GS1 Digital Link and DPP: The technology connecting products to their digital passport
GS1 Digital Link connects a product identifier to a web address that can be encoded in a QR code. A resolver handling that address directs users or applications to the relevant information, including the Digital Product Passport. A working solution requires consistency between the marking on the product, the identifiers in the company’s systems, and the services that make the data available.
The most important decisions concern the long-term reliability of this connection. The company needs to establish who controls the domain encoded on the label, where links to passports are maintained, and how access to information will continue after a provider change. Distinguishing between the product, batch, and individual item is equally important.
GS1 Digital Link connects the Digital Product Passport to the identifier of a specific product, batch, or item. We explain the broader regulatory context in our article on why to start preparing for the DPP now.
1. What is GS1 Digital Link and how is it different from a regular QR code
GS1 Digital Link defines how GS1 identifiers are represented in a URI. A QR code is a data carrier that can contain that address. For products, the primary identifier is usually a GTIN, supplemented with a batch number or serial number where appropriate.
A regular QR code can contain any web address. A GS1 Digital Link address follows a defined structure that allows software to recognize the product identifier. A checkout system can therefore use the GTIN, while a browser or application can open the associated information. These capabilities depend on the scanning device and its software.
Within the company’s architecture, PIM systems can organize identifiers and their relationships with product data. Retrieving and updating operational data is a separate topic, covered in our article on integrating DPP with an ERP system.
The transition to 2D barcodes in retail is supported by Sunrise 2027, an industry initiative targeting checkout readiness by the end of 2027, separate from the deadlines established by DPP legislation.
1.1 URL structure: GTIN, batch, and serial number (Application Identifiers)
Each GS1 Application Identifier (AI) defines the meaning of a particular data element in the address. The identifiers 01, 10, and 21 are used for the GTIN, batch/lot number, and serial number, respectively.
Example address:
https://id.example.com/01/09521234000006/10/LOT2026A/21/SN000123
| Element | Meaning |
|---|---|
| id.example.com | Domain serving the address |
| 01/09521234000006 | GTIN identifying the trade item |
| 10/LOT2026A | Batch/lot number |
| 21/SN000123 | Serial number of the individual item |
This is an example of the syntax, not the address of an actual passport. It contains a product identifier, batch number, and serial number to show their order in the address. The identification scope for a particular DPP must match the applicable requirements.
The GTIN identifies the trade item, while additional qualifiers narrow the reference to a batch or individual item. The same hierarchy should be reflected in the company’s data model.
1.2 One code, multiple destinations – the role of the resolver
A resolver is a service that accepts an identifier and points to associated resources. It maintains relationships between the product and addresses leading to its passport, instructions, or technical documentation. It describes these links using link types, which indicate the kind of resource available.
Consider an office chair. A consumer scanning its code with a phone reaches the default product page, with access to the passport and user instructions. A recycling facility’s application can request a link to disassembly instructions. A market surveillance authority can follow a link to documentation that requires appropriate access rights.
The resource selected depends on the resolver’s configuration and the application’s request, for example the linkType parameter. The application can indicate its preferred language or response format in HTTP request headers. The service providing the data is responsible for checking access rights to protected information. Selecting a link type does not establish the recipient’s identity.
The resolver can also return a set of associated links in JSON-LD format when requested by an application.
2. Is GS1 Digital Link legally required for the DPP?
ESPR, Regulation (EU) 2024/1781, sets requirements for identification, data carriers, and access to information while allowing different compliant solutions. GS1 Digital Link is one way to meet these requirements. The regulation does not designate GS1 Digital Link as a mandatory standard.
