QR and Second-Screen Attribution, Built and Validated

What a QR code on a television actually does: Scan rates on CTV land between roughly 0.1 and 0.4 percent of impressions when the code holds the screen for five seconds or more and the viewer is given a reason to reach for their phone. They fall to effectively nothing when the code is parked in the corner of a two second end card. That makes a QR a response channel worth building properly and a poor foundation to hang attribution on. This engagement builds the two halves separately: the scan path, so the people who do scan convert, and the measurement, so the work is still legible when nobody scans at all. The scan path: A distinct short domain per placement, not one shared link with parameters the scan may not carry. Codes sized to occupy roughly a tenth of screen height, because a code that scans on a desk is unreadable from eight feet across a living room. Error correction level and quiet zone set for streaming compression, which chews fine modules. A 301 through a server-side Google Tag Manager container on a subdomain you own, so the first-party cookie survives Safari's restrictions instead of being clipped on arrival. A separate vanity path per creative and per network, so source is readable from the request line alone. The measurement half: Exposure logs from Innovid or your ad server joined to site and app events. IP-level household matching, which resolves on perhaps 60 to 75 percent of residential households and close to none behind carrier-grade NAT, stated as a range in the reporting rather than quietly rounded to a number. App installs through Kochava, Branch or AppsFlyer with the SKAdNetwork and AdAttributionKit constraints written into the spec, not discovered in month two. Clean room joins in Snowflake or Ads Data Hub when your volumes justify the overhead, and a clear recommendation against them when they do not. Quality assurance most builds skip: Every code is scanned on an actual television at viewing distance, across three handset cameras and two operating system versions, on a bright scene and a dark one. If it fails once, it is redrawn. This takes an afternoon and prevents the most expensive failure in the category, which is a flight that ran clean and could never have been scanned. What I refuse: No QR on a fifteen second spot with a two second end card. Scans are not conversions and will not appear in a conversion column. ACR-derived exposure from VIZIO Inscape or Samsung is a licensed panel and gets described as a panel, never as deterministic household truth. And I do not build against a measurement partner contract you have not read, because the identity claims in the sales deck and the ones in the master service agreement are rarely the same claims. Not included: Creative design and production. Measurement partner selection or contract negotiation, though I will review a contract you are about to sign. Incrementality testing, which is separate work. Consent management platform implementation, though the container is built to respect the one you already run. Ongoing reporting, unless you take the retainer. Who this is not for: Teams without engineering access to DNS records and tag deployment, since the build stalls on the first ticket. Brands that want a QR because a competitor has one, which is a creative decision wearing measurement clothes. Anyone expecting scan volume to carry a business case on its own. What arrives: A measurement specification your engineers can implement without me, the container configuration and event schema, creative-side code standards with the sizing math, the device test log, and a validation window where the numbers are checked against your own analytics before anyone reports them upward.