DPP QR Code — How Digital Product Passport QR Codes Work

How the Digital Product Passport QR Code Works

The digital product passport QR code is not just a link to a product page. It encodes a structured URL using the GS1 Digital Link standard, which resolves to a backend registry that serves different data layers to different scanning actors — a consumer sees carbon footprint and recycled content; a recycler accesses disassembly instructions; a regulator views the full conformity record. Same physical code, permission-controlled data. Understanding this architecture matters because a QR code that links to a static website is explicitly not a compliant digital product passport, regardless of how much sustainability information that page contains.

This guide explains the technical structure of the DPP QR code, how it connects to the registry, what the GS1 Digital Link encoding looks like, where the code must appear on products, and what the scanning experience looks like for different users. For the broader DPP framework within which the QR code operates, start with the digital product passport overview.

The QR Code Is Not the DPP — Understanding the Distinction

This is the most important conceptual clarification in the entire DPP technical domain. The QR code is the data carrier — the physical access point. The digital product passport is the complete system: unique identifier, structured data record, access permission framework, backend registry, version history, and APIs. The QR code is the door handle; the DPP is the building behind the door.

ESPR (EU Regulation 2024/1781) specifies that the data carrier must be affixed to the product, its packaging, or accompanying documentation. It specifies that the data carrier must encode the unique product identifier in a format that allows machine-readable access. It specifies that the data carrier must be durable enough to remain functional throughout the product's useful life. What it does not say is that the QR code itself constitutes compliance — the QR code only satisfies the data carrier requirement. The registry, the data, the access controls, and the identifier system must all exist and meet the regulation's standards for the DPP to be compliant.

In practice, this means that a company which prints a QR code on its product packaging linking to a company website describing their environmental commitments has complied with approximately 5% of their digital product passport obligation. The other 95% is the data infrastructure behind the code.

GS1 Digital Link: The Encoding Standard for DPP QR Codes

The GS1 Digital Link standard is the recommended encoding approach under ESPR and the explicitly referenced standard in the EU Battery Regulation's implementing acts on data carrier requirements. Understanding what GS1 Digital Link does — and why it is the preferred approach rather than a simple URL QR code — is essential for any manufacturer building DPP infrastructure. The GS1 Digital Link technical guide provides a complete implementation reference; this section summarises the DPP-relevant aspects.

What GS1 Digital Link Encodes

A GS1 Digital Link URL encodes product identification data from the GS1 system — Global Trade Item Numbers (GTINs), batch/lot numbers, serial numbers, and other GS1 Application Identifiers — directly into a structured URL. A typical GS1 Digital Link URL for a serialised product looks like this:

https://id.example.com/01/09521234543213/21/A1B2C3D4

Breaking this down: https://id.example.com is the brand's or platform's resolver domain; /01/ signals the GTIN Application Identifier; 09521234543213 is the 14-digit GTIN for this product model; /21/ signals the serial number Application Identifier; A1B2C3D4 is the unique serial number for this specific unit.

When this URL is scanned, the resolver at id.example.com uses the product identity data to locate the correct DPP record in the backend registry. The resolver then checks the scanner's credentials — or the absence of credentials, for anonymous consumer scans — and returns the appropriate data layer.

Why GS1 Digital Link Rather Than a Plain URL QR Code

A plain URL QR code — one that simply encodes a fixed web address like https://example.com/products/jacket-blue — has three structural problems for DPP use.

First, it provides no machine-readable product identity. The URL is meaningful to a human reading it, but an automated scanning system cannot extract the GTIN or serial number from it without custom parsing rules that vary by manufacturer. GS1 Digital Link URLs carry the product identity in a standardised, machine-parseable structure that any conformant scanning system can interpret without manufacturer-specific configuration.

Second, a plain URL encodes a fixed endpoint. GS1 Digital Link uses the resolver architecture to dynamically route requests based on product identity and scanning context. This is what enables the same physical QR code to serve different data to a consumer and a recycler — the resolver applies the access permission logic, not the QR code itself.

Third, GS1 Digital Link is interoperable with existing retail scanning infrastructure — point-of-sale systems, warehouse management systems, supply chain logistics platforms — that already reads GS1 barcodes. The GS1 Digital Link structure means that a product with a DPP QR code can be scanned at the point of sale for pricing, at the warehouse for inventory management, at the recycling facility for disassembly guidance, and at a market surveillance inspection for conformity checking — all with the same physical symbol, without any of those systems needing special configuration for the specific manufacturer.

