ReviewHeroQR Codes for Review Requests: What Works, What Backfires
Google endorses QR codes for review requests — where they help, where the flow behind one becomes banned gating, and the physical risk to plan for.
The short version
- Google's own help pages recommend QR codes for review requests by name — the code itself isn't the risk, what happens after the scan is.
- A table tent that routes happy customers to the public review link and unhappy ones somewhere else is review gating, and Google's policy bans that outright regardless of which channel triggers it.
- A QR code printed on a public, unattended surface can be covered with a fraudulent sticker that redirects the scan; the fix is checking your printed materials periodically, not avoiding QR codes.
A customer finishes a haircut, a repair, a meal. The owner has ten seconds of their attention and a printed card that says "scan to leave us a review." It feels almost too simple to be a real question, but it is one worth asking properly: is a QR code on a receipt or a table tent actually an acceptable way to collect Google reviews, or is it the kind of shortcut that gets a profile flagged.
The short answer is that the code is fine. Google says so in its own words. What gets businesses in trouble is not the piece of printed plastic or paper — it's the decision tree behind it, and, less obviously, who else can walk up and put a different code where yours used to be.
This is general information, not legal advice. Platform policies change; check the current wording on Google's own pages before relying on this article.
What Google actually says about QR codes
There's no ambiguity to untangle here, which is unusual for this beat. Google's own review-management guidance states plainly that businesses can share a review request link or QR code with customers, and its tips page for getting more reviews repeats it: "To leave reviews, you can ask customers to visit a Google link or scan a QR code." Google even ships a dedicated tool for it — inside a Business Profile, under Reviews, there's a built-in option to generate a review link or QR code sized for printing on receipts, thank-you emails, or an in-store sign.
None of these four pages carry a visible "last updated" date, which is normal for Google's support library and worth knowing if you ever see someone cite a change date for one — there isn't one to cite.
So the format is explicitly sanctioned. The rules that already govern every other review-request channel still apply in full: no incentives, no pressuring anyone while they're standing in front of you, and no scripting what the review has to say. A QR code doesn't exempt you from any of that. It's a delivery mechanism, not a loophole.
Where a QR code turns into review gating
Here's the failure mode that actually gets businesses penalized, and it has nothing to do with the code itself. It's the two-path table tent: "How was your visit? 😊 scan here / 😞 scan here" — where the happy path goes to the public Google review link and the unhappy path goes to a private feedback form that never reaches Google.
That's review gating, and it's banned under Google's prohibited and restricted content policy in language that doesn't leave room for interpretation: businesses may not "discourage or prohibit negative reviews, or selectively solicit positive reviews from customers." The policy is written around the behavior, not the channel that carries it — an email that gates and a QR code that gates are the same violation to Google.
The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465, effective 21 October 2024) doesn't mention QR codes, kiosks, or in-store stations anywhere in its text — I checked, and the rule is written entirely around online reviews and review platforms. But that's not a gap you can drive through. Section 465.7's review-suppression provisions and the Commission's own framing of "generalized solicitations" in §465.2(d)(1) describe the underlying conduct — filtering who gets asked, or who gets shown the public link, based on expected sentiment — and that conduct is what matters, not the hardware that triggered it. Google's rule reaches the same practice with no nuance at all: a QR-based happy/unhappy fork is banned the moment it exists, whatever it's printed on.
If you're already running a physical two-question flow before the scan — a common setup sold as "reputation protection" — that's the thing to remove first, before worrying about anything else in this article.
The physical risk nobody plans for
There's a second problem specific to QR codes that an emailed link doesn't have: someone else can tamper with the physical copy. The FBI's Internet Crime Complaint Center has warned since January 2022 that "cybercriminals are tampering with QR codes to redirect victims to malicious sites," including placing "a sticker placed on top of the original code." The FTC issued a matching consumer alert in December 2023 describing the same tactic on parking meters, and the FBI put out a follow-up advisory in July 2025 on a related QR-code fraud scheme. This isn't hypothetical: the City of Ottawa found and removed dozens of fraudulent stickers covering the QR codes on its own pay-and-display parking machines, reported by CBC News — a Canadian municipal case, not a US small-business one, but the mechanism transfers directly to a laminated card taped to a counter or window.
