Asking for the camera
Ask when the user taps 'Scan', with a reason (Android Developers, n.d.); people often misunderstand permission prompts (Felt et al., 2012). Guide denied users to settings. The principles mirror notification permission requests.
Viewfinder and feedback
Show a frame and a torch button in low light. Codes must be large enough in frame (Google, n.d.); iOS highlights detected codes (Apple, n.d.). Confirm with haptic feedback. On the web, open the camera with getUserMedia (MDN, n.d.) and handle denial.
Safety and alternatives
Malicious QR codes can lead to phishing (Kieseberg et al., 2010), so show the domain first as error prevention. Offer manual code entry or image import, and announce results per WCAG 2.2 (W3C, 2023) 4.1.3.
FAQ
- When to ask for camera access?
- When the user first tries to scan, with a reason.
- Should scanning work without a camera?
- Yes, offer manual entry or image import.
Sources reviewed: 2026-10-27
References
- Google. (n.d.). Barcode scanning. ML Kit. Recognition conditions.
- Apple. (n.d.). DataScannerViewController. VisionKit documentation. iOS built-in scanner.
- MDN Web Docs. (n.d.). MediaDevices: getUserMedia() method. Web camera access.
- Android Developers. (n.d.). Request runtime permissions. Request in context.
- Felt, A. P., Ha, E., Egelman, S., Haney, A., Chin, E., & Wagner, D. (2012). Android permissions: User attention, comprehension, and behavior. In Proceedings of the Eighth Symposium on Usable Privacy and Security (pp. 1–14). ACM. Users misunderstand permissions.
- Kieseberg, P., Leithner, M., Mulazzani, M., Munroe, L., Schrittwieser, S., Sinha, M., & Weippl, E. (2010). QR code security. In Proceedings of the 8th International Conference on Advances in Mobile Computing and Multimedia (pp. 430–435). ACM. Malicious QR risks.
- World Wide Web Consortium. (2023). Web Content Accessibility Guidelines (WCAG) 2.2. Criteria 1.1.1 and 4.1.3.
