A Digital Product Passport (DPP) is a structured digital record about a specific product, its materials, origin, environmental footprint and end-of-life handling, reachable through a data carrier on the product itself, almost always a QR code. It is the mechanism the European Union chose to make product sustainability data travel with the product. The legal engine is the Ecodesign for Sustainable Products Regulation (ESPR), in force since July 2024, which empowers the Commission to require passports product category by product category.
Who has to comply, and when
Two tracks matter. The first is batteries, which got their own regulation ahead of everything else: under EU Regulation 2023/1542, EV batteries, industrial batteries above 2 kWh and light means of transport batteries need a battery passport from 18 February 2027 to be sold in the EU.
The second track is the ESPR working plan, adopted in April 2025, which names the first product groups for delegated acts: textiles and apparel, furniture, mattresses, tyres, and the intermediates iron, steel and aluminium. Each category gets its own delegated act specifying exactly what data its passport must carry, with obligations landing between roughly 2027 and 2030. The ESPR timeline article tracks the dates as they firm up; textiles are widely expected to be the bellwether consumer category.
If you sell into the EU in any of these categories, the question is not whether a passport requirement reaches you but which delegated act carries it and when. Brands outside those categories still feel the pull, because retailers tend to standardize their supplier requirements across categories once the infrastructure exists.
What data goes in a passport
The exact fields are set per category by each delegated act, but the recurring core is consistent: unique product identity, materials and substances of concern, origin and manufacturing information, carbon and environmental footprint, durability and reparability information, and instructions for recycling or end of life. The passport must be accessible to consumers, market surveillance authorities and recyclers, each of whom may see different depths of the data.
How the QR code and the passport connect
The regulation requires a data carrier on the product linking to the passport, and the industry consensus carrier is a QR code holding a GS1 Digital Link. The logic is straightforward: the passport must be findable from the product identity, the identity on retail products is the GTIN, and Digital Link is the standard way to put a GTIN inside a URL. One code then serves checkout, marketing and the passport simultaneously, instead of the pack sprouting a second and third QR.
Mechanically, a scan of the code reaches a resolver, which routes by audience: shoppers see the product page with the passport data presented readably, machines can request the structured form. On Onpack, passport fields (origin, materials, carbon footprint, recycling) are settings on the product and its batches, shown automatically to scans from EU countries, in the shopper's language. The same code shows a California shopper a Prop 65 warning instead, because compliance is jurisdictional and the resolver knows where the scan came from.
What to do now, by situation
You sell batteries in scope: the February 2027 date is fixed and the specification work is public; you should already be in implementation.
You sell textiles, furniture, mattresses or tyres into the EU: your delegated act is being drafted. Put the data carrier question to bed now by printing Digital Link codes on your next artwork cycle, so the passport, when its fields are finalized, becomes a data update rather than a packaging project. The Sunrise checklist doubles as preparation, since it establishes the same code.
Everyone else: watch your category, and treat every reprint as an opportunity to put a future-proof code on the pack for free.
Common questions
Is the Digital Product Passport already mandatory?
For most products, not yet. The framework (ESPR) is in force, and requirements land category by category via delegated acts from roughly 2027 onward. Batteries are the exception: their passport is required from 18 February 2027 under a separate regulation.
Which products are first in line for DPP requirements?
The adopted first ESPR working plan prioritizes textiles and apparel, furniture, mattresses, tyres, and iron, steel and aluminium as intermediates. Batteries run earlier on their own track.
Does the DPP require a specific type of QR code?
The regulation requires a data carrier linking to the passport and is technology-neutral, but industry practice is converging on QR codes carrying GS1 Digital Link, because that reuses the product's existing GTIN identity.
Can a small brand handle DPP without a compliance team?
The data gathering is the real work: origin, materials, footprint. Publishing it is not. On Onpack, passport fields are form fields on the product, served automatically to EU scans from the same QR code, free.