A review-request QR code is a lower-value target than a payment QR code, so this isn't a reason to avoid the format. It's a reason to treat any code posted in an unattended, publicly accessible spot the way you'd treat a cash box left on the counter: check it periodically, and if a sticker looks like it's been added rather than printed as part of the card, peel it and look underneath before trusting it. Codes printed directly on a receipt or emailed to the customer don't have this exposure at all, since nobody but you controls that surface.
What the QR-code usage numbers actually show — and where the data runs out
QR code use is genuinely common now. A TEAM LEWIS survey of 1,000 US adults, fielded in early 2024 and published that September, found 68% had scanned a QR code in the past year, rising to 83% among Gen Z respondents. Scanning one from a default phone camera is no longer a technical hurdle for most people — Apple documents native QR scanning directly in the iPhone Camera app, and Google's Camera app documentation confirms the same capability, though it notes availability varies by device rather than claiming it's universal across every Android phone.
Where the data runs out: there is no named, sample-sized study comparing completion rates between a QR-code review request and an emailed link specifically. BrightLocal's 2026 Local Consumer Review Survey — 1,002 US consumers, fielded on a SurveyMonkey panel — found 78% of respondents had been asked for feedback in the past 12 months, and 83% of those asked went on to leave a review. That's a strong result for the ask itself, across whatever channels were involved. Neither that survey nor anything else we could find breaks the result down by delivery channel. If you see a stat claiming QR codes convert at some specific rate better or worse than email, ask for the source — as of this writing, it doesn't appear to exist.
| Placement | Outcome | Why |
|---|---|---|
| Printed on the receipt, same link every customer gets | Works | One destination, no filtering, matches Google's own recommended use |
| Table tent with separate smiley/frown codes | Backfires — policy | Routes by expected sentiment before the review is posted; this is gating under Google's rule regardless of the printed medium |
| Laminated card taped to an unattended door or window | Backfires — security | A public, unmonitored surface a fraudulent sticker can be placed over per FBI/FTC guidance |
| Printed in a thank-you email alongside the same text link | Works | Identical destination as the primary channel, just a second way to reach it |
Where QR codes fit next to email
For a business already sending review requests by email, a QR code isn't a replacement channel — it's a second door to the same room. The link behind the code should be the exact same public Google review URL the email points to, with no separate form and no filter in front of it. Put it somewhere the customer is already looking at the moment they'd naturally think to leave feedback: the receipt, not a random spot on the wall by the register where it can sit unattended for months.
This is the same design constraint that governs the email side: every recipient sees the same public link, with no fork based on how they answered a prior question. ReviewHero's email requests work this way for exactly that reason — one link, sent to everyone in a batch, with no sentiment gate in front of it. A QR code that follows the same rule is just another way to hand someone the identical link; one that doesn't is the same violation Google would flag in an email, just printed instead of sent.
What to do next
- Check any QR code you're already using for reviews — does it lead straight to the public Google link, or is there a question in front of it that decides where you go? If there's a question, that's gating; remove the fork.
- Generate your code directly from your Business Profile's own review-link tool rather than a third-party shortener, so you control the destination and can regenerate it if something looks wrong.
- Put the code somewhere it's handed to the customer directly — a printed receipt or an in-hand card — rather than posted on an unattended public surface.
- If you do post one somewhere public, glance at it every so often for a sticker that looks added rather than printed, and scan it yourself occasionally to confirm it still goes where you expect.
- Treat the code as a second delivery path for the same request you're already sending by email, not a separate campaign with its own rules.
Put this on autopilot
ReviewHero asks every customer once, follows up politely, and stops the moment they open the review link. Free to download, and you can set it up from your phone.
