Digital Product Passports & Connected Packaging

1. Executive Summary

The 7 most important insights

DPP is now law in the EU via ESPR (Reg. (EU) 2024/1781). Products in scope require a DPP and access via a data carrier tied to a persistent unique product identifier; no personal datamay be stored in the DPP without explicit GDPR consent. [1]
Battery Passports arrive first. From 18 Feb 2027, batteries must carry a QR codeproviding access via a unique identifier compliant with ISO/IEC 15459. [2]
GS1 Digital Link is the web-native spine for connected packaging (URI for GS1 IDs + typed links), enabling one code to serve both compliance and consumer outcomes. [3, 4]
2D-at-POS is accelerating (Sunrise 2027), but UPC/EAN will remain. Plan dual-compatible artwork and coordinate with trading partners before removing linear codes. [5]
Print quality and symbol design are mission-critical. Use ISO/IEC 18004 (QR) or 16022 (Data Matrix), verify to ISO/IEC 15415/15416, and size per GS1 General Specifications; POS QR X-dimension typically0.396–0.990 mm. [6–11]
EPCIS 2.0 + GS1 Web Vocabulary supercharge DPP and traceability. JSON/JSON-LD events and standard link types create consistent endpoints for consumers and regulators. [12, 13]
Regional stance differs. EU mandates DPP via ESPR; the US focuses on DSCSA and UDI; UK is enabling digital labelling without a DPP mandate (yet). [1, 14–16]

3–5 recommended actions

Choose a primary 2D carrier + URI strategy now (GS1 Digital Link over QR or GS1 DataMatrix), preferring GTIN + serial where item-level is likely. [3, 6, 8]
Stand up a resolver & link governance (linkType policy, locales, consent), decoupling the on-pack code from experience routing; integrate with PIM/MDM and regulatory data. [3, 12, 13]
Build a DPP-ready data backbone (open standards, role-based access, audit), mapping ESPR Annex III and category fields; strictly separate GDPR consent. [1, 2, 14]

Key risks (next 12–24 months)

Delegated Acts will phase in and may set carrier/layout/access specifics per category; monitor the Commission consultation (launched 9 Apr 2025). [15]
POS readiness variance could force dual-marking; do not retire UPC/EAN prematurely. [5]
Privacy & dark patterns: ESPR forbids personal data in the DPP without explicit consent; GDPR applies fully to landing experiences. [1, 16, 17]

2. Definitions & Concepts

Digital Product Passport (DPP): Structured, machine-readable product record mandated by ESPR; must be accessible via a data carrier linked to a persistent unique product identifier. [1]
Data carrier: Linear barcode, 2D symbol (QR/Data Matrix), or other AIDC medium. [1]
Unique Product Identifier (UPI): Identifier enabling a weblink to the DPP, compatible with ISO/IEC 15459. [1]
GS1 Digital Link (DL): Encodes GS1 IDs (e.g., GTIN, serial) into a URL and attaches typed links (e.g., gs1:pip). [3, 13]
EPCIS 2.0: Event standard (JSON/JSON-LD) for "what/where/when/why" of product movements. [12]
ISO/IEC 18004 / 16022: QR Code / Data Matrix symbology specs. [6, 7]
ISO/IEC 15415 / 15416: 2D/1D print quality verification standards. [9]
DSCSA (US): Interoperable, package-level traceability for prescription drugs. [14]
UDI (US/EU): Unique Device Identification AIDC + HRI requirements. [18, 19]

Concept map (bullet diagram)

Product
↳ Identifier (GTIN/serial) → GS1 Digital Link URI → Data carrier (QR/DM) on pack → Resolver → Typed links (consumer, regulator, service). [3, 13]
↳ DPP dataset (ESPR Annex III + category DA) → Access rules → Back-up provider (ESPR Art. 10–11). [1]
↳ Traceability events (EPCIS 2.0) → Verification/compliance + consumer transparency. [12]

