Under the ESPR (Regulation (EU) 2024/1781, Article 9), every product covered by a digital product passport must carry a data carrier, in practice a QR code, that links to its passport. GS1 Digital Link is the URL syntax that carrier is converging on: the product's GTIN embedded in a standard web address, so one printed code serves shoppers, retail tills, customs and recyclers alike.
This page reflects the rules as of 10 July 2026. Regulatory dates are dated and may change, confirm against the current instruments or with qualified advisers.
A data carrier is the machine-readable mark, a QR code, Data Matrix or similar, physically on the product, its packaging or its accompanying documentation, that connects the physical item to its digital product passport. This is not optional decoration: Article 9 of the ESPR (Regulation (EU) 2024/1781) requires the passport to be accessible through a data carrier, connected to a unique product identifier, with the data in machine-readable format.
The regulation's preference is for the carrier to sit on the product itself where possible, so the link survives after the box is thrown away. A passport that becomes unreachable the day the packaging goes in the bin fails at exactly the moment a repairer or recycler needs it, years later.
Which carrier types are acceptable, how durable they must be, and how they are marked is now covered by a European standard, EN 18220:2026, published in May 2026, which admits 2D symbols (QR Code, Data Matrix) and RFID, and sets rules on print quality, error correction, placement and durability. Each product group's delegated act will pin down the specifics for that category, but the direction is set.
GS1 Digital Link is a GS1 standard that turns a product identifier into an ordinary web address. Instead of a QR code pointing at an arbitrary marketing URL, the code encodes a structured URI in which the GTIN sits in a fixed position in the path:
https://id.example.com/01/09506000134352
The /01/ is the GS1 Application Identifier for GTIN; the number after it is the product's GTIN. Batch and serial numbers extend the same path (/10/{batch}, /21/{serial}), which matters because DPP granularity can be model, batch or item level depending on the product group's delegated act.
The consequence of that structure: the URL is simultaneously a link and an identifier. A shopper's phone opens it like any web page. A retail scanner parses the GTIN straight out of the path without visiting the page at all. A customs system, a marketplace or a recycler's software does the same. One printed code, read four different ways, instead of a linear barcode for the till plus a second QR for everything else.
The domain can be your own. GS1 Digital Link does not force traffic through gs1.org; the syntax works on any domain you control, which is what lets the destination, the passport page itself, evolve while the printed code stays valid.
Three forces point the same way. First, the ESPR requires unique identifiers and data carriers to follow internationally recognised standards; Article 9 and the regulation's recitals reference ISO/IEC 15459-compliant identification, and GS1's identifier system is the dominant implementation of it in trade.
Second, the new European DPP standards bake the approach in. EN 18219:2026 (unique identifiers) and EN 18220:2026 (data carriers), published by CEN and CENELEC on 27 May 2026 under joint committee CEN-CLC/JTC 24, define globally unique, persistent, web-resolvable identification at model, batch or item level, the architecture GS1 Digital Link already implements. GS1 identifiers are one recognised scheme under these standards rather than the only one, but they are by far the most widely deployed.
Third, retail is migrating anyway. GS1's Sunrise 2027 initiative aims for 2D barcodes to be scannable at retail points of sale worldwide by the end of 2027, with GS1 Digital Link QR codes as a headline format. A manufacturer choosing a QR structure for its DPP in 2026 and a QR structure for retail checkout in 2027 should not choose twice.
One honest caveat: the Commission has not, as of July 2026, adopted the delegated act that fixes the final identifier and carrier rules for the DPP system; that act is expected late 2026, and the EU DPP Registry that will store unique identifiers is required by the ESPR to be set up by 19 July 2026 (Article 13), with practical details still settling. GS1 Digital Link is the strong default, not yet the legally mandated answer. Structuring your codes this way is the low-regret position either way, because it satisfies the published EN standards' requirements today.
The GTIN (Global Trade Item Number) is the 8-to-14-digit number behind every retail barcode, issued through a GS1 licence. For a DPP it identifies the product model. Where a delegated act requires batch-level passports, the GTIN is paired with a batch number (/10/). Item-level passports, as the battery passport under Regulation (EU) 2023/1542 requires from 18 February 2027, pair it with a serial number (/21/).
The ESPR also introduces unique operator identifiers and facility identifiers alongside the product identifier, so a passport can state who made the product and where. EN 18219:2026 covers the rules for all three: global uniqueness, persistence over the product's life, and interoperability.
