What's inside a Digital Product Passport: the system below the surface
Most explanations of a Digital Product Passport stop at the data. They list what a passport must contain and leave it there. That misses the harder question a compliance team actually has to answer. When a regulator, a consumer, or an AI agent scans the code on your product, what happens in the half second before the right record appears on screen? A DPP is not a file you upload. It is a small system of connected parts. This article opens up that system. We cover the unique identifier, the data carrier, the GS1 Digital Link, the resolver, where the data is hosted, and the EU Registry that ties it together. For the list of fields a passport must hold, read what data goes inside a DPP.
What is a Digital Product Passport, technically?
Technically, a Digital Product Passport is a structured digital record about a single product, reached through a code on the pack. It is introduced under the EU Ecodesign for Sustainable Products Regulation. The passport is not stored on the product. The product carries an identifier and a link. The data lives on a server and is retrieved when the code is scanned.
The phrase "passport" suggests a document that travels with the product. That is the wrong mental model. The product carries a pointer. The record sits elsewhere, on infrastructure the brand or its provider controls. This split matters because it changes what you are actually building. You are not printing a passport onto a label. You are connecting a physical item to a live data record and making sure the connection holds for the life of the product. For the plain-language overview of what a DPP is and who it applies to, start with our guide to the Digital Product Passport.
What is the unique identifier and the data carrier?
The unique identifier is the code that names one specific product. The data carrier is the physical mark that holds it, usually a QR code on the pack. Under the EU framework the identifier follows ISO/IEC 15459, the same identification standard GS1 Digital Link is built on, so the product can be named consistently across systems.
These are two different things and they are often confused. The identifier is data. The data carrier is the physical thing that holds the data. A QR code is the most common carrier for consumer goods because any phone camera reads it and it prints cheaply. NFC tags and RFID are also valid carriers under the regulation, used where the product or the use case justifies the cost.
The identifier has to be unique and stable. If two products share an identifier, the system cannot tell them apart, and the whole record falls over. Building the identifier on ISO/IEC 15459, the recognised product identification standard, keeps it consistent whether the product is read at a border, in a warehouse, or in a kitchen.
What is the GS1 Digital Link and the resolver?
The GS1 Digital Link is a way of writing the product identifier inside an ordinary web address, so one QR code can serve many purposes. The resolver is the service that reads that address and decides what to return. The link names the product. The resolver routes the scan. They are separate jobs and the difference is the most misunderstood part of the system.
Here is the distinction that trips most teams up. A point-of-sale scanner reads the GS1 Digital Link and pulls the product identifier straight out of the address structure. It never goes online. The GS1 standard is explicit that the identifier can be extracted without any need for an internet connection. So checkout works on the link alone. No resolver is involved at the till.
The resolver handles everything beyond checkout. When a consumer scans, the resolver can return a product page. When a regulator scans, it can return the compliance record. When the scan comes from another market, it can return content in that market's language. One physical code, different responses, decided at the moment of the scan by the resolver. This is the part of the architecture that does the real work for a passport, and it is also the part that is still maturing.
James Williamson, our co-founder, is careful about how he frames this. Structured data using the GS1 link type with the GS1 resolver is not fully in play yet. As brands adopt 2D barcodes and the resolver system, that layer will start to pay dividends and become the way machines access authoritative product data. The resolver is coming, and it is a real shift, but it is honest to say the ground is still being laid. For the event-data standard that feeds traceability into this system, see EPCIS 2.0 explained.
The practical proof is already visible in export. Ian Batt at Small Things Wine adopted GS1 2D barcodes to solve exactly this routing problem after a market rejected a label that pointed everyone to the same global page.
Where does the data live and how does a scan find it?
The passport data lives on a server controlled by the brand or its connected-packaging provider, not on the product and not in the EU Registry. A scan reads the identifier from the data carrier, the resolver looks up where that product's record sits, and it returns the correct record for the audience and market making the request.