3. Standards, Regulations, and Governance

3.1 EU (ESPR + Batteries + Packaging)

ESPR (EU 2024/1781) establishes the DPP framework; DPP must be accessible via a data carrier and linked via a persistent unique identifier; no personal data without consent; use open, interoperable formats; maintain an independent back-up provider. [1]
Batteries Regulation (EU 2023/1542): from 18 Feb 2027, batteries must be marked with a QR code providing access via a unique identifier compliant with ISO/IEC 15459. [2]
PPWR interplay: when a DPP exists, reuse it to surface packaging information; potential standardised digital marking for substances of concern. [20]

Known upcoming changes: Commission DPP consultation launched 9 Apr 2025; Delegated Acts will define category details with typical transition periods. [15]

3.2 US (DSCSA, UDI)

DSCSA requires interoperable, package-level identification and electronic exchange; FDA updates timing via stabilization periods and targeted exemptions—monitor FDA pages. [14, 21, 22]
UDI (21 CFR 801.40; EU MDR Annex VI Part C): AIDC + HRI on devices, typically using GS1 DataMatrix; carrier/placement specifics in guidance. [18, 19]

3.3 UK

No DPP mandate currently. Policy focus on enabling digital labelling across sectors (Smarter Regulation), signalling openness to QR-based augmentation of static labels; category specifics pending. [24]

Topic	EU	US	UK
DPP legal basis	ESPR 2024/1781 (framework; DPP mandatory per delegated acts)	No DPP mandate	No DPP mandate
Earliest DPP-like requirement	Battery Passport via QR by 18 Feb 2027	—	—
Retail 2D scanning	Growing; not mandated by law	Growing	Growing
Medical devices	EU MDR/IVDR UDI (AIDC + HRI)	UDI (AIDC + HRI)	UK MDR reforms pending; UDI policy evolving
Digital labelling policy	ESPR permits digital access via data carrier; PPWR interplay	Guidance varies by category	Policy drive for digital labelling enablement

4. Evidence Base & Benchmarks

Core standards & legal anchors

ESPR Articles 9–11; Annex III. [1]
Batteries Regulation (EU 2023/1542). [2]
GS1 Digital Link; GS1 Web Vocabulary. [3, 13]
GS1 General Specifications v25. [8]
ISO/IEC 18004, 16022, 15415/15416, 15459. [6–11]
EPCIS 2.0 Implementation Guideline. [12]
GDPR lawful basis and consent. [16, 17]

Table 1 — 2D symbol selection & use

Use case	Preferred data carrier	Notes	Evidence
Consumer + compliance (general retail)	QR with GS1 Digital Link	Ubiquitous smartphone scanning; supports typed links, locale, resolver logic	[3, 13]
Small imprint area / healthcare	GS1 DataMatrix	Compact; widely used in UDI/healthcare and DSCSA	[7, 18, 14]
POS scanning (retail checkout)	GS1 DL QR (or GS1 DataMatrix where supported) + retain UPC/EAN as needed	2D-at-POS is rising; UPC not being retired	[5, 8]

Table 2 — Sizing & verification quick-reference

Parameter	QR (GS1 DL at POS)	Data Matrix (general)	Evidence
X-dimension	0.396–0.990 mm typical	Follow GS1 symbol spec tables	[10, 8]
Quiet zone	Per symbology; must be clear	Min ~1× module typical for DM; failing quiet zone fails ISO/IEC 15415	[11, 9]
Verification	ISO/IEC 15415 (2D), 15416 (1D)	As left	[8, 9]

Table 3 — Data & exchange

Layer	Standard	What it does	Evidence
Identifier	GTIN + serial (GS1 keys)	Unambiguous identity; item-level DPP	[8]
On-pack link	GS1 Digital Link	Web-resolvable URI with link types	[3, 13]
Traceability	EPCIS 2.0	Event-level what/where/when/why	[12]

