PassportBox

GS1 Digital Link & QR codes for Digital Product Passports

ESPR requires every in-scope product to carry a QR code (ISO/IEC 18004) and a unique identifier (ISO/IEC 15459) that resolves to the product's Digital Product Passport. GS1 Digital Link is the industry-consensus implementation that satisfies both requirements in a single, web-native URL — though the regulation is technology-neutral and does not mandate GS1 specifically.

What ESPR actually requires

ESPR (EU 2024/1781, in force 18 July 2024) sets out data-carrier requirements in Article 10 and Annex III. Three things are mandatory for every in-scope product:

  1. QR codeMust conform to ISO/IEC 18004. This is the international QR code standard — it defines the symbol structure, error-correction levels, and encoding rules. A standard QR generated by any compliant library satisfies this.
  2. Unique identifierMust conform to ISO/IEC 15459, the international standard for unique identifiers for transport units and items. A GTIN issued by GS1 satisfies ISO/IEC 15459 and is the most common choice for retail products.
  3. Open & interoperableThe format must be machine-readable and not lock product data behind a proprietary system. The regulation is explicitly technology-neutral — NFC or RFID may supplement the QR, but the QR plus unique identifier is the floor.

GS1 Digital Link is not named in ESPR or in any adopted delegated act. It is the industry-consensus implementation that satisfies all three requirements simultaneously — but you are not legally required to use GS1 if another ISO/IEC 15459-conformant identifier and a standard QR meet the delegated act for your product category.

What GS1 Digital Link is

GS1 Digital Link (GS1 standard 2.0) turns a GS1 identifier — most commonly a GTIN (Global Trade Item Number) — into a structured web URL. That URL encodes the product identifier in a predictable path format that any resolver can parse:

https://id.gs1.org/01/09506000134352/10/ABC123

Structure: https://[resolver]/01/[GTIN-14]/10/[batch] — AI element identifiers (01 = GTIN, 10 = batch) follow GS1 Application Identifier syntax. The resolver turns this URL into a redirect to the hosted DPP or product page.

When that URL is encoded into a QR (ISO/IEC 18004), scanning it with a smartphone camera opens a browser to the resolver, which routes the request to the appropriate destination — a consumer product page, a DPP endpoint, or regulator-facing structured data — depending on who is asking and what link type they request.

This single-QR/multiple-destination behaviour is the main practical advantage of GS1 Digital Link for DPP compliance: you do not need separate QRs for marketing, DPP, and regulatory access. One code serves all audiences via resolver-level routing.

How it works on a physical product

The flow from product label to compliance check has four steps:

  1. 1Product is labelled. A QR code encoding the GS1 Digital Link URL (or another compliant identifier URL) is printed on the product, care label, hang tag, or packaging.
  2. 2QR is scanned. A consumer, customs official, or automated reader scans the QR. The camera or scanner reads the encoded URL.
  3. 3Resolver routes the request. The URL reaches a GS1 resolver (or the EU DPP registry pointer once it launches in July 2026), which determines the appropriate destination based on the link type requested.
  4. 4DPP is served. The scanner reaches the hosted Digital Product Passport — structured, machine-readable data at a stable URL. The registry does not hold this data; a compliant DPP host (such as PassportBox) does.

The EU DPP registry (due 19 July 2026) sits at step 3 as a pointer directory: it knows which product identifiers map to which DPP host URLs. The actual passport data lives at the host, not in the registry — think of it as DNS for product identity.

QR code best practices for DPP

A QR that cannot be scanned is a compliance failure. These are the practical rules for durable, scannable DPP data carriers:

  • Minimum size: 10 × 10 mm for static products; 20 × 20 mm or larger for products scanned at arm's length or in poor lighting. ISO/IEC 18004 quiet zones (white border) must be preserved.
  • Error-correction level H (30% data recovery) is recommended for products subject to wear, folding, or partial obscuring — especially textiles, outdoor goods, and industrial products.
  • Surface and contrast. Avoid curved surfaces, holographic foil, and surfaces with background patterns. The QR needs at least 4:1 contrast ratio between module and background to reliably decode.
  • Durability matching product lifetime. For textiles, use woven labels or heat-transfer prints that survive washing cycles. Printing on paper hang tags is insufficient for the product's full lifecycle — use a secondary durable marker if the hang tag will be removed.
  • One carrier per product. Use a single QR code that routes to all required link types via the resolver. Multiple competing QRs on the same product create consumer confusion and audit risk.
  • Test before production. Scan the artwork file with at least two different smartphone cameras before ordering label stock. Test at minimum and maximum scanning distances relevant to your retail context.

