What a scan actually tells you

What a scan produces, and what it does not

A code on a garment produces one thing when somebody points a phone at it. A request arrives at a server, carrying a time, an identifier and whatever the requesting device chooses to disclose about itself. Everything beyond that is inference, and most of the inference in circulation has no population underneath it.

The second thing worth saying at the top has changed since this page was first drafted. Four field measurements of scanning behaviour with stated populations have now been located, and they were public the whole time. They do not converge. Between the lowest and the highest they span roughly three orders of magnitude.

That strengthens the position this page already held rather than weakening it. A number that moves by a factor of about a thousand depending on the shop, the device and what the scan is worth is not a rate anybody can plan against, and this page publishes no universal scan rate in any form. What follows sets out what has been counted, against what population and with what on the other end of the code.

The four measurements, and the distance between them

The rule applied to every row below is the estate's ordinary one. A figure appears in the same sentence as the population it was measured against, or it does not appear at all. Four studies now clear that rule, and each of them measured a different thing.

One thing has to be said before the table rather than after it. The four figures, and the denominators that make them figures, sit in the research record and are not transcribed into this page. Transcribing a number from memory is how a denominator gets separated from its numerator, which is the failure this whole page exists to describe, so the rows below carry the design of each study and the honest state of its figure instead. Closing that is a transcription check against four publications rather than an open research question.

Three of those four were read at their own publication. One reached us through a mirror, because the publisher's own file returned an access error, and that provenance travels with the figure rather than being dropped once the number is convenient. Which of the four it is has to be named in its own row before publication, and it is not named here on a guess.

The distance between the top and the bottom of that set is roughly three orders of magnitude. The explanation sits in the third column rather than the second. Where somebody used their own phone and got product information for it, the number is at the floor. Where the scan paid something immediately, or where the study put a working device into the participant's hand, it climbs. Device friction and value exchange move this number. Curiosity does not, and no amount of interest in the category substitutes for either.

A court decision sits alongside the four and is worth naming separately, because it is not a study. A United States federal court held that a disclosure delivered only through a code on the pack was not sufficient, citing evidence about technical knowledge and device access among the people the disclosure was for. That is one court in one country, deciding about food rather than clothing, and it reached this page through the estate's research record rather than from the judgment itself. It is also the only occasion we found where an institution with the power to decide the question actually decided it.

The figures that point the other way, and the test to apply to all of them

Numbers running in the opposite direction do exist and they are much larger. They are surveys of intention. One trade association survey across five countries reports stated willingness far above anything in the table above, which is what stated willingness usually does.

Its sample size was not published. So the figure does not appear on this page, and neither does the size of the gap, because one side of that arithmetic has no denominator to divide by. This is not a judgement about the survey or about the people who ran it. It is the same rule applied in both directions: a proportion whose population nobody states cannot be checked by anybody, including by the people quoting it.

The vendor figures behave the same way. Several circulate as scan rates. Where we chased them, the sample size, the fielding period and the question wording were not obtainable, and in at least one case the publisher openly concedes that operators do not agree on what a scan is, some counting distinct devices per code per day and others counting every event including repeats. A rate assembled from two definitions is not a rate.

A longer list circulates alongside them and none of it appears here: re-engagement multiples, resale multiples, lifetime value doublings, registration uplifts, revenue lifts, total access counts, product counts across consortia and purchase intention proportions. Not one of them arrived with a baseline, with a denominator or with a counterfactual. The three questions below are the shortest form of the test, and they work in a meeting without a laptop.

What the traffic on a resolver can and cannot produce

If you print a code and stand something up to answer it, you get a log. The log is real, it is yours and it is worth having. It is also a much narrower instrument than it is usually sold as, and the boundary is structural rather than a gap that better tooling closes. What sits between the camera and the record is a mechanism with several moving parts, and each of them decides what the log gets to see.

What it can produce

• A count of resolutions, and a separate count of distinct devices, if you define both and keep them apart.
• A timestamp on every one of them.
• Coarse geography, and the language the requesting device asks for.
• The identifier itself, together with any batch or serial the address happens to carry.
• Device class and operating system, at the level the request discloses them.
• Which printed variant was used, but only if you took the trouble to print distinct codes per channel.