Resolver Architecture

The resolver is the server that handles the routing from the GS1 Digital Link URL to the appropriate DPP data endpoint. When a scanner sends the URL to the resolver, the resolver:

1. Parses the GS1 Application Identifiers to extract product identity (GTIN, serial number, batch)
2. Looks up the DPP record for that product identity in the registry
3. Checks the request context — authenticated operator credentials, anonymous consumer request, or market surveillance authority token
4. Returns the appropriate data layer for that actor type, formatted as JSON-LD, GS1 Web Vocabulary, or another specified format

The resolver can also handle multiple link types — the same GS1 Digital Link URL might resolve to a consumer-facing DPP interface for a standard QR scan, to a machine-readable JSON-LD data feed for an automated operator system, or to a specific data endpoint for a market surveillance authority's inspection tool. The GS1 Digital Link standard defines the link type mechanism that makes this multi-resolution possible from a single physical code.

QR Code Technical Specifications for DPP Compliance

Not any QR code will satisfy the ESPR data carrier requirements. The regulation and its implementing acts specify minimum requirements for data carrier type, error correction level, minimum size, and durability.

Code Type and Error Correction

QR Code model 2 (the standard square QR code) is the accepted format for DPP data carriers in consumer product contexts. The minimum error correction level recommended for DPP applications is Level M (15% error correction), which allows the code to remain readable when up to 15% of the code module area is damaged. For products with expected exposure to abrasion, chemical contact, heat, or UV — industrial equipment, outdoor products, batteries installed in vehicles — Level Q (25%) or Level H (30%) error correction is advisable, accepting the tradeoff of a larger or denser code.

The QR code must encode the full GS1 Digital Link URL in UTF-8 encoding. The version of the QR code (which determines its size in modules) must be sufficient to encode the full URL at the chosen error correction level — this is calculated automatically by QR generation software when the URL and error correction level are specified.

Minimum Size Requirements

The minimum recommended quiet zone for a DPP QR code is 4 modules on each side of the code. Minimum print sizes depend on the scanning distance expected: for a product scanned at 10 cm (consumer smartphone scan), a minimum QR code size of approximately 10×10 mm works reliably with current smartphone cameras. For codes expected to be scanned at greater distances or by industrial scanners at range, larger sizes improve scan reliability.

For products where the physical surface cannot accommodate a QR code of adequate size — very small electronic components, tiny battery cells — the regulation permits the data carrier to appear on the packaging and accompanying documentation rather than the product itself, as long as the packaging cannot be separated from the product before the point of sale and the documentation is permanently linked to the product through the serial number or batch number.

Durability Requirements

The data carrier must remain readable throughout the product's useful life. For a consumer electronics product with an expected service life of 5-7 years, a printed QR code under a polycarbonate overlaminate on the device chassis meets this requirement in most normal use conditions. For an industrial battery with a 15-25 year service life exposed to temperature cycling, vibration, chemical exposure, and physical cleaning, a printed label is almost certainly insufficient — laser engraving or electrochemical etching of the QR code into the metal chassis is the appropriate approach, supplemented by a QR code on an embedded RFID or NFC tag for systems where optical scan access may be obstructed during installation.

DPP Data Carrier Options by Product Type

Product Context	Recommended Carrier	Durability Consideration
Consumer apparel	QR code on label or hangtag (permanent attachment)	Label must survive washing cycles for life of garment
Consumer electronics	QR code printed under overlaminate on device chassis	Must survive 5-10 years normal handling
Industrial battery (>2 kWh)	Laser-engraved QR on metal chassis + NFC tag	Must survive 15-25 years, chemical and thermal exposure
Furniture	QR on permanent attached label or laser engraved on frame	Must survive product life, access after installation
Small electrical components	QR on packaging (product too small for direct marking)	Packaging must remain associated with component through sale

RFID and NFC: When QR Codes Are Not Enough

QR codes are the dominant DPP data carrier for consumer-facing applications because of their zero-cost reader requirement — any smartphone camera reads them without specialised hardware. For industrial and high-value product contexts, RFID and NFC tags offer advantages that make them the preferred supplementary or primary carrier.

NFC (Near Field Communication) tags embedded in products allow scanning by tapping a smartphone to the product surface — no camera line of sight required, which is significant for installed equipment where the QR code surface may be inaccessible. NFC chips can also store cryptographic signatures that authenticate the DPP record, preventing counterfeit products from carrying a legitimate-looking QR code that links to a fraudulent registry entry. For luxury goods, pharmaceuticals, and high-value electronics where anti-counterfeiting is a key DPP use case, NFC with cryptographic authentication is materially superior to QR code alone.