How PassportBox handles this for you

PassportBox manages the QR and DPP hosting layer so you can focus on the product data rather than the infrastructure:

  • QR code generation — PassportBox generates ISO/IEC 18004-conformant QR codes that encode the public passport URL for each product, ready to download and send to your label printer or artwork team.
  • Printable label templates — Generate print-ready label PDFs (including QR, product name, and SKU) sized for standard label stock, in batch across your entire catalogue.
  • Public passport pages — Each product gets a stable public URL (/p/[slug]) that serves structured passport data to consumers, scanners, and regulatory systems.
  • GS1 Digital Link URL format — Passports are served at URLs structured to be compatible with GS1 Digital Link resolver conventions, making it straightforward to register them with GS1 resolvers or the EU registry.
  • Shopify-native — Pull product data directly from your Shopify catalogue to populate passport drafts, so your QR codes and passport pages stay in sync with your store.

Frequently asked questions

Is GS1 Digital Link legally required for DPP compliance?
No. GS1 Digital Link is not named or mandated in any adopted delegated act. ESPR (EU 2024/1781) is technology-neutral — it requires a QR code conforming to ISO/IEC 18004 and a unique product identifier conforming to ISO/IEC 15459, but does not prescribe a single implementation. GS1 Digital Link is the industry-consensus way to satisfy both requirements simultaneously, and the standard most retailers and supply chains are converging on, but it is a best-practice choice rather than a legal obligation at this stage.
What QR and identifier standards does ESPR actually mandate?
ESPR Article 10 and Annex III require: (1) a QR code conforming to ISO/IEC 18004, (2) a unique product identifier conforming to ISO/IEC 15459, and (3) an open, interoperable, machine-readable format. The regulation is explicitly technology-neutral — NFC, RFID, or other carriers may supplement the QR, but the QR plus unique identifier combination is mandatory for in-scope products.
Do I need a GTIN to use GS1 Digital Link?
GS1 Digital Link is built around GS1 identifiers, of which the GTIN (Global Trade Item Number) is the most common for retail products. If you already have GTINs (usually assigned via a GS1 member organisation), GS1 Digital Link uses them directly. If you don't have GTINs yet, you can apply through GS1 UK, GS1 US, or your local GS1 member organisation. Alternatively, ESPR permits other ISO/IEC 15459-conformant identifiers — GS1 is not the only route, but it is the most widely supported.
What is the EU DPP registry, and does GS1 Digital Link connect to it?
The EU DPP registry (due 19 July 2026) is a pointer directory — it stores product identifiers and resolves them to the URL where the passport data lives. It does not host passport data itself. GS1 Digital Link URLs are designed to be resolver-based, meaning the QR encodes a URL that can be routed through the EU registry or a private resolver to reach the hosted DPP. The exact interoperability specification between GS1 Digital Link resolvers and the EU registry is still being finalised.
Can one QR code on a product carry multiple links (to a DPP, a product page, etc.)?
Yes — this is one of GS1 Digital Link's key advantages. A single GS1 Digital Link QR can resolve differently depending on who scans it: a consumer sees the product page; a regulator or automated system receives structured DPP data. This is handled at the resolver level via link types (conforming to IANA link relations), so you do not need multiple QR codes on the same product.
Where should the QR code be placed on a product or label?
Place the QR where it can be scanned without removing the product from packaging — typically the back or side panel, avoiding curved or reflective surfaces. Industry print guidelines suggest a minimum printed size around 10 × 10 mm (larger for durable goods). For textile products, which must survive washing, the QR should be on a care label made from durable material, or on a hang tag with a secondary durable reference. Test scannability from 20–30 cm with a standard smartphone camera before finalising artwork.

Not sure if your products are DPP-ready?

Upload a product CSV and get a free readiness report — no account required.

Run a free DPP readiness scan

New to Digital Product Passports? Read the complete DPP & ESPR guide or see what data fields a DPP must contain.

This is general information, not legal advice. Regulatory requirements and dates are evolving — verify against official EU sources. europa.eu