The following provisions are particularly relevant when designing the solution:
| Legal basis | Relevance to the connection between a product and its DPP |
|---|---|
| Article 9(1) of ESPR | Passport availability and accurate, complete, up-to-date data |
| Article 9(2)(b)-(d) | Specification of the data carrier, its placement, and the identification level in the applicable delegated act |
| Article 10(1)(a)-(b) | A persistent connection between the passport and a unique identifier through a physical data carrier |
| Article 10(1)(c) | Compliance of the data carrier and identifier with the relevant standards |
| Article 10(1)(d) | Openness, interoperability, and data portability without dependence on a single provider |
Annex III of ESPR refers, among other standards, to the ISO/IEC 15459 family, which sets rules for assigning unique identifiers. Article 12(6)(c) requires the Commission to remain technology-neutral as far as possible when establishing certain rules for identifiers.
Using GS1 in DPP can be practical for an organization that already uses GTINs: it connects existing product identifiers to online information. The conformity assessment needs to cover the entire solution, including the data carrier, information availability, and product-group requirements.
Implementation deadlines depend on the product group and applicable legislation: for example, the passport requirement taking effect on February 18, 2027, for certain batteries comes from the separate Regulation (EU) 2023/1542, rather than a common deadline for all products covered by ESPR.
3. EN 18220:2026 and GS1 Digital Link – the new harmonized standard
EN 18220:2026 concerns data carriers used in a Digital Product Passport system. Its reference was published in the Official Journal of the European Union through Commission Implementing Decision (EU) 2026/1736, alongside five other standards for DPP infrastructure. The standardization work was carried out by CEN/CENELEC JTC 24.
A solution that conforms to this standard is presumed to meet the requirements of Articles 10 and 11 of ESPR covered by the standard. Other parts of the DPP solution require a separate assessment.
The standards address different layers:
| Standard | Main scope |
|---|---|
| ISO/IEC 15459 | Rules for unique identification |
| ISO/IEC 18975:2024 | Encoding identifiers and directing requests to associated resources over HTTP |
| GS1 Digital Link URI | The structure of an address containing GS1 identifiers |
| EN 18220:2026 | Requirements for DPP data carriers |
ISO/IEC 18975:2024 defines broader principles for using identifiers in web-based services. GS1 Digital Link and the GS1 resolver standard describe solutions consistent with this approach.
3.1 What EN 18220:2026 covers – and what it doesn’t
The published scope of EN 18220:2026 covers:
- symbology characteristics, format, encoding methods, and error correction;
- printing and production quality, together with data-carrier durability;
- indicators that help users recognize DPP data carriers and requirements for their placement;
- machine readability, quality checks, and links between the physical product and its digital representation.
The standard excludes system architecture, use cases, and cryptographic security features. The publicly available scope description does not establish that GS1 Digital Link is mandatory. Assessing a specific solution in detail requires access to the full text of the applicable standards.
EN 18220:2026 addresses requirements for the data carrier. The information that must be published in a passport for a particular product group is determined by the relevant product legislation.
For the implementation team, this means checking both the address itself and whether it can be read from the physical product. Testing should account for the label material, contrast, marking size, and conditions of use. A code on packaging stored in a dry environment will face different conditions from a marking on equipment exposed to abrasion or cleaning chemicals.
4. EU DPP Registry requirements for the Digital Link URL
In EU DPP Registry documentation, the unique product identifier takes the form of a URL. According to the DPP Registry User Guide for Economic Operators v1.02, the address must begin with https://, follow the format specified by the CEN/CENELEC JTC 24 standards, and not exceed 2,000 characters.
Validation should cover the complete address: protocol, domain, path, any query parameters, character encoding, and total URL length. As the Commission updates the registry documentation, the project should record which version of the requirements was used to validate generated addresses. This makes it easier to establish whether a registration error results from changed rules, an incorrect identifier, or the way the data was submitted.
4.1 Designing URLs with multiple qualifiers within the character limit
The address should contain the identifiers needed to reference the correct product, batch, or individual item. The qualifiers required depend on the chosen identification level and GS1 Digital Link rules. Other information describing the product can be made available in the passport.