UHF RFID is used in logistics and industrial environments where multiple items must be scanned simultaneously without individual QR code alignment — a pallet of batteries can be scanned in bulk as it passes a reader gate, with each battery's RFID tag resolving to its individual DPP record in the backend system. This makes RFID the preferred carrier for supply chain management applications, while the QR code serves the consumer-facing and end-of-life scanning use cases on the same physical product.

The regulation permits multiple data carriers on a single product. A battery that carries both a laser-engraved QR code and an embedded NFC tag satisfies the regulation's requirements for both consumer-accessible scanning and automated industrial scanning from a single product.

Placement Rules for DPP Data Carriers

The ESPR regulation specifies that the data carrier must be affixed to the product itself, or where this is not technically feasible, to the product's packaging, to a label attached to the product or packaging, or to the product's accompanying documentation. The applicable delegated act for each product category may specify more precisely where the data carrier must appear.

Practical placement decisions need to balance several considerations. The code must be physically accessible for scanning throughout the product's service life — a QR code on the back panel of a battery that is installed inside a vehicle and inaccessible once mounted is not fit for purpose, even if it technically appears on the product. For products that are installed or integrated into larger systems, placement on removable components, visible surfaces, or accompanying documentation (with a permanent document reference number linking back to the unit) may be necessary. The DPP requirements checklist includes placement guidance by product category to help manufacturers assess compliance of their labelling approach.

The End-to-End Scanning Experience

What happens between a consumer opening their phone camera and the DPP data appearing on screen involves several technical steps happening in under two seconds.

The camera app decodes the QR code and reads the encoded GS1 Digital Link URL. The operating system (iOS or Android) identifies it as a URL and either opens it directly in the default browser or presents a prompt. The browser sends an HTTP GET request to the resolver domain encoded in the URL. The resolver parses the GS1 Application Identifiers from the URL path to extract product identity. The resolver queries the DPP registry for the product record matching that identity. The registry returns the data record to the resolver. The resolver applies the access permission logic — for an anonymous consumer request, it returns the consumer-accessible data layer. The resolver sends either a redirect to a consumer-facing web interface or a JSON-LD data response, depending on the Accept headers in the request. The browser renders the consumer interface or passes the structured data to whatever application is handling it.

For a professional operator with authenticated credentials — a repair technician using a verified operator app — the same flow occurs, but the resolver identifies the authenticated operator role and returns the operator-accessible data layer with the additional fields those credentials unlock.

The key technical requirement for this to work without friction: the resolver domain in the QR code must remain accessible for the entire product life. A company that encodes its own domain into the GS1 Digital Link URL and then goes out of business, or migrates to a new domain, creates a broken DPP — the QR code still exists on the product, but the resolver is gone. This is one of the strongest practical arguments for using a purpose-built DPP platform as the resolver rather than self-hosting — the platform's resolver infrastructure is maintained independently of any individual manufacturer's business continuity. The DPP-Tool features include managed resolver infrastructure with guaranteed availability obligations, addressing this long-term accessibility requirement. The pricing structure covers how resolver hosting and registry maintenance scale with product volumes.

Generating DPP-Compliant QR Codes

Generating a DPP QR code requires three inputs: the GS1 Digital Link URL (which requires a GS1 company prefix, the product's GTIN, and the serial or batch number for this specific instance), the resolver domain (either self-hosted or provided by a DPP platform), and the QR code generation parameters (error correction level, quiet zone size, output format for print or digital use).

Most DPP platforms generate the QR code automatically once product data is entered and a unique identifier is assigned. The platform constructs the GS1 Digital Link URL using your GS1 credentials (or its own registered resolver domain if operating under a platform-managed identifier scheme), generates the QR code at the specified technical parameters, and provides print-ready output in vector formats (SVG, PDF) suitable for label printing and artwork integration.

For manufacturers producing at scale, QR code generation is typically integrated into the production line — identifiers assigned and QR codes generated in batch before printing, linked to the ERP system so that each unit's identifier is associated with its production record from the point of manufacture. The step-by-step DPP creation guide covers the integration workflow between production systems and DPP platforms for high-volume manufacturing contexts.

For manufacturers producing smaller volumes or implementing their first DPPs, the manual workflow through a DPP platform web interface — enter product data, assign identifiers, download QR codes — is entirely practical and does not require any production system integration to get started.

Frequently Asked Questions