The DPP QR code is not a marketing QR code. It is a machine-readable data carrier that must conform to ISO/IEC 18004, encode a GS1 Digital Link URL, resolve to a valid DPP data record, and remain scannable for the product's entire lifetime. Getting the QR code wrong means your DPP is non-functional and your product is non-compliant.
| Requirement | Specification | Standard |
|---|---|---|
| QR code format | QR Code Model 2, Error Correction Level M or higher | ISO/IEC 18004:2015 |
| URL structure | GS1 Digital Link URL encoding GTIN + serial number or batch number | GS1 Digital Link Standard v1.2 |
| URL resolution | Must resolve to DPP data record with HTTP 200 response | ESPR Article 8(2) |
| Minimum size | Minimum 10mm × 10mm (product-specific minimums in delegated acts) | ISO/IEC 18004, delegated act |
| Quiet zone | Minimum 4 modules on all sides | ISO/IEC 18004 |
| Contrast ratio | Minimum 7:1 contrast ratio (dark modules on light background) | ISO/IEC 18004 |
| Durability | Must remain scannable throughout product lifetime (material-specific requirements in delegated acts) | ESPR Article 8(4) |
| Placement | On product, packaging, or accompanying documentation — visible without disassembly | ESPR Article 8(2), delegated act |
A GS1 Digital Link URL encodes the product's GTIN (Global Trade Item Number) and, where applicable, the serial number or batch number. The URL structure follows the GS1 Digital Link Standard v1.2:
https://id.gs1.org/01/{GTIN}/21/{SerialNumber}
https://id.gs1.org/01/{GTIN}/10/{BatchNumber}
When scanned, the GS1 Digital Link URL resolves to the DPP data record hosted on the manufacturer's DPP registry or a third-party DPP registry. The EU DPP Registry stores the mapping between the GS1 Digital Link URL and the DPP data record location.
QR codes support four error correction levels: L (Low, 7% error recovery), M (Medium, 15% error recovery), Q (Quartile, 25% error recovery), and H (High, 30% error recovery). For ESPR DPP QR codes, the recommended error correction level is M or Q. Level L is not recommended because it provides insufficient error recovery for QR codes that may be subject to minor damage or soiling. Level H provides the highest error recovery but results in a larger QR code for the same data payload — this may be a constraint for products with limited label space. The choice of error correction level should be based on the expected environmental conditions the QR code will be exposed to during the product's lifetime. For products used in harsh environments (construction, industrial, outdoor), level Q or H is recommended.
The length of the GS1 Digital Link URI determines the QR code version required to encode it. A typical GS1 Digital Link URI for a serialised product (including GTIN, serial number, and resolver domain) is approximately 50–80 characters. A QR code Version 4 (33 × 33 modules) can encode up to 50 alphanumeric characters at error correction level M, which is sufficient for a basic GS1 Digital Link URI. A QR code Version 6 (41 × 41 modules) can encode up to 74 alphanumeric characters at error correction level M, which is sufficient for most GS1 Digital Link URIs including serial numbers. Manufacturers should design their GS1 Digital Link URI to be as short as possible while still containing all required identifiers, to minimise the QR code version and size required.
Before committing to a production run of products with ESPR DPP QR codes, manufacturers should conduct a comprehensive QR code testing programme. The testing programme should include: print quality verification using a calibrated ISO/IEC 15415 verifier, scanning tests using a range of smartphones (iOS and Android, different generations), scanning tests under different lighting conditions (bright sunlight, low light, fluorescent lighting), scanning tests at different distances and angles, and durability testing under the expected environmental conditions. The testing programme should be documented and the results retained as part of the technical documentation for the product. If the QR code fails any of the tests, the print parameters (ink density, substrate, print resolution) should be adjusted and the tests repeated before production begins.
The minimum size of a QR code for ESPR DPP purposes depends on the scanning distance and the QR code version. As a general rule, the minimum QR code size for reliable scanning by a smartphone at a distance of 20–30 cm is 2 × 2 cm (20 × 20 mm). For products that will be scanned at greater distances (for example, products on warehouse shelves), the QR code should be larger — a QR code scanned at 1 metre should be at least 5 × 5 cm. The ESPR implementing acts may specify minimum size requirements for QR codes on specific product categories. Manufacturers should test their QR code sizes under realistic scanning conditions before committing to a production label design. The ISO/IEC 18004 standard provides guidance on the relationship between QR code size, version, and scanning distance.
QR codes have four levels of error correction: Level L (7% of codewords can be restored), Level M (15%), Level Q (25%), and Level H (30%). For ESPR DPP applications, Level M or Level Q error correction is recommended — this provides sufficient redundancy to ensure that the QR code can be scanned even if it is partially damaged or obscured, without making the QR code unnecessarily large. Level H error correction should be used for QR codes on products that will be exposed to harsh environments (outdoor products, industrial equipment) where the QR code is likely to be damaged. The choice of error correction level affects the QR code's data capacity — higher error correction levels require more modules (pixels) to encode the same data, resulting in a larger QR code. Manufacturers should select the error correction level that provides the appropriate balance between reliability and size for their specific product and use environment.
