GS1 Digital Link: How It Works for Digital Product Passports

GS1 Digital Link is a GS1 standard that writes GS1 identifiers, such as a GTIN, a batch or lot number, and a serial number, as a web address. Because the identifier sits inside a URL, one QR code can ring up a product at retail checkout and also open web content about that product, including a digital product passport (DPP). Under the EU Ecodesign for Sustainable Products Regulation (ESPR), GS1 Digital Link is one way to implement the passport's unique product identifier and data carrier. ESPR does not mandate GS1. The harmonized standards set the requirements: EN 18219 covers unique identifiers and describes schemes that use issuing agencies, self-issuing systems, or both, and EN 18220 covers data carriers.

The Commission cited both standards, with four other DPP standards, in Implementing Decision (EU) 2026/1736 of July 14, 2026, which gives passports built to them a presumption of conformity with ESPR Articles 10 and 11. Those articles require a data carrier linked to a persistent unique product identifier, open and interoperable standards without vendor lock-in, and access rights for each stakeholder group. Our digital product passport guide covers the full set of obligations.

How GS1 Digital Link works

The GS1 Digital Link URI Syntax standard, release 1.7.0, ratified in August 2026, defines the structure. After the domain, the path starts with a primary key, written as a GS1 Application Identifier (AI) code and its value, such as AI 01 for a Global Trade Item Number (GTIN) or AI 414 for a Global Location Number (GLN). Key qualifiers follow in a fixed order: consumer product variant (AI 22), batch or lot (AI 10), and serial number (AI 21). Data attributes, such as an expiry date (AI 17), go in the query string. Since release 1.4.0, the standard expects 14-digit GTINs, so a 12-digit UPC-A number gains two leading zeros.

GS1's documentation uses GTIN 09520123456788, from the 952 prefix range that GS1 reserves for demonstrations and examples. Section 4.12 of the standard gives https://example.org/01/09520123456788/10/ABC123?17=210630 as a canonical URI, and adding the standard's serial number example produces https://example.org/01/09520123456788/10/ABC123/21/12345XYZ?17=210630. That address identifies item 12345XYZ in batch ABC123 of the product and carries an expiry date of June 30, 2021 as a data attribute. Any registered domain can replace example.org, and AI 10 and AI 21 each accept up to 20 alphanumeric characters.

GS1 once published an algorithm that compressed these URIs into smaller QR codes. The legacy GS1 Digital Link Standard, release 1.1.4, keeps it only for backward compatibility and marks it as unmaintained and not approved for open supply chain standards. GS1's only current compression standard, ratified in July 2025, covers EPC binary strings on RFID tags and limits compressed URIs to closed systems, and GS1's provisional DPP standard requires the uncompressed form.

Resolvers and link types

A resolver is the web service at the URI's domain that turns a scan into a destination. Under the GS1-Conformant Resolver Standard, release 1.2.1, ratified in August 2026, a resolver redirects to the default link unless the request carries information that points to a better match. An application can ask for one link type, such as linkType=gs1:pip for the product information page, or for every link with linkType=linkset, which returns a list in the RFC 9264 linkset format. Resolvers should also honor the Accept-Language header, so a phone set to German can reach German content.

Link types come from the GS1 Web Vocabulary, which defines gs1:dpp as "a link to a digital product passport" alongside gs1:sustainabilityInfo, gs1:certificationInfo, gs1:instructions, and gs1:serviceInfo for service or maintenance instructions. One printed code can therefore reach the passport, repair instructions, and recycling information.

GS1 runs a free resolver at id.gs1.org that publishes the links companies store in the GS1 Registry Platform through their GS1 Member Organization. A brand can instead run a resolver, or have a vendor run one, on its own domain, and the resolver standard lets one resolver hand matching requests to another.

A printed URI cannot change after the product ships, so its domain has to keep working for as long as the passport must be available. ESPR sets that period in each delegated act and requires the passport to stay available after insolvency or cessation of activity, with a back-up copy at an independent DPP service provider (Articles 9 to 11). If the domain lapses, every code printed with it stops resolving for shoppers. GS1's provisional DPP standard adds that systems can parse the identifier from the URI to reach private DPP data, including back-up data. Register the domain to the legal entity that places the product on the market, renew it for the long term, and keep product links on a dedicated subdomain.