What it cannot produce

• A denominator. How many units are in circulation is not knowable from the resolver. Without that number there is no rate, only a count.
• Any view of the people who did not scan. They leave no trace at all, so no weighting corrects the bias, because the frame itself is unknown.
• Purchase attribution. A scan is not a sale, and nothing in the log turns it into one.
• A clean count. The same log holds bots, link previews generated by messaging apps, scans by your own staff, quality checks during production and repeat scans by one curious person. Nothing in the exchange separates them.
• Reliable geography. Address masking, relay services and carrier network translation degrade exactly the field that makes the log personal data in the first place.

Read the second list against the first and the honest position is not complicated. Resolver traffic is a good signal about a self-selected group of people who had an unmet question at a moment of decision. It is not a panel and it is not projectable.

Where it earns its keep is narrow and genuine. A cluster of scans on one batch in one market can surface a defect earlier than returns data does, precisely because the population that bothers to scan skews towards people with a problem. That is a monitoring use rather than a measurement one, and it should be priced as one.

What you are permitted to collect is a separate question again

Nothing above asks whether you may keep any of it. Two constraints sit on top of the technical ones and they run in the same direction.

The first is ordinary. What the destination page does as it loads is what brings data protection rules into play, rather than the printed square itself, and a compliance carrier that quietly instruments its visitors is a decision somebody made rather than a default somebody inherited. Supervisory guidance on the technical scope of the communications privacy provision goes further than most people in this category expect: an identifier carried in the address itself can fall inside that provision through nothing more than client-side caching by the browser. The provision is written around information stored on or read from a device rather than around personal data, so the question of whether the identifier is personal is not the question that decides it.

The second constraint is sharper, and almost nobody in this category mentions it. In the one live European regime that already places mandatory product information behind a code, the electronic route is conditioned on the producer collecting or tracking no user data. The Commission notice implementing that regime states it in the operative voice: no user data shall be collected or tracked. Its question 35 closes the obvious escape by answering that there are no exceptions to that rule. This is not a consent problem to be engineered around. It is a condition on taking the electronic route at all.

Now the scope guard, in the same breath as the rule, because the rule is easy to over-read. That regime is wine. It is not clothing, and the ecodesign framework carries no equivalent prohibition for textiles. Nothing we read extends the wine rule past the product category it was written for, and a textile seller who takes the paragraph above as a prohibition binding on them has taken it wrongly. What it demonstrates is narrower and more useful than a prohibition: that a European legislator, handed a compliance carrier, has already decided once that measuring the people who use it is not something the producer gets to do.

Whether anything of that shape reaches clothing is not established, and nothing we read decides it either way. How the estate handles a question it cannot resolve, and how it types an absence before writing it down, is set out in how we know.

Who sees what, and what should never be in there

There is a positive half to this and somebody has to decide it. The framework provides for the information in a passport to be available to different actors at different levels, and it leaves the naming of those actors and those levels to the product-specific act rather than settling it itself. No such act exists for textiles, so nobody has yet been told what a consumer sees, what a repairer sees, what a recycler sees or what an authority sees.

Until somebody is told, the level of access is a design decision made by whoever publishes, and it gets made by default if it is not made deliberately. Two rules survive without any act at all. Publish nothing into a consumer-facing view that you would not print on the swing ticket, because a code is a printed surface with no lock behind it. Then decide what each other audience is given on the evidence of what they can act on, rather than on what happens to be easy to expose.

The duty is to make information reachable, not to be read

This is the part that changes what a programme is for. The framework's passport articles require a data carrier physically present on the product, its packaging or the documentation accompanying it, connected to a persistent identifier. They do not mention engagement, they set no threshold and they provide for nobody to measure one.

The framework's own answer to discovery points the same way. It provides for a publicly accessible portal allowing stakeholders to search and compare passport data. Stakeholders is doing the work in that sentence, and it is not a synonym for shoppers. The other audience this category talks about is the one at the far end of the garment's life, and what a recycler can actually use turns out to be a separate question with an answer just as unflattering.

So a programme that has to earn a consumer engagement rate to justify itself has quietly become a marketing programme in compliance clothing, and it will be judged on a number nobody in the field can produce. A programme built to make correct information reachable is judged on whether it is reachable and whether it is correct. Both of those are measurable by the party doing the work, which is the whole difference.