Follow one scan end to end. A phone reads the QR code. Inside the code is a GS1 Digital Link holding the unique identifier. The resolver receives the request, sees which product the identifier names, checks who is asking and from where, then returns the matching record from the host server. The whole sequence takes a moment and the consumer sees a page, not the machinery behind it.
This is why where you host the record is a real decision, not an afterthought. The record has to stay available, accurate, and updateable for the life of the product, which can run years. If the host goes dark, the code points at nothing. When you compare providers, the hosting model and the resolver behind it matter more than the front-end design. How to choose DPP software walks through what to ask.
What is the EU DPP Registry and what does it store?
The EU DPP Registry is a central system run by the European Commission. It is to be set up before 19 July 2026. It does not hold the full passport. It stores a list of unique product identifiers and data carriers, enough to connect a product to its passport and to support verification and customs checks at the EU border.
This is the part most brands misread. The Registry is not where your passport content goes. It is a lookup and verification layer. It holds the identifiers and the data carriers so authorities can confirm a product is registered and find the route to its record. The actual passport content stays with the brand or the provider. The Commission's own design keeps sensitive supply-chain detail out of the central system and on the operator's infrastructure.
That division of labour is the clearest signal that a DPP is a system, not a document. The Registry verifies. The resolver routes. The host server holds the record. The data carrier on the pack ties a physical product to all three. Get those four parts connected correctly and the passport works. Miss the connection between them and you have data nobody can reach.
The gap is real. In the KPMG European Digital Product Passport Readiness Survey, 97% of organisations had heard of the DPP, but only 33% reported a high level of understanding. The regulation is known. The architecture beneath it is not yet, and that is where projects stall.
If you are working out how the identifier, data carrier, resolver and EU Registry connect for your products, the Orijin Plus Digital Product Passport solution generates GS1-compliant 2D barcodes with a managed resolver and structured product data hosting, so the connection between the pack and the record holds across markets and over time.
Frequently Asked Questions
Is the Digital Product Passport stored on the product itself?
No. The product carries a unique identifier inside a data carrier, usually a QR code. The passport record sits on a server controlled by the brand or its provider. When the code is scanned, the system retrieves the record. The product holds the pointer, not the data, which is why the host server and the resolver behind the code matter so much.
What is the difference between the data carrier and the unique identifier?
The unique identifier is the code that names one specific product. The data carrier is the physical mark that holds it on the pack, most often a QR code, sometimes an NFC tag or RFID chip. The identifier is the data. The carrier is the container. The regulation requires both, and the identifier follows the ISO/IEC 15459 standard so it stays consistent across systems.
Do I need a resolver to be compliant at point of sale?
No. A point-of-sale scanner reads the product identifier directly from the GS1 Digital Link address without going online. Checkout works on the link alone. A resolver is only needed for everything beyond the till, such as serving a consumer page, returning a compliance record, or delivering market-specific content. The link names the product. The resolver routes the scan.
Does the EU DPP Registry store my full product passport?
No. The European Commission's Registry, due before 19 July 2026, stores a list of unique product identifiers and data carriers. It is a verification and lookup layer that lets authorities confirm registration and find the route to a passport. The full passport content stays on infrastructure controlled by the brand or its connected-packaging provider, not in the central Registry.
How does one QR code show different content to different people?
Through the resolver. The QR code holds a single GS1 Digital Link with one identifier. When the code is scanned, the resolver reads who is asking and from which market, then returns the matching record. A consumer can get a product page, a regulator can get compliance data, and another market can get local-language content, all from the same physical code.
What does GS1 Digital Link have to do with a DPP?
GS1 Digital Link is the method for writing a product identifier inside a normal web address, built on the ISO/IEC 15459 identification standard. It lets one QR code serve checkout, consumers, regulators, and AI agents. For a DPP, it is the connecting syntax between the physical code on the pack and the digital record the resolver returns.
Will AI shopping agents use the DPP system?
They will rely on the resolver layer. An AI agent that needs to confirm a product's origin or check a certification queries structured data through the resolver, not the printed code. As James Williamson puts it, the resolver layer used in machine decision-making may end up mattering more than the physical barcode it points to, because that is where authoritative product data is retrieved.
