A digital product passport (DPP) is reached through a data carrier on the product, its packaging or an accompanying document. Under the ESPR, this carrier can be a linear barcode, a two-dimensional code or another automatic identification technology that can be read by a device. Which carrier is used for which product group will be set by that group's act. Where information for consumers is concerned, the leading option is the QR code, which a phone camera can open directly.
What does the regulation require of the carrier?
Article 10 of the ESPR, Regulation (EU) 2024/1781, sets these requirements for the carrier:
- It must be linked to a persistent identifier. The carrier leads to the product's unique identifier and, through it, to the passport.
- It must be physically present. On the product itself, its packaging or the accompanying document.
- It must comply with standards. The carrier and identifier must comply with the ISO/IEC 15459 series or with harmonised standards.
- It must be based on open standards. It must be interoperable and machine-readable and must not create dependence on a single provider.
The harmonised standard for carriers is EN 18220:2026. Together with EN 18219:2026 for unique identifiers, it was published in the Official Journal of the EU on 15 July 2026 by Implementing Decision (EU) 2026/1736. The operator must also provide dealers and online marketplaces, on request, with a digital copy of the carrier or the identifier within five working days, free of charge.
How do the QR code, DataMatrix and RFID compare?
| Carrier | Reading with a phone | Strength | Point to watch |
|---|---|---|---|
| QR code, with GS1 Digital Link | The camera opens it directly | Consumer, checkout and warehouse read the same code | The code area is larger than a DataMatrix |
| Data Matrix, with GS1 Digital Link | Most phones need an additional app | Takes up less space on small and cylindrical surfaces | Can be a reading barrier for consumer information |
| GS1 DataMatrix (element string) | Carries no web address | Established in pharmaceuticals and healthcare, common in direct part marking | Needs separate resolution to link to the passport |
| RFID (RAIN, EPC) | Usually not read by a consumer's phone | Bulk reading without line of sight | Must carry the same serial number as the barcode |
| NFC | Read by a phone | Can be hidden inside the label | A complementary carrier in GS1 as of 2026 |
GS1 in Europe's DPP document notes that the ESPR explicitly mentions the QR code and that the QR code is very likely to be among the approved carriers. Using the GS1 Digital Link format for the QR code means the same code can also be read at the checkout. We explain this structure in the GS1 Digital Link article.
What should you watch for if you use RFID?
RFID is usually used not on its own but as a carrier that complements the barcode. The GS1 General Specifications require that, when RFID complements a GTIN barcode, the tag uses an SGTIN (GTIN with serial number) and the serial number is the same as the (21) value in the barcode. The July 2025 joint statement by GS1 and RAIN Alliance recommends starting RFID use in the passport with textiles, tyres and furniture. Because consumers cannot read it with their phones, RFID should not be chosen as the only route to consumer information.
Where on the product should the code go?
The regulation lists three places; the choice depends on the product:
- The product itself: The most robust place if the passport is to stay accessible throughout the product's life. The code must withstand conditions of use such as washing, wear or heat.
- Packaging: When the packaging is thrown away, the carrier goes with it. May be suitable for short-lived products sold in their packaging.
- Accompanying document: Such as a user manual or warranty certificate. If the document does not stay with the product, access is lost.
Whatever place the product act requires applies. For example, the battery regulation requires the code to be printed on the battery, or on the packaging and documents where this is not possible.
At what level will the code be printed?
A passport can be created at model, batch or item level; the level is set by the product group's act. This choice directly changes the work on the line:
- Model level: The same code on every pack of the same model. It can be added to the packaging print.
- Batch level: A code that changes with each batch. The print or label is updated on the line at each batch change.
- Item level: A different code on each unit. The line needs variable data printing or pre-printed serial labels, and every unit must be scanned and linked to the record.
Under the implementing regulation, an item-level passport is linked to the identifiers of the batch and the model. We look at the difference between batch and serial numbers in the serial number verification article.
What mistakes are made most often in the field?
- Mistaking a campaign QR code for a passport carrier: a code with no product identity in its address does not lead to the passport.
- Printing two separate codes on the packaging and writing a different GTIN in each.
- Placing the code on a fold line, a curved surface or under transparent film.
- Printing serial labels and shipping without matching them to the unit on the line.
- Not redirecting the addresses opened by old codes when the domain changes.
Does the carrier prove that the product is genuine?
No. A QR code, DataMatrix or RFID tag can be copied, and the copied code leads to the same passport. Article 11 of the ESPR requires passport data to be accurate and intact, not that the code on the product belongs to the genuine product. To tell that a code has been copied, you need to look at the history of its scans. We cover this distinction in the article on verification without an app.
Where does Tagvex fit in this preparation?
Tagvex numbers products at batch or unit level with copy-resistant codes, fits the code into the existing label layout and records every change of hands from the line exit to the dealer. When a copied code is scanned, the repeated scan shows up in the record. Records can be passed to ERP and warehouse systems through an API. The passport itself, DPP Registry registration and GS1 numbers, however, are set by the operator placing the product on the market and by your company prefix; the Tagvex record does not replace them. We summarise the steps for collecting the data that goes into the passport in the passport readiness article.
Sources
- EUR-Lex, Regulation (EU) 2024/1781 (ESPR)
- EUR-Lex, Commission Implementing Decision (EU) 2026/1736
- EUR-Lex, Commission Implementing Regulation (EU) 2026/1778
- GS1 in Europe, GS1 Standards enabling the EU digital product passport, Release 2.2
- GS1 and RAIN Alliance, joint position statement on the DPP, 2025
- GS1 General Specifications, Release 26.0, 2026