Data carriers: QR code, DataMatrix, NFC, and RFID

EN 18220 sets requirements for DPP data carriers: symbology characteristics, format, error correction, encoding methods, printing and production quality, durability, and a graphical indicator that marks a DPP carrier. Each delegated act names the carrier for its product group, placed on the product, its packaging, or accompanying documents (ESPR Articles 9 and 10). The Commission's ESPR FAQ of September 2024 said it would weigh the recyclability and waste impact of components such as NFC circuits.

GS1's provisional DPP standard, first issued in April 2025, updated in June 2026, and not yet ratified, is narrower. It specifies a QR Code or a Data Matrix carrying an uncompressed GS1 Digital Link URI, and allows EPC/RFID and NFC only in addition to that 2D barcode. A Data Matrix holding the URI differs from GS1 DataMatrix, which carries GS1 element strings for supply chain and healthcare scanning.

The QR Code is the default for consumer products because, as GS1 notes, the default camera app on any mobile device scans it, while not all phone cameras read Data Matrix. Capacity is no constraint: a QR Code holds up to 7,089 digits and a Data Matrix up to 3,116 digits. NFC typically works at less than 4 cm. RAIN RFID reads at up to 10 meters without line of sight and up to 1,000 items per second, according to the RAIN Alliance, but it needs a dedicated reader, which suits distribution more than shoppers.

The retail move to 2D barcodes

Retail's move to 2D barcodes runs separately from ESPR and uses the same QR code. GS1 US describes Sunrise 2027 this way: by the end of 2027, retailers have agreed to be equipped to accept 2D barcodes at checkout. GS1 reported in June 2024 that 22 retail and consumer goods companies had signed a joint statement calling for QR Codes with GS1 standards to be widely adopted by the end of 2027, with pilots in 48 countries representing 88 percent of world GDP. Both are industry initiatives with no legal force.

GS1's 2D Barcodes at Retail Point-of-Sale Implementation Guideline, release 1.1.0, ratified in December 2025, keeps the linear EAN or UPC barcode on pack "until 90% of POS scanning solutions are capable of using GS1 compliant POS 2D barcodes," with the 2D code within 50 mm of the linear barcode's center. One QR Code with a GS1 Digital Link URI then serves checkout and consumers, and, where the delegated act accepts a QR code, the passport as well, so one packaging redesign covers both programs.

GS1 Digital Link for digital product passports

ESPR lets each delegated act set passport granularity at model, batch, or item level. GS1 in Europe's DPP guidance, release 2.2, maps the GTIN, or a GTIN with a consumer product variant, to the model, adds the batch or lot number for batch level and the serial number for item level, and commits that an identifier allocated to a product subject to ESPR is never reused for another product.

The registry rules fit that structure. Article 8 of Implementing Regulation (EU) 2026/1778 requires an item-level passport to be linked to its batch and model identifiers where they exist, and a product covered by several EU laws to be registered at the most granular level any of them requires. The verified economic operator placing the product on the market registers through the registry's user interface or API. The Commission then reads the passport, checks semantic conformity, granularity, and, where relevant, the commodity code and the back-up link, and issues a unique, persistent registration identifier. The registry went live on July 20, 2026, and customs check that identifier and the commodity code before releasing imports for free circulation (ESPR Article 15).

A shopper's scan carries no linkType and reaches the brand's default link, such as a public passport page, while software requesting linkType=gs1:dpp reaches the passport. The resolver standard has no authentication or access control provisions, so restricted fields sit on the passport platform. ESPR Article 11 requires free access under rights set for each stakeholder group, such as repairers, recyclers, and market surveillance authorities, with authenticated, reliable data and a high level of security and privacy. GS1 in Europe lists passwords, multi-factor authentication, federated identity, and verifiable credentials as options, and two further standards, on access rights and security and on data authentication and integrity, complete the CEN-CENELEC set. Our guide to digital product passport security covers the controls.

For the passport's unique operator and facility identifiers, GS1's provisional DPP standard makes the GLN the ISO/IEC 15459 compliant identifier in the GS1 system, and GS1 in Europe applies it to the legal entity responsible for the product and to the site that produces it.

Implementation steps

A GS1 Digital Link passport program runs in six workstreams.

