QR and Second-Screen Attribution for CTV, Built In-House

What a QR is worth: One to three scans per thousand impressions, in DACH, when the code holds the screen for at least six seconds and takes up around a tenth of the frame height. On a two million impression flight that is two to six thousand scans. Useful, and nowhere near enough to attribute a campaign with. The honest framing is that the QR is a signal with a known floor, and the actual measurement of a spot's effect on your site comes from what happens to baseline traffic in the minutes after it airs. This engagement builds both, and keeps them separate so neither borrows the other's credibility. The build: A dedicated host on your own domain, something short like tv.yourbrand.de, served through your CDN and issuing a 302 to the landing page with parameters attached. One code per creative, per streamer, per daypart, generated by a redirect service that lives in your infrastructure rather than a QR SaaS that rate-limits you mid-flight and holds your scan data hostage at renewal. A server-side Tag Manager container on your domain, GA4 via Measurement Protocol, and the raw redirect log written to your warehouse where nothing else can filter it before you see it. Matching sessions to airings: This is the part that produces a real number. We model expected baseline sessions per minute from at least eight weeks of history, accounting for weekday, hour and campaign activity elsewhere, then measure excess sessions in the three to five minutes following each verified airing. Airing timestamps come from log-level delivery data, matched at minute granularity. The output is excess sessions per thousand impressions with an interval on it, by creative and by daypart, which is what lets you tell a fifteen from a thirty on evidence. Consent, and the correction it forces: Under TTDSG section 25 and GDPR, the redirect itself is user-initiated and needs nothing, but analytics storage after landing does. German consent rates run somewhere between 60 and 75 percent depending on the banner, which means your scan-to-session count understates reality by roughly a third before anyone has made a mistake. We measure your actual consent rate and apply the correction explicitly in reporting, with the uncorrected number shown next to it. Nobody should be quietly grossing up a figure without saying so on the same page. We will not: Install a third-party attribution vendor that claims deterministic household matching in Germany, because the identity graph to support that claim does not exist here and the output is a modelled number wearing a deterministic label. Put a QR in a fifteen-second creative. Build a dashboard whose figures cannot be reproduced from your own warehouse export by someone who has never met us. Or treat scan volume as a campaign KPI, which turns creative into a code-placement exercise within two flights. Poor fit: If your site gets under about 500 sessions an hour in the evening, the baseline is too noisy for airing-level excess to surface and the method collapses into anecdote. If your landing experience is inside an app with no web fallback, the scan path breaks for a meaningful share of scanners. And if the campaign is already live next week, this is not a build you want rushed. What you end up owning: The redirect service and its source. The server container configuration. The baseline model and its scheduled query. A runbook covering code generation for the next flight, written for whoever inherits it.