Moving a batch number or serial number into the query string simply to shorten the path would be incorrect. In an uncompressed GS1 Digital Link URI, key qualifiers have a defined position and order in the path. Query parameters serve other categories of data.
Three practical rules are worth following:
- use a short, stable domain and a concise path prefix;
- include only the information needed for the intended application;
- check the length of the final URL after special characters have been encoded.
The address length also determines how many characters need to be encoded in the barcode. The marking design should therefore be tested for readability at its intended size and with the chosen printing method, independently of any limit imposed by the registry form or API.
5. GS1-hosted, self-hosted, or a DPP platform resolver – How to Choose
Choosing a DPP resolver also determines who will maintain the links between product identifiers and the resources made available. The company needs to establish who controls the domain, manages redirects, and keeps the passport accessible for the required period.
Article 9 of ESPR makes passport availability a condition for placing products subject to the relevant requirements on the market. Article 11(e) requires access to be maintained for the specified period, including after the responsible business ceases trading. The provider agreement should therefore define how service continuity will be maintained.
The following provisions are particularly relevant when designing the solution:
| Model | Technical operation | What remains the company’s responsibility | Main risk when switching providers |
|---|---|---|---|
| GS1-hosted resolver | A GS1 organization operates the resolver infrastructure | Identifiers, up-to-date links, and DPP content and availability | Losing the ability to manage mappings or failing to meet the service’s terms |
| Self-hosted resolver | The company or its chosen operator runs the service on the company’s domain | Domain, configuration, service continuity, integrations, and documentation | Configuration that cannot be exported in a transferable format, or insufficient knowledge to restore the service |
| DPP platform with a resolver | The provider may operate both redirects and passports | Data oversight, access arrangements, the contract, and an exit plan | Dependence on the provider’s domain, closed formats, or inaccessible mappings |
When switching providers, retaining the address already printed on the product is critical. The ability to download passport files alone does not establish whether existing markings will continue to lead to the correct information.
Our separate DPP ROI analysis can support the assessment of investment and benefits.
5.1 GS1-hosted resolver (id.gs1.org) – reducing in-house infrastructure
GS1 provides a resolver service, and id.gs1.org is the domain of the GS1 Global Office resolver. Arrangements for linking identifiers to resources and managing those links should be agreed with the relevant GS1 Member Organization. The service’s terms of use also matter.
This model reduces the amount of resolver infrastructure the company needs to maintain itself. The company remains responsible for preparing identifiers, specifying correct destination addresses, and maintaining passport data in its own environment or with a DPP provider.
Before choosing the service, establish whether links can be updated automatically, which identification levels are supported, and how administrative access can be recovered. Availability and performance requirements should be defined for the entire period during which the DPP must remain accessible.
5.2 Self-hosted custom-domain resolver – full control, full responsibility
A company-owned domain separates the address on the product from the hosting or DPP platform provider. A resolver operating on that domain, also called a custom domain resolver, can be maintained by the company or an external operator. Retaining control of the domain and configuration is essential to service continuity.
The maintenance plan should cover DNS, TLS certificates, hosting, the link database, updates, monitoring, and recovery after a failure. Availability testing should cover the complete process from reading the address to opening the correct passport.
Where several contractors are involved, responsibilities need to be clearly assigned. The Pimcore and Azure implementation for ZARYS illustrates this division: Tandemite handled system integration, while Hostersi was responsible for the infrastructure environment in Azure.
We discuss digital product passport implementation cost separately, including integration work and ongoing maintenance.
5.3 Third-party DPP platform resolver – what to check in the contract
A DPP platform can combine passport management and link handling in one service. A key consideration is DPP vendor lock-in, where dependence on a provider can make a future platform change difficult.
The contract and technical documentation should specify:
- Domain control: who is the registrant and who can change the DNS configuration.
- Export scope: passport data, identifiers, change history, and link mappings, including link types and language versions.