5. Design & Production Implications

Pick one primary symbol (QR or GS1 DataMatrix) and follow GS1 General Specifications for AIs, HRI, quiet zones, contrasts, and substrate selection. [8]
Size for the environment. For POS QR under GS1 DL, target X-dimension 0.396–0.990 mm; verify at speed. [10]
Verify every lot to ISO/IEC 15415 (2D) and retain reports. [9]
Avoid curved-surface distortion; preserve quiet zones; manage varnish/finish for scan contrast. [8]
Use GS1 DL + resolver for consumer, regulatory/DPP, service, and recycling endpoints using link types. [3, 13]

Manufacturing note: for glossy surfaces, specify matte overlam or micro-texture patches to reduce glare. Validate with partner scanners.

Material/format trade-offs

Paper label vs. direct print: labels enable late serialisation; direct print improves durability.
Inkjet vs. laser vs. thermal transfer: laser yields crisp modules; inkjet excels inline; TTR strong on labels. Verify to ISO/IEC 15415.

Supplier perspective

Reserve symbol area (incl. quiet zone), specify X-dim, target grade, HRI style, colour/contrast; supply verification reports and GS1 DL URI rules. [8, 9, 13]

6. Sustainability & Compliance Considerations

Recyclability labels & connected packaging: Use QR/DL to host location-specific recycling guidance while maintaining on-pack marks aligned with APR/CEFLEX/OPRL. [25–27]
ESPR & PPWR synergy: Reuse the DPP to surface packaging-related information where possible. [20]
Claims risk: Avoid absolute claims; host substantiation and test reports via typed links. [25]
Privacy by design: No personal data in the DPP without explicit consent; GDPR governs landing experiences. [1, 16, 17]

Compliance watch: maintain a DPP back-up provider as required by ESPR Art. 10(4). [1]

7. Workflow & Tooling

Checklists

Print-ready 2D code checklist
☐ GS1 identifiers & AIs confirmed
☐ Data carrier selected (QR/GS1 DM) + GS1 DL URI defined
☐ X-dim & symbol size set (POS/handheld)
☐ Quiet zone reserved; finish/varnish controlled
☐ Contrast/substrate specified
☐ ISO/IEC 15415 verification grade target
☐ HRI content/style approved
☐ Test scans + verification reports

DPP readiness checklist (EU ESPR)
☐ Category in scope? Map Annex III + DA fields
☐ Unique product identifier standardised (ISO/IEC 15459/GS1)
☐ Carrier placement/layout per DA; access control mapped
☐ No personal data unless explicit GDPR consent
☐ Open, interoperable formats; back-up contracted
☐ Pre-contract access for retail/e-com (Art. 9–10)

Resolver & link governance checklist
☐ Link types (gs1:pip, instructions, safety, recycling) defined
☐ Localisation & market routing rules
☐ Consent flows and analytics compliant
☐ Campaign taxonomy; audit logs; resolver SLA

Decision trees

Choose label stock/adhesive → substrate → finish → scanner environment → durability → print method → verify → approve
Select print process by run length & substrate → flexo vs. digital vs. laser marking → module fidelity achievable? → ISO 15415 checks

Calculator blueprints

Symbol size = (module count per side) × X-dimension; ensure quiet zone ≥ spec (e.g., Data Matrix ≥ 1× module each side typical). [11]
Throughput capacity: verification sampling = AQL-based; set per converter QA policy.

