Digital Product Passport
How a Digital Product Passport Works
From the QR code to the passport data — the end-to-end chain of a DPP: identifier, carrier, resolver, access tiers and the EU registry, step by step.
From the outside, a Digital Product Passport is just a QR code. Behind it sits a five-part chain: a unique identifier, a data carrier, a resolver service, tiered passport data and an EU registry entry. This article unpacks that chain, starting from the moment of the scan.
1. The unique identifier
Everything starts with an identity that is globally unique, persistent and machine-readable. EN 18219 permits five schemes; the most common in practice is a GS1 Digital Link URI built on a GTIN:
https://id.examplebrand.com/01/08691234567890/10/LOT2026AHere 01 and 10 are GS1 application identifiers for the GTIN and batch. Add 21 for a serial number where item-level tracking is needed. See what a GTIN is and EN 18219.
The level at which the identity is issued — model, batch or item — directly determines cost and capability. See choosing granularity.
2. The data carrier
The identifier is bound to the physical product by a carrier. EN 18220 permits QR, Data Matrix, NFC, HF RFID and RAIN RFID, and sets one critical rule: at least one carrier must be free, app-free and smartphone-readable.
| Carrier | Strength | Weakness |
|---|---|---|
| QR code | Every phone reads it, cheap | Needs surface area |
| Data Matrix | Readable in tiny areas | Harder for consumer phones |
| NFC | Contactless, premium feel | Tag cost, reader variation |
| RAIN RFID | Bulk reading, logistics | No consumer access |
See data carriers and QR code design.
3. The resolver
The URL printed on the product has to survive the product's lifetime. But the system hosting the passport may not: you change platforms, domains move. That is why a resolver sits in the middle, taking the identifier and redirecting to the address currently in force.
A resolver also performs content negotiation: a browser asking for HTML gets a human-readable page, while a system asking for application/ld+json gets structured data. See what a resolver service is.
4. Tiered passport data
The address the resolver points to serves the passport data — and not everyone sees the same thing:
- Public tier: product name, composition summary, care and recycling information. No login, no fee.
- Restricted tiers: disassembly instructions for repairers, detailed composition for recyclers, test reports for authorities.
FprEN 18239 standardises this tiering. See restricted data tiers and access rights and roles.
5. The registry
Before the product is placed on the market, its identifier is registered in the EU DPP Registry, which holds the identifier, hosting address, operator identity and customs commodity code — never the passport content. Customs queries this entry at import. See the EU DPP Registry guide.
The scan, second by second
- The user scans the QR; the camera finds a URL.
- The browser requests it and the resolver receives the request.
- The resolver resolves the identifier and issues a 307 redirect to the current passport address.
- The passport service checks the requester's authorisation; an anonymous request gets the public tier.
- The page opens — no app, no login, in seconds.
When an authorised user such as a recycling facility arrives with credentials, the same URL returns deeper data.
Where the data comes from
The passport screen is the last link in the chain. The data itself is collected from ERP, PLM and supplier declarations, then validated and versioned — and in practice that is where most of the project's time goes. See collecting data from suppliers and ERP integration.
Frequently asked questions
Is the data inside the QR code itself?
No. The QR carries only a URL. The data sits at the service that URL resolves to, which is how you can update a passport without reprinting labels.
Can the passport be reached offline?
Online access is the default model. A small core data set can be written to an NFC tag in some scenarios, but the full passport is online.
Do old QR codes keep working if the passport address changes?
Yes, if you use a resolver: the printed URL stays fixed and the redirect is updated. Printing a direct link instead risks dead links later.
Does every product get its own page?
It depends on granularity. A model-level passport covers all units; at item level, every serial number has its own record.
