A badge scan tells an exhibitor who stopped at the stand. It does not tell them they may email that person. Under UK GDPR and PECR, the scan shares a record, the exhibitor needs its own lawful basis for follow-up, and some emails need consent. Organisers should say plainly what a scan shares.
What Does a Badge Scan Actually Share?
It shares whatever the organiser and the lead retrieval tool have agreed it shares, and that varies by tool. At a trade show the rep points a phone at the QR code on each attendee's badge or in their event app, and a record lands in that exhibitor's lead list: a name, an email address, perhaps a company, perhaps more.
The scan itself is rarely the legal problem. Booth Maven makes the same point: what matters is what happens next, meaning follow-up email, storage and onward sharing. A scan is a handshake with a barcode. Nobody has signed anything at the stand.
That is why "they let me scan them" is a weak legal sentence. Letting someone scan a badge is a social act, usually done in a hurry, with a queue behind it. It tells the exhibitor the attendee was happy to be scanned. It does not tell anyone what the attendee expects to happen to their details on Monday morning.
Who Is the Controller of a Scanned Lead?
Once the lead is in the exhibitor's list, the exhibitor decides what to do with it, so the exhibitor is the controller of that lead. Vendelux (published 28 September 2026, updated 16 October) says exactly that, and adds that the app storing the leads is a processor under a contract. The Eventscribe lead capture privacy FAQ from Cadmium (last modified 18 February 2026) draws the same line: the organiser controls registration data, and the exhibitor controls the lead data it collects once it is delivered.
The organiser still has a job. The organiser collected the attendee's details in the first place, so the organiser's privacy notice has to say that exhibitors can receive them through scanning, what they receive, and what the attendee can do about it. A conference with exhibitors who scan, and a privacy notice that never mentions exhibitors, has a gap in the notice, not just in the paperwork.
Can an Exhibitor Email Someone They Scanned?
Sometimes without consent, sometimes not (and this is general information, not legal advice). Two separate rules apply. UK GDPR asks for a lawful basis to hold and use the person's data. PECR, the Privacy and Electronic Communications Regulations, governs the email itself.
On PECR, the ICO's business-to-business marketing guidance separates corporate subscribers (companies, LLPs, Scottish partnerships) from individual subscribers (sole traders and some partnerships). For corporate subscribers the consent requirement for marketing email does not apply, though you must identify yourself and offer an opt-out. For individual subscribers you need consent, unless the soft opt-in applies. If you cannot tell which kind of subscriber you are dealing with, the ICO says to treat them as an individual.
The soft opt-in needs all of these: the details were obtained during a sale or the negotiation of a sale, you are marketing your own similar products, the person had a clear chance to refuse when you took their details, and every message carries an opt-out. Whether a chat at a stand counts as negotiating a sale is a question for each exhibitor's adviser. A conversation about the weather does not qualify.
On UK GDPR, many B2B teams rely on legitimate interests. The ICO's legitimate interests guidance sets a three-part test: a real purpose, necessity, and a balance against the person's rights. It also says legitimate interests can cover direct marketing only where PECR does not require consent, and that the right to object to direct marketing is absolute. Record the assessment before the first email, not after the first complaint. Germany adds its own stricter unfair competition rules for direct marketing, which Booth Maven flags and which an exhibitor selling into Germany should check.
A scan proves the conversation happened. It does not prove the permission, so write the permission down somewhere other than the barcode.
How Do Lead Retrieval Tools Treat the Scan?
They differ, and the differences are worth reading before you pick one for a show. The table compares what each tool says on its own pages as at 29 October 2026.
Register the Visitors. Badge the Exhibitors.
Free visitor registration, paid delegate passes and private exhibitor staff passes on one event, badges designed from the answers, and lead retrieval on exhibitors' own phones.
| Tool | What a Scan Shares | How Consent and Preferences Are Handled | Where the Leads Go |
|---|---|---|---|
| eventcloud lead retrieval | First name, last name and email, plus more only if the organiser chooses to share more | Attendees agree Terms at registration. A scan is not treated as consent. Who Scanned Me shows attendees which companies scanned them and what was shared | Each rep downloads their own leads to Excel. The organiser sees totals only. Erasing an attendee on request also deletes the leads reps captured by scanning them |
| Cadmium Eventscribe Lead Capture (FAQ, February 2026) | Registration profile fields the organiser chooses, to the scanning exhibitor only | Letting an exhibitor scan a badge is treated as the attendee's opt-in to share with that exhibitor | Exhibitor controls the lead data once delivered |
| Cvent LeadCapture (product page, checked 29 October 2026) | Contact details, notes and lead ratings | Not stated on the product page | Exportable on demand to any database, in the page's own words |
| Vendelux Lead Scanner (own page, September 2026) | Not stated | Reps can record a consent or preference at the booth with a note, voice note or tag (self-reported) | CSV export at any time and HubSpot sync (self-reported) |
The Cadmium row is the one to notice. A tool that treats the scan as the attendee's opt-in has answered the question this article is asking, and answered it the opposite way. That may be defensible for sharing a profile with one exhibitor. It is not a basis for a newsletter subscription, and no organiser should let an exhibitor believe it is.
What eventcloud Shows Attendees and Exhibitors
Lead retrieval comes with every seat: exhibitors scan attendees with their own phones, rate and qualify each lead, and export their leads to Excel. No charge from us per scanner or per lead. You decide whether exhibitors get it with their pass or buy it at checkout for a price you set.
The consent side is built to keep the scan honest. Every order records the Terms agreement. Exhibitor reps scan the QR code on each attendee's badge or in their event app, and before they start they agree the organiser's scanner rules (up to ten lines you write) and give the name and company that the people they scan will see. Attendees can open Who Scanned Me in the event app or the attendee portal to see which companies scanned them. You can read more on the trade shows and exhibitions page.
Two data points matter for a privacy notice. Production data is hosted in one United States region, so say so in your transfer paperwork. And when an attendee asks to be erased, the erasure also removes the leads reps captured by scanning them, which is the part most organisers forget to ask about. Coming soon: EU or UK data hosting and a DPA. Need it for your event? Tell us.
What to Put in the Registration Form and on the Stand
Four small things carry most of the weight, and none of them is a legal essay.
A sentence in the registration privacy notice: exhibitors may receive your name and email if you let them scan you, and here is who they are. Link the notice from the form, where the registration form already asks people to agree Terms.
A line on the badge holder or the signage: "Your badge can be scanned by exhibitors. You can say no."
A scanner rule for exhibitors: no scanning without asking, honour a refusal at once, and no passing leads to third parties.
A first-email rule: identify yourself, link your privacy notice, offer an opt-out in every message.
The stand script is the fourth item's twin. Something like: "Happy to scan you so I can send the brochure we talked about. I'll email you once, and you can tell me to stop." It takes six seconds, it is true, and it gives the exhibitor something a barcode never will: a record of what the person agreed to. The guide to GDPR and attendee data covers how long to keep what you collect.
Before your next show, read your own registration privacy notice as an attendee would and check that it mentions exhibitors. If it does not, that is the first edit to make.
