If you sell into Europe, you have probably heard that products will need a "digital passport". The phrase covers a real EU law, but it is often described as if it applied to every product today. It does not. This explainer sets out what a Digital Product Passport is, who it applies to and when, and how it connects to the code on a pack.
What a Digital Product Passport is
A Digital Product Passport (DPP) is, in the European Commission's words, "a digital identity card for products, components, and materials". The legal definition is more precise: a set of data specific to a product, accessible electronically through a data carrier.
It comes from the EU's Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, in force since 18 July 2024. Its purpose is to give customers, repairers, recyclers and authorities reliable information about a product's sustainability, circularity and legal compliance.
In practice, a passport has two halves:
- On or with the product: a data carrier, such as a QR code, that leads to the passport;
- Online: the passport data itself, held by the company responsible for it or by a service provider acting for it.
Who it applies to, and when
The ESPR is a framework. It does not, on its own, require any product to have a passport. The Commission says plainly that there is "no general obligation" for products to have one. Requirements arrive product group by product group, through delegated acts that set out what data is needed, which data carrier to use and from when.
Batteries are first. A separate law, the Batteries Regulation (EU) 2023/1542, requires a battery passport from 18 February 2027. It covers each light-means-of-transport battery (such as e-bike and e-scooter batteries), each industrial battery above 2 kWh and each electric vehicle battery placed on the EU market. It is reached through a QR code and uses the common DPP technical system.
Other groups are planned. The Commission's working plan for 2025–2030, adopted in April 2025, prioritises textiles and apparel, furniture, tyres, mattresses, iron and steel, and aluminium, plus horizontal measures on repairability and on recycled content and recyclability of electrical and electronic equipment. The plan gives indicative years for adopting the rules, mostly between 2026 and 2029. Those are not compliance deadlines: each delegated act sets its own application date.
What data a passport may hold
Each product group's act decides the exact content. The ESPR lists the elements those acts can choose from, including:
- the product's unique identifier, and product codes such as customs commodity codes;
- compliance documents, such as the declaration of conformity;
- user manuals, instructions, warnings and safety information;
- information about the manufacturer, importer and other responsible operators;
- the product-group information the rules require, which the Commission's examples describe as technical performance, materials and their origins, repair, recycling and lifecycle environmental impacts.
Different people see different parts. Consumers may see some information, while repairers, recyclers or authorities have access to more, under access rights set per product group. And the ESPR is explicit that personal data about customers must not be stored in a passport without their explicit consent.
How the code on pack connects to the passport
This is where a DPP meets connected packaging. The ESPR requires each passport to be "connected through a data carrier to a persistent unique product identifier". It defines both terms:
- a data carrier is a linear barcode, a two-dimensional symbol or another automatic identification medium that a device can read. The Commission's FAQ names QR codes and NFC as common options;
- a unique product identifier is a unique string of characters that identifies a product and enables a web link to its passport.
The carrier must be on the product, its packaging or the documents that accompany it, as the product group's act specifies. That act also sets the level of detail: one passport per model, per batch or per individual item. Those levels map closely onto the familiar product, batch and serial identity levels explained in batch-level vs unit-level identification.
Standards. The carrier and identifier must follow the ISO/IEC 15459 identification standards, or equivalent, until EU harmonised standards are in place. Those are now arriving. European standards bodies (CEN-CENELEC) developed eight harmonised DPP standards. Six, including ones on unique identifiers and data carriers, were cited by the Commission in July 2026. The ESPR also requires open, interoperable standards with no vendor lock-in.
The registry. On 20 July 2026, the Commission launched the DPP Registry, where companies register their products' unique identifiers. The registry does not hold the passport itself; product data stays decentralised, with the responsible company or its service provider.
Where GS1 Digital Link fits
None of the EU sources above names GS1 or GS1 Digital Link. The law is written in terms of international standards, not any one organisation. So GS1 Digital Link is not mandated for the DPP, and no product needs a GS1 code to comply.
It is, however, one way industry is proposing to meet the requirements. GS1 in Europe has published a paper describing how companies already using GS1 identifiers could:
- use the GTIN for model-level passports, the GTIN plus batch for batch level, and the GTIN plus serial number for item level;
- carry that identity in a QR code or Data Matrix using GS1 Digital Link syntax, so that a phone can open it as a web link;
- register the same identifier elements in the EU registry, independent of the web domain in the code.
The appeal is that one identity could serve several jobs. A brand may already print a GS1 Digital Link for retail checkout or consumer information, as explained in what GS1 Digital Link is. A resolver behind that link can send different users to different resources, as covered in what a GS1 resolver is. Whether that route suits a given product group will depend on the final rules for it.
What it means for exporters outside the EU
The DPP is not only a European manufacturers' issue. Where a product group's rules require a passport, they apply to imported products too, and the Commission says imports will need a passport before customs releases them for free circulation. The company placing the product on the EU market must also give dealers and online marketplaces a digital copy of the data carrier or identifier on request.
For an Indian or GCC manufacturer exporting to Europe, a sensible response is preparation rather than panic:
- Check whether your product groups are covered. Batteries have fixed rules already; textiles, furniture, tyres, mattresses, steel and aluminium are the working plan's early priorities.
- Agree roles with your EU importer or distributor. Decide who will create, host and update passport data, and who registers identifiers.
- Get your product identities in order. Clean, stable identifiers for each model, and batch or serial data where the line can provide it, are useful whatever the final rules say.
- Ask where the data will come from. Material composition, repair and recycling information often sits with suppliers. Start collecting it early.
- Plan packaging changes once. If a code is coming to the pack anyway, design it so it can also serve consumers and retailers. The broader preparation is in how to prepare your packaging for the next generation of product identity.