1. License a GS1 Company Prefix from your GS1 Member Organization, which is GS1 US in the United States, and assign GTINs under the GTIN Management Standard, release 1.1. It requires a new GTIN when consumers or trading partners are expected to distinguish the changed product, when a regulatory or liability disclosure requires it, or when the change has a substantial supply chain impact.
2. Set serialization to the granularity the delegated act requires, generate batch and serial numbers within the 20-character limit, and block identifier reuse.
3. Choose the resolver and domain, register the passport under gs1:dpp, and name the owner who renews the domain for the passport's availability period.
4. Specify a QR Code or Data Matrix with the uncompressed URI, symbol size and print quality for each substrate, placement, and the linear barcode retail still needs. Add NFC or RFID only with a business case, encoding the same URI.
5. Test production samples with iPhone and Android camera apps, point-of-sale scanners, and a barcode verifier, and confirm that each request type, including signed-in access, reaches the right destination.
6. Brief artwork agencies, label converters, and co-packers, collect supplier data, and connect the passport platform to ERP, PLM, and PIM systems; our system integration team handles that connection.

A DPP platform vendor hosts the passport. Our ESPR compliance services cover the identifier design, platform selection, integration, and registry registration around it.

Other identifier schemes

GS1 is one of several issuing agencies under ISO/IEC 15459, the standard series for unique identification. AIM, Inc. is the registration authority, and every identifier issued under an agency's authority begins with one of its issuing agency codes, so no two agencies issue the same string. AIM's register of June 16, 2026 lists GS1 under codes 0 to 9, the Health Industry Business Communications Council (HIBCC) under LH and RH, Odette under OD, IFA under PP, and Dun & Bradstreet under UN.

ISO/IEC 18975:2024, published in November 2024, generalizes the web address approach: it encodes globally unique identifiers in HTTP URIs using either ISO/IEC 15459 identifiers or the domain name itself, and GS1 Sweden describes GS1 Digital Link as fully compliant with it. IEC 61406-1:2022 specifies an Identification Link, a URL on a 2D symbol or NFC tag that identifies a physical object, and IEC 61406-2:2024 adds structured forms for models, batches, and items.

Implementing Regulation (EU) 2026/1778 names no identifier scheme, so the delegated act and EN 18219 decide what qualifies. A company with GS1-numbered consumer goods and IEC 61406-marked industrial parts should confirm that its passport platform resolves both; our guide to choosing a digital product passport platform covers that test.

Frequently asked questions

Is GS1 Digital Link required for the EU digital product passport? No. ESPR requires a data carrier connected to a persistent unique product identifier, built on open and interoperable standards, and each delegated act names the carrier. EN 18219 describes identifier schemes that use issuing agencies, self-issuing systems, or both, so GS1 Digital Link is one way to meet the requirements.

What is the difference between a GS1 Digital Link QR code and an ordinary QR code? Both hold a web address. In a GS1 Digital Link QR code, the address follows the GS1 URI syntax, so software can read the GTIN, batch, and serial number from its path. A 2D-capable retail scanner can ring up the product, and a phone opens the page or passport the brand chose.

Can I use id.gs1.org instead of my own domain? Yes. GS1 runs a free resolver at id.gs1.org that publishes links companies register in the GS1 Registry Platform through their GS1 Member Organization. A brand-owned domain gives the brand direct control of redirect rules and makes it responsible for keeping the domain live for the passport's availability period.

What happens to the passport link if we change our website domain? Every printed code keeps pointing at the old domain, so that domain has to keep redirecting for as long as the passport must stay available. A dedicated subdomain for product links, or a GS1 resolver, separates passport links from website changes.

Does a GS1 Digital Link QR code work at checkout today? It depends on the retailer's scanners. Under the Sunrise 2027 initiative described by GS1 US, retailers have agreed to be equipped to accept 2D barcodes at checkout by the end of 2027. GS1's retail guideline keeps the linear barcode on pack until 90 percent of point-of-sale scanning solutions can read GS1 2D barcodes.

If you are deciding how GS1 Digital Link fits your passport program, from GTIN and serial design to resolver choice and registry registration, our ESPR compliance practice can map the requirements for your product groups and set up the identifier layer with your packaging and IT teams.