moment of mild curiosity. Treating the two as equivalents distorts cost per response and flatters digital tracking at the expense of commercial truth.

Six audit points for UK mailpacks

1. Unique codes and clean identifiers. A single campaign QR code can report aggregate scans, but it cannot tell you which list, segment or mailer produced them. Where budget allows, use unique or batch-level codes. Keep the URL opaque: do not place names, email addresses or full postcodes in the query string. A short redirect domain controlled by the advertiser is preferable to a third-party shortener that may expire or obscure ownership. Match scans back to the mail file only at the level the privacy notice permits.

2. Landing-page friction. Test the full journey on a mid-range Android handset using mobile data, not just office Wi-Fi. Check load time, form length, postcode lookup, consent language and whether a phone fallback is visible. A QR code that leads to a desktop-designed page with seven required fields is not a response channel; it is a barrier with a square barcode. The Advertising Standards Authority expects claims on the landing page to match the mailpack, so the audit should include message consistency as well as usability.

3. Attribution window. Define the window before the campaign breaks. A seven-day window may suit a time-limited offer; a twenty-eight-day window may be more realistic for considered purchases. Record scans, qualified visits, leads, sales and redemptions separately. Where possible, use a promo code, a matched-back source question at the call centre or a control group that received no QR code. Last-click attribution will otherwise award the sale to the QR code even when the recipient would have responded anyway.

4. Privacy and consent expectations. UK GDPR and PECR still apply when a physical mailpiece points to a digital journey. If the landing page sets analytics cookies or captures personal data, the consent banner and privacy notice must be fit for purpose. Avoid embedding personal data in the URL. Avoid assuming that a scan equals consent to marketing. The ICO's expectations around transparency are not a technicality; a poorly governed QR journey can create more risk than the mailpack itself.

5. Print and placement. Audit the code in the format in which it will be printed. Check contrast, size, quiet zone and position against folds, windows and addressing panels. A code on a dark envelope may fail; a code beside a perforated edge may be damaged. Test envelope, letter, insert and door-drop formats separately. The cheapest placement is rarely the one that produces the cleanest scan.

6. Cost per commercial outcome. Report cost per scan only as a diagnostic. The commercial metric is cost per qualified lead, sale or redemption, including print, postage, data, landing-page build, fulfilment and any discount. A campaign with a high scan count and a low conversion rate may still be useful for creative testing, but it should not be presented as a return on investment.

The point at which a scan becomes a sale

A scan becomes a sale only when a commercial event can be linked to it with a defensible rule. That rule might be a unique promo code redeemed online, a matched-back telephone order, a completed application or a verified booking. If no such link exists, the honest label is 'scan-assisted activity', not revenue. For smaller mailers, a control group and a simple source question may be more credible than an elaborate dashboard.

Set thresholds in advance. For example, a test cell might require a minimum number of scans before any landing-page conclusion is drawn, and a separate minimum number of qualified actions before the QR route is judged viable. If the scan-to-qualified-action rate is very low, the problem may be the offer, the page or the audience rather than the code. The audit should identify which.

Reporting without vanity

A useful QR report has four columns: scans, qualified visits, commercial actions and margin. It separates curiosity from intent and shows the drop-off at each stage. It also states the attribution window and the matching method. That is less exciting than a rising scan graph, but it is more useful to a finance director. The GreatDMA view is that direct mail measurement should survive a boardroom question, not just a dashboard review.

Before the next UK mailpack goes to print, audit the QR journey as a chain rather than a feature. The code may be square, but the commercial case should be circular: test, match, challenge and refine. A scan is not the sale. It is simply the first place where the sale can be lost.