What Happens When a Consumer Scans a Connected Product?

A shopper at home picks up a bottle of face serum, opens the phone camera and points it at the QR code on the box. A second later a page opens with usage tips and the ingredients list. In between, several systems have done their job. This article follows that path and looks at what the brand can learn from the scan, and what it should not try to.

A consumer scan is a web request

At the checkout, a 2D code is read and decoded offline, and the till looks up the GTIN in the retailer's own system. A consumer scan is the opposite: it is an ordinary visit to a web address. The two paths share the same printed code, but nothing else. For the checkout side, see what happens when a product is scanned at the checkout.

Step by step

1. The camera reads the code

The phone camera recognises a QR code and decodes the text inside it. If that text is a web address, the phone offers to open it.

2. The address carries the product's identity

On a connected product, the web address is a GS1 Digital Link. It looks like a normal link, but its path contains GS1 identifiers:

https://brand.example/01/09506000134376/10/B2407/21/7Q4K9X

Here /01/ introduces the GTIN, /10/ the batch and /21/ the serial number. Expiry, if present, goes after a ? in the query string. GS1 recommends brands use their own domain, so the address can point at a service the brand controls.

3. A resolver decides where to go

The request arrives at a resolver: a web service that connects a GS1 identity to one or more online resources. In a GS1-conformant resolver, each product has exactly one default link, and the resolver redirects there unless the request asks for something else. It can pick a different default by language, and an app can ask for a specific type of link, such as product information (gs1:pip) or instructions (gs1:instructions).

Links are inherited "up the tree". If a serial number has no page of its own, the resolver falls back to the links for its GTIN, so a brand doesn't need to configure millions of individual units. What a resolver is, in more depth, is covered in what is a GS1 resolver?

4. The page loads

The phone follows the redirect and the brand's page opens. Depending on what the brand has set up, the page might show product details, how-to videos, recall status, a warranty form or a loyalty offer. The full journey, including how the address is built and printed, is told in how GS1 Digital Link works, from packaging to browser.

What a scan can record

Every web request carries some technical information, and the services handling it — the resolver, the web server, any analytics on the page — can log it. For a product scan, that typically means:

Two points matter here. First, a scan on its own does not reveal who the person is. Second, precise location is not automatic: modern browsers ask the user before sharing it, and many people decline.

For a serialized product, the scan record is linked to one physical unit. That is what makes anomaly checks possible, such as one serial being scanned in two distant cities within an hour, but it does not make the code proof of authenticity on its own.

Privacy and consent

Because a scan is a web visit, the same privacy expectations apply as to any website, and data-protection laws in many countries cover the personal data involved. Good practice for brands is straightforward:

• Be clear. Tell people on the page what you collect and why, in plain language.
• Ask before you track precisely. Request device location only when there is a real reason, such as finding a nearby service centre, and explain the reason first.
• Collect only what you need. Anonymous scan counts by product and region answer many business questions without personal data.
• Separate identity from engagement. If someone registers a warranty or joins a loyalty scheme, that is a deliberate choice, and it should be recorded as consent, not inferred from a scan.
• Check the rules where your consumers live. Requirements differ between countries; take advice for each market.

Why a GS1 DataMatrix usually won't open on a phone

Some packs carry a GS1 DataMatrix using GS1 element strings rather than a web address. It is a perfectly good code for the checkout and the supply chain. But it contains numbers with Application Identifiers, not a link, so a standard phone camera usually has nothing to open. A specialist app can read it, but most consumers won't have one.

If you want consumers to reach a page, the code needs to carry a GS1 Digital Link — most often in a QR code, because phone cameras recognise it most readily. The choice is compared in QR code vs GS1 DataMatrix.

A worked example

Lumière Skin, a fictional cosmetics brand, prints a QR code with a serialized GS1 Digital Link on each box of serum.

1. Priya scans the box at home. Her phone opens the address, and Lumière Skin's resolver redirects her to the product page in her browser's language.
2. The resolver logs the time, the GTIN, batch and serial, her device type and an approximate region from her network. It does not know her name.
3. The page offers a "find a store near you" button. When she taps it, the browser asks for location permission. She declines and types her city instead.
4. She chooses to register the product for a skincare tips programme, ticking a consent box. Only now does Lumière Skin hold personal data linked to this unit, under the terms she agreed to.

What a brand can build from moments like step 4 is the subject of why connected packaging can create a direct brand relationship.