- Exit arrangements: the transition period, administrative access, configuration handover, and continued handling of existing addresses.
- Service continuity: availability commitments, backups, procedures for restoring the service after a failure, and arrangements if the provider discontinues the service.
Before signing the contract, test the migration of a small set of data and mappings. One acceptance criterion can be that the same test codes continue to open the correct passports after migration.
Teams planningg Digital Product Passport implementation with Tandemite can start by defining these responsibilities and the requirements for transferring data and maintaining addresses.
6. How provider or data changes affect an already-printed QR code
Once printed, the QR code continues to contain the same address. The resolver can change the associated destination addresses while preserving the product identifier. Instructions, documentation, or the location of the passport can therefore be updated through the online services.
There are three scenarios to consider:
| Change | What happens to the code on the product |
|---|---|
| Updating the data or passport location while retaining the same encoded address | The code remains unchanged; the data or mappings are updated in the online services |
| Changing a GTIN, batch number, or serial number encoded in the marking | A new code must contain the updated identifier value |
| Losing control of the domain encoded in the code | The old address must remain operational for the existing marking to keep working |
A redirect should preserve the identity of the product being referenced. An existing serial number must continue to lead to information about the same item. When a new product requires a new identifier, its marking must be prepared accordingly. Where a new passport is created for a product that already has a DPP, the legislation requires a link to the previous passport to be maintained.
The highest-risk scenario is a code containing a domain over which the company loses control. A new provider can recreate the passport; keeping the old address operational requires cooperation from the party controlling that domain. The migration plan should therefore cover both the data and the continued operation of existing addresses.
7. Modeling GS1 Digital Link in a PIM – a Pimcore example
For GS1 Digital Link PIM integration, the data model should keep product, batch, and item identifiers separate from the addresses of services that publish information. A change of publishing platform can then be handled through the connection configuration while preserving the identifiers printed on products.
In Pimcore, a GTIN should be stored as a text field. The Input type stores text in a VARCHAR column and allows its length to be configured. This representation preserves leading zeros and prevents the identifier from being treated as a value intended for calculations.
For new GS1 Digital Link implementations, the specification requires GTINs to be represented as 14-digit strings. Shorter GTINs are padded with leading zeros. Validation should check length, permitted characters, and the check digit while preserving those zeros.
The following table presents an example data model to be adapted to the organization’s scale and architecture.
| Object or level | Example fields | Modeling principle |
|---|---|---|
| Product or trade-item variant | gtin, internal identifier, relationship to the variant | Store the GTIN as text and assign it according to trade-item identification rules |
| Batch | lotNumber, relationship to the product | Interpret the batch number in the context of the relevant GTIN |
| Individual item | serialNumber, relationship to the product and, where applicable, the batch | Ensure the item is uniquely identified within the product |
| Digital Link address | digitalLinkUri, identification level, version of the generation rules | Preserve the approved address used in the marking |
| Resource mapping | Destination address, link type, language, status | Update the mapping separately without changing product identity |
For large numbers of individual items, detailed serial-number records may remain in a specialized system. PIM then maintains product data and the necessary relationships, while the identification service handles addresses assigned to individual items. This is an architectural decision that depends on record volumes and update frequency.
A simplified division of responsibilities looks like this:
PIM → Digital Link service → resolver → DPP
During publication, PIM supplies approved identifiers and the information needed to prepare mappings. Passport data is sent to the DPP service. When the code is scanned, the resolver looks up the relationship between the identifier and the relevant resource, then directs the user or application to it.
We explain this flow in more detail in our article on DPP, PIM and LCA integration.