Template specs (RFQ & artwork)

RFQ fields: GS1 keys; symbology; X-dim; final size; substrate; finish; verification grade; HRI; colour; placement; samples; QA deliverables
Artwork naming/versioning: include GTIN and DL profile in metadata; version by date + plant code

8. Category-Specific Guidance

Beauty: Use QR/DL to off-load claims substantiation and usage content; prepare for textile/cosmetic-adjacent sustainability disclosures via DPP endpoints as DAs land. [15]
Food & Beverage: One code for PIP + allergens + recycling; ensure legally required safety data remains on-pack where mandated. [1]
Beverage (Cans, PET): Manage curvature/condensation; prefer label zones or textured patches; if DM used for line scanning, validate to ISO/IEC 15415 and GS1 specs. [8, 9]

9. Case Studies

EV/Industrial Batteries (EU)
Problem. Battery Passport by 18 Feb 2027 via QR + unique ID; multi-stakeholder datasets.
Approach. GS1 keys + GS1 DL URI; item-level serial; QR on housing; open formats; role-based access; back-up provider.
Result. One code routes public, service (restricted), and compliance endpoints; production verified to ISO/IEC 15415; meets ISO/IEC 15459. [2, 1, 12]
Textile/Apparel (EU—watching DAs)
Problem. Anticipated DPP delegated act.
Approach. Pre-stage GS1 DL URIs + resolver policies; pilot item-level serialisation; integrate EPCIS 2.0.
Result. Ready for DA details with minimal on-pack change; live care/repair/resale experiences today. [15, 12]
OTC/Pharma (US)
Problem. DSCSA electronic interoperability and package-level identity; mixed scanner environments.
Approach. GS1 DataMatrix with GTIN/serial/lot/expiry; EPCIS 2.0 for event exchange; consumer QR separate or multiplex via GS1 DL where allowed.
Result. Compliance with DSCSA expectations; consumer endpoints gated by consent. [14, 12]

Evidence gap: retailer 2D-at-POS readiness varies; confirm with each account.

10. Common Pitfalls & Red Flags

Quiet zone violations causing scan failures. [9, 8]
Under-sized codes for POS distance; check X-dim targets. [10]
Hard-wiring campaign URLs on pack; use GS1 DL + resolver. [3]
Storing personal data in the DPP; keep DPP non-personal; gate marketing analytics under GDPR consent. [1, 16, 17]
Skipping verification; implement lot-based ISO/IEC 15415/15416 checks. [9]
Assuming UPC/EAN will be retired; align with trading partners. [5]

15. References

Regulation (EU) 2024/1781 (ESPR)—Articles 9–11; Annex III. EUR-Lex
Regulation (EU) 2023/1542 (Batteries)—QR + unique ID (18 Feb 2027).
GS1 Digital Link Standard (Release 1.1.3)—URI syntax, resolvers.
GS1 Web Vocabulary—link types and semantics. ref.gs1.org/voc
GS1—2D at POS initiative; UPC not going away. GS1 US
ISO/IEC 18004—QR Code symbology.
ISO/IEC 16022—Data Matrix symbology.
GS1 General Specifications v25. GS1
ISO/IEC 15415—2D print quality verification; ISO/IEC 15416—1D.
GS1 UK—QR (DL) size guidance for POS (0.396–0.990 mm). GS1 UK
GS1 Canada—Barcoding for Designers (quiet zone/ISO 15415). PDF
GS1 EPCIS 2.0 Implementation Guideline (ratified). Kezzler explainer
GS1—Digital Link & typed links overview.
FDA—DSCSA overview & stabilization context. FDA
European Commission—DPP consultation launch (9 Apr 2025). EC
GDPR (EU 2016/679)—lawful basis. EUR-Lex
GDPR—consent conditions (Art. 7). gdpr-info.eu
EU MDR—UDI system and carrier (Annex VI Part C). EUR-Lex
US UDI—21 CFR 801.40; FDA guidance. LII
PPWR interaction—using DPP for packaging info.
FDA—waivers & exemptions beyond DSCSA stabilization period.
Additional DSCSA enforcement context (verify with FDA).
APR Design Guide for Plastics Recyclability.
CEFLEX—Designing for a Circular Economy (D4ACE).
OPRL—UK recycling labelling rules.

Last reviewed date: 10 August 2025 (Europe/London).