ESPR requires a QR code conforming to ISO/IEC 18004 that encodes a GS1 Digital Link URL. The URL must resolve to the DPP data record. The QR code must be machine-readable and must remain scannable throughout the product's lifetime.
ESPR Article 8(2) allows NFC tags as an alternative or supplement to QR codes, provided the NFC tag also encodes a GS1 Digital Link URL. For most consumer products, a QR code is required as the primary data carrier because it is readable by any smartphone without special equipment.
ESPR and the applicable delegated act specify QR code placement. The general rule is that the QR code must be on the product itself, its packaging, or its accompanying documentation. It must be visible and accessible without disassembling the product.
GS1 Digital Link is a standard that encodes product identifiers (GTIN, serial number, batch number) into a URL format. When a GS1 Digital Link URL is scanned, it resolves to the DPP data record. GS1 Digital Link ensures that the same QR code can be used for multiple purposes (DPP access, product authentication, supply chain tracking).
The EU DPP Registry goes live on 19 July 2026. EU customs will verify DPP compliance automatically from that date. Products without a valid DPP can be refused entry. Register now at Africa's first ESPR-compliant DPP registry.
Register Your Digital Product Passport →ESPR Article 8(2)(a) requires the data carrier to be "readable by a device that is widely available to the public." QR codes meet this requirement because they can be scanned by any smartphone with a camera — a device that is now available to the majority of the world's population. NFC tags also meet this requirement for NFC-enabled smartphones, but QR codes have broader compatibility because they do not require NFC hardware. The EU Commission's DPP technical specification mandates QR codes as the primary data carrier for ESPR DPPs, with NFC as an optional additional carrier.
The QR code on an ESPR DPP is not a simple URL shortener. It encodes a GS1 Digital Link URL — a structured URL format that contains the product's GTIN (Global Trade Item Number) and, optionally, the product's serial number or batch number. The GS1 Digital Link URL is sent to a resolver that returns the DPP data. This architecture allows the QR code to remain stable even if the DPP data is updated or moved to a different server — the resolver handles the routing.
| Parameter | Requirement | Standard |
|---|---|---|
| QR code version | Version 1-40 (as required by data length) | ISO/IEC 18004 |
| Error correction level | Minimum M (15% recovery); Q or H recommended | ISO/IEC 18004 |
| Minimum module size | 0.4mm | GS1 General Specifications |
| Quiet zone | 4 modules minimum on all sides | ISO/IEC 18004 |
| Print quality grade | ISO/IEC 15415 grade D minimum | ISO/IEC 15415 |
| URL format | GS1 Digital Link (https://[resolver]/01/[GTIN]/21/[serial]) | GS1 Digital Link Standard |
| Colour | Dark modules on light background; minimum contrast ratio 4:1 | GS1 General Specifications |
ESPR Article 8(2)(c) requires the data carrier to be "affixed to the product, its packaging, or accompanying documents." The preferred placement is on the product itself — not on the packaging, which may be discarded before the product reaches the end user. For products where placement on the product itself is impractical (due to size, material, or use conditions), the data carrier may be on the packaging or accompanying documents.
The QR code must be visible and accessible throughout the product's lifetime. For products that are installed in buildings or equipment (such as boilers, heat pumps, and construction materials), the QR code must be placed in a location that remains accessible after installation. For products that are used outdoors (such as solar panels and tyres), the QR code must be durable enough to remain scannable under outdoor conditions for the product's expected lifetime.
ESPR Article 8(2)(d) requires that the data carrier be accompanied by human-readable information that allows consumers to identify the product and understand the purpose of the data carrier. This typically means printing the product's GTIN and model number alongside the QR code, and a brief text label such as "Scan for Digital Product Passport" or "EU Digital Product Passport." The human-readable information must be in the official language(s) of the member state where the product is sold.
ESPR requires that the DPP data carrier remain functional throughout the product's lifetime. For QR codes, this means that the QR code must remain scannable after exposure to the environmental conditions the product will encounter during its use phase. The ISO/IEC 15415 standard specifies the print quality verification methodology for 2D barcodes, including QR codes. Manufacturers should test their QR code labels against the ISO/IEC 15415 standard to verify that the print quality meets the minimum requirements for reliable scanning. For products that will be exposed to harsh environments (outdoor products, industrial equipment, food contact materials), manufacturers should conduct accelerated aging tests to verify that the QR code label remains scannable after exposure to UV radiation, moisture, chemicals, and abrasion. The test conditions should simulate the worst-case environmental conditions the product will encounter during its use phase. Manufacturers should document their QR code durability testing as part of their technical documentation for ESPR conformity assessment purposes.