7.1 What belongs in the URI path vs. the query string
In a full, uncompressed GS1 Digital Link address, the position of each data element depends on its role:
| Location | What it contains in this model |
|---|---|
| URI path | The primary key, such as a GTIN, and identification qualifiers, such as a batch number and serial number |
| Query string | Additional GS1 data attributes, such as dates, and permitted extension parameters |
| Passport content | Detailed descriptions, documents, instructions, and information that needs to be updated |
The query string begins after ?. An attribute included as a query parameter becomes part of the address and may be encoded in the marking. Updating data in PIM does not change a value already encoded on a label. For each attribute, establish whether it needs to be part of the physical marking or retrieved from the passport.
GS1 Digital Link URI syntax defines how keys, qualifiers, and data attributes are arranged in the address. Custom extensions must also follow naming rules to avoid conflicts with GS1 Application Identifiers.
When designing the model, it helps to establish what product data lives in a PIM and where it comes from. The URI can then include the data needed for identification and the intended application.
8. Common mistakes when implementing GS1 Digital Link for DPP
The following mistakes arise from confusing the roles of the identifier, data carrier, resolver, and passport content.
1. Treating any address as a GS1 Digital Link.
A custom domain is permitted, and the rest of the address must follow the standard’s rules. Encoding an ordinary product-page address in a QR code does not make it a GS1 Digital Link.
2. Choosing the wrong identification level.
A code containing only a GTIN may suit one application and be too general for another. The identification scope needs to match the DPP level required for the product group. Errors include omitting a necessary batch or serial number and creating individual-item records without a justified need.
3. Altering identifiers during data processing.
Removing leading zeros from a GTIN, changing the case of a serial number, or encoding characters incorrectly can break the link between a marking and its record. Acceptance testing should compare the source data, generated URI, and the result of scanning the physical code.
4. Failing to plan for domain and redirect continuity.
The platform agreement should cover existing codes throughout migration. Passport export capabilities need to be accompanied by a way to restore mappings and preserve addresses.
5. Testing the code only on a screen.
Acceptance testing of the marking should use the finished product or packaging and reflect the conditions in which the code will be read. Quality, durability, and readability requirements are part of EN 18220:2026.
6. Linking a valid identifier to incomplete data.
A working address should lead to the approved passport for the correct product. Preparing that content requires checks on data sources and documentation. We discuss this in our article on why supplier data can block DPP implementation.
A well-designed GS1 Digital Link implementation combines correct identification, durable marking, and controlled access to up-to-date information. The assessment should also cover provider changes, recovery after a failure, and continued code operation after the product is no longer sold.
Arrange an implementation consultation with Tandemite to define the identification model, resolver approach, and PIM changes needed to connect products to their digital passports.
FAQ: Frequently asked questions about GS1 Digital Link and DPP
Is GS1 Digital Link legally required for the Digital Product Passport?
ESPR sets requirements for identifiers, data carriers, and access to information and refers to the applicable standards. GS1 Digital Link is one available solution. The choice should be assessed against the requirements for the relevant product group.
Can one QR code serve both retail checkout and the Digital Product Passport?
Yes. A GS1 Digital Link QR code can enable the checkout system to read the GTIN and the user to open the passport. This requires compatible scanning hardware and checkout software, together with a working connection to the online information.
Do you have to use the GS1-hosted resolver (id.gs1.org), or can you run your own?
A company can use the GS1 service, operate its own resolver, or choose a provider’s solution. The standard supports a distributed network of services. The choice should account for domain control, the ability to transfer mappings, and access to the DPP for the required period.
How does the EN 18220:2026 standard affect the choice of DPP data carrier?
The standard covers requirements for encoding, quality, durability, placement, and reading of the data carrier. Applying it helps assess the quality, durability, and readability of the carrier connecting a product to digital information. The URI structure and other system components need to be assessed against the relevant specifications.
Does switching DPP platform providers mean reprinting QR codes already on products?
Reprinting may be unnecessary if the company retains the encoded address, identifiers, and the ability to update mappings to the new data location. The greatest risk arises when the old address depends entirely on the previous provider’s domain or service. Migration arrangements should therefore be agreed before product marking begins.