What would change this page

This is a reading of a thin evidence base, and it is built so that one publication can overturn it. If anybody publishes a scan count with the number of units placed on the market beside it, for a named product group over a named period, the finding here changes and the page changes with it. That is the intended behaviour rather than a risk being managed.

That clause has now been tested once. Four measurements turned up, all of them public and none of them ours, and the page was rewritten around them rather than defended against them. What they did not do is settle the argument, because not one of the four is a count of resolutions against units placed on the market.

Five numbers would settle most of it. We did not find an operator publishing any of them.

1. Resolutions per unit placed on the market, with both numbers stated rather than the ratio alone.
2. Total resolutions and distinct devices, defined separately and never merged into one figure.
3. Time from placing a unit on the market to the first resolution against it.
4. The proportion of well-formed identifiers that resolve to nothing, with the number of identifiers tested.
5. Repeat resolutions per household across a purchase cycle.

That is a statement about where we looked rather than a statement about the world. The one brand-published scan count we did find is a bare total with no units-in-market figure anywhere near it, which is the shape of almost everything in this field.

We do not publish those five numbers either. The symmetry is deliberate. A page that argues this and then reports a bare count of its own would be an instance of exactly what it is criticising, and the four measurements above do not change that, because none of them is one of the five.

One thing this page does not say, and will not. It does not say that consumers do not scan. It says what has been measured. It says by whom, against what population and with what on offer. Those are different claims and only the second one is supportable.

What follows for a brand deciding whether to print a code

Nothing here argues against printing one. It argues against printing one for the reason usually given. Three reasons survive the evidence above and none of them is an engagement reason.

1. A duty to make information reachable is discharged by the carrier working. Whether anybody uses it does not enter into it, which is unusually convenient, because whether anybody uses it is the part you cannot measure.
2. A scan that does something is a transaction rather than a document. A repair booked, a warranty registered, a return routed. The measured range says the same thing from the other direction: the studies at the top of it are the ones where the scan was worth something at the moment it happened.
3. Machines and staff scan far more reliably than shoppers do. A code read at a till, in a warehouse or at a customs desk is read whether or not anybody in the shop was curious.

What does not survive is a business case whose main term is a projected consumer engagement rate. There are now four measurements to build one on and they disagree by a factor of about a thousand, so the projection would land wherever the person building it chose to put it. If you need the identifier and the carrier themselves explained rather than argued about, the identifier a code carries and what a scan actually reaches are the two places to start.

Sources

• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text
  Arts. 9, 10, 14CELEX 02024R1781-20240628In forceRelevant provisions reviewed

  Here for three propositions and no others: that the carrier duty is a duty to make information reachable from the object, that the framework's own answer to discovery is a portal for stakeholders, and that which actors may see which information is left to the product-specific act rather than settled by the framework. Nothing here rests on the annex or on the articles above twenty nine, which were not readable.

  View official source

• Four field measurements of scanning behaviour, each with its own denominator
  Field researchRelevant provisions reviewed

  The four field measurements this page is built on. Three were read at their own publication and one through a mirror, because the publisher's own file returned an access error, and that provenance travels with the figure. The figures themselves and the denominators that make them figures are held in the research record and are not transcribed into this page, so no row and no band carries a number. What the record does state, and what this page therefore states, is that the four span roughly three orders of magnitude and that no aggregate may be formed across them.

• Regulation (EU) 2021/2117, electronic labelling of wine and the rules governing that carrier
  In forceRecitals reviewed, enacting terms pending

  Declared for one proposition and no more: that in at least one European regime already placing mandatory product information behind a code, the electronic route is conditioned on the producer collecting or tracking no user data. The regulation itself was read at its recitals only, and the enacting terms it introduces were not reachable, so the page names no article and quotes nothing from the operative provisions. The Commission notice implementing that regime, which states the rule in the operative voice and answers the exceptions question at its question 35, was read at its own text in this pass. The maintained register carries the regulation rather than the notice, and adding a row for the notice is a publication check rather than a gap in the reading.

  View official source

• Supervisory guidance on the technical scope of the communications privacy provision
  Institutional guidanceRelevant provisions reviewed

  Two sentences and no more. It is here for the distinction the page turns on, that technically measurable and permitted to measure are different questions, and specifically for the finding that an identifier carried in an address can fall inside a communications privacy provision through client-side caching alone. The estate's own identifier minting decision is open and this page takes no position in it.