The practical point for a manufacturer: if you do not yet hold GS1 GTINs for your products, that is the first dependency in your DPP timeline; everything downstream hangs off it. If you already sell through retail, you almost certainly have GTINs, and the DPP work is then about putting them into resolvable URLs, not obtaining new numbers.
Most of a DPP programme is revisable. Passport data can be corrected, pages redesigned, hosting moved. The one thing you cannot revise is ink on a shipped product. A QR code printed on ten thousand labels, moulded into a casing or woven into a care label is fixed for the life of those items.
That makes the URL structure inside the code the single decision to get right before printing. A code that encodes an unstructured short-link, example.com/p/x7k2, will open a web page, but no till, customs system or recycler's scanner can extract a GTIN from it, and nothing in it maps to the identifier structure in EN 18219. Retro-fitting means reprinting labels, re-marking products, and running two carrier generations in the field for years.
A GS1 Digital Link URL on a domain you control inverts this. The printed artefact, yourdomain.com/01/{GTIN}, is stable and standard-conformant; everything behind it stays movable. The resolver can redirect scans to a new passport host, serve different views to different audiences, or add destinations as delegated acts land, all without touching the physical product. The carrier is permanent; the destination never has to be.
This is why "we'll sort the URL scheme out after launch" is the one plan that does not work. Sort it out first; then print.
Get GTINs. License them through your national GS1 member organisation if you do not have them. Assign one per product model, and decide how batch and serial numbering will work for categories where finer granularity is coming.
Adopt GS1 Digital Link URLs for every product QR you print from now on, /01/{GTIN} on a domain you control, extended with /10/{batch} or /21/{serial} where you need it. Even for product groups whose delegated act is years away, a marketing QR in this format costs nothing extra and never needs re-printing when the passport obligation arrives.
Check new artwork against EN 18220, symbol type, error correction, size, print quality and placement, so labels designed in 2026 do not need a second pass when a delegated act points at the standard.
Keep the resolver flexible. The point of the architecture is that the printed code outlives any single web page. Passfolia issues GS1 Digital Link URLs and QR codes for every passport from day one, so the code on your product resolves to a passport page you can keep current as the rules move, including the identifier and registry details still being finalised in the delegated acts expected late 2026.
/01/{GTIN}), so one QR code serves consumers, retail POS, customs and recyclers , GS1 Digital Link standardAs of July 2026, no law names GS1 Digital Link as mandatory; the ESPR requires standards-based identifiers and carriers, and the delegated act pinning down specifics is expected late 2026. But the published European standards (EN 18219/18220) require globally unique, persistent, resolvable identification, which GS1 Digital Link implements and an arbitrary short-link does not. It is the strong default, and the low-regret choice for anything you print now.
Yes. GS1 Digital Link is a URL syntax, not a hosting requirement; yourdomain.com/01/{GTIN} is fully conformant. You control the domain and can redirect the resolver to wherever the passport lives, which is exactly what keeps a printed code useful for the product's whole life.
Your existing GTINs are the right foundation; you don't need new numbers. But a linear EAN barcode is not a DPP data carrier: it encodes only the number, not a link to the passport. The move is to a 2D code carrying a GS1 Digital Link URL built on those same GTINs; GS1's Sunrise 2027 initiative means retail tills are heading the same way.
The risk is much smaller with a structured code than an unstructured one. A GS1 Digital Link URL on your own domain lets you change everything behind the code, the passport page, the host, the data, without reprinting. What you cannot change is the printed structure itself, which is why aligning to EN 18219/18220 and GS1 Digital Link before printing is the point: those are the standards the delegated acts are expected to reference.
The ESPR (Article 9) allows the carrier on the product, its packaging or accompanying documentation, but favours the product itself where possible, so the passport stays reachable after the packaging is discarded. Each product group's delegated act will set the rule for that category; for durable goods, expect pressure toward on-product marking.
The ESPR's "unique product identifier" is the legal concept: a standards-based identifier at model, batch or item level. The GTIN is the most common real-world implementation of it, optionally extended with a batch (/10/) or serial (/21/) component where the delegated act requires finer granularity. EN 18219:2026 defines the rules such identifiers must meet.
Publish a passport today, free for your first three products, full schema, real QR codes.
Start free