DPP Data Carriers: QR Code, Data Matrix, NFC or RFID?

Short answer: the EU Digital Product Passport (DPP) must be reachable through a data carrier linked to a persistent unique product identifier, placed on the product, its packaging or its accompanying documentation, as your product group's delegated act specifies (ESPR, Regulation (EU) 2024/1781, Art. 10(1)). Today the safe baseline is a 2D code: a QR code or a Data Matrix. NFC and RFID are add-ons, not replacements. Batteries are the only group where the law already names the carrier: a QR code, from 18 February 2027.

Below: what is fixed and what is still open, the standards published in 2026, three tables we built from the primary sources, and a checklist. Status as of 1 November 2026.

What the law fixes, and what it leaves to delegated acts

ESPR Art. 2 defines a data carrier as "a linear barcode symbol, a two-dimensional symbol or other automatic identification data capture medium that can be read by a device". The unique product identifier is "a unique string of characters for the identification of a product that also enables a web link to the digital product passport". Art. 10(1) then requires that the carrier and identifier comply with the ISO/IEC 15459 series listed in Annex III, or equivalent standards, until harmonised standards are cited.

Everything else is decided per product group. Under Art. 9(2), each delegated act sets the carrier(s), its layout and position, and whether the passport is per model, batch or item. The Commission's DPP page gives an indicative timeline: iron and steel around Q4 2026; textiles, aluminium and tyres around Q3–Q4 2027, with at least 18 months before each act applies. The same indicative timeline puts furniture around 2028 and mattresses around 2029; both are also working-plan priorities. One rule will apply to every product group once its act applies: on request, you must give dealers and online marketplaces a digital copy of the data carrier or identifier, free of charge, within five working days (Art. 10(3)).

The standards that now exist

CEN-CENELEC JTC 24 has published eight DPP standards. According to its catalogue, EN 18216, EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221, EN 18222 and EN 18223 came out on 27 May 2026, and EN 18239 (access rights and security) and EN 18246 (data authentication, reliability and integrity) followed on 16 September 2026. CEN-CENELEC says six of the eight are cited in the Official Journal, which gives a presumption of conformity; the Commission lists a decision for the remaining two. EN 18220 is paywalled, so we make no claim here about what it permits beyond its title.

GS1's provisional DPP standard in plain terms

GS1's provisional DPP application standard (GSCN 26-226, June 2026) is explicit that it is "NOT a ratified GS1 standard" and "subject to change". Within the GS1 system:

• Identifier: the GTIN, "possibly in conjunction with a product version, batch/lot or serial number". The delegated act decides the minimum granularity. Operators and facilities get a GLN.
• Carrier: QR Code or Data Matrix, both with GS1 Digital Link URI syntax (uncompressed).
• EPC/RFID: "SHALL be in addition to QR Code or Data Matrix", carrying the same serial number without adding or dropping leading zeros.
• NFC: "MAY be used in addition to the 2D barcode" and "cannot be proposed as a potential replacement for 2D as it is inappropriate for use in the open supply chain".

GS1's support FAQ adds that any ISO-standardised carrier qualifies under ESPR's general rules, pending the delegated acts.

Batteries: the one settled case

The Battery Regulation (EU) 2023/1542 is precise. From 18 February 2027 (unchanged as of 1 November 2026), "all batteries shall be marked with a QR code" (Art. 13(6)), printed or engraved on the battery, or on the packaging and documents where it doesn't fit (Art. 13(7)). LMT batteries, industrial batteries above 2 kWh and EV batteries also need a battery passport reached through that QR code (Art. 77), holding data for the individual battery. The law requires an ISO/IEC 15459 identifier; GTIN plus serial number is GS1's recommendation, not the law's. NFC or RFID would need a separate delegated act on "alternative types of smart labels" (Art. 13(8)).

Worked example 1: the four carriers compared

Sources: GS1 GSCN 26-226 (status, Data Matrix shape); NXP NTAG 424 DNA (NFC interface, cryptography). The copy column is our own reasoning.

Worked example 2: which carrier for which product

Worked example 3: how much label space does it take?

We encoded sample GS1 Digital Link URIs with two QR libraries (segno and rqrcode, error correction level M) and a Data Matrix ECC 200 encoder, then applied GS1 symbol specification table 1, addendum 2, which covers items scanned at retail point of sale: X-dimension (module size) of 0.396 mm minimum, 0.495 mm target and 0.990 mm maximum, and a quiet zone of 4X on each side for QR and 1X for Data Matrix. The formula is: printed width = (modules + 2 × quiet zone) × X.

For the serialised URI https://id.example.com/01/09506000134352/21/A1B2C3 (50 characters, GS1's example GTIN): the QR code is version 4, 33 × 33 modules, so 33 + 8 = 41X. At the target X, 41 × 0.495 = 20.3 mm square. The Data Matrix needs 41 codewords, more than the 36 a 24 × 24 symbol holds, so it is 26 × 26: (26 + 2) × 0.495 = 13.9 mm.

Retail POS is not the only case. The same GS1 document sets larger modules for items scanned in general distribution (table 3, POS plus distribution: X 0.743 to 0.990 mm), so the serialised QR code becomes 41 × 0.743 = 30.5 mm to 41 × 0.990 = 40.6 mm, and the 26 × 26 Data Matrix 20.8 to 27.7 mm. For direct part marking (table 7, target X 0.300 mm) it shrinks to about 12.3 mm for the QR code and 8.4 mm for the Data Matrix. Batteries, steel parts and most B2B goods fall in these tables, not the retail one.

Three takeaways. For a retail-POS item, reserve about 20 mm square for a serialised QR code at GS1's target X, and 1.5 to 2 times that if the item is scanned in distribution. The quiet zone is 8 of the 41 modules, so cutting it to save space is a common reason codes fail to scan. And with a lot number in the URI, no rectangular Data Matrix fits (the largest, 16 × 48, holds 49 codewords), so a small part with a batch and a serial in its URI needs a square symbol.

A QR code identifies a product. It doesn't authenticate it

A printed code can be photographed and reprinted on a fake, which then resolves to the genuine passport. Two things help. A server-side record per item can show when and where a code was scanned or who owns the item, so the same serial on two continents stands out. For high-value goods, a cryptographic NFC tag such as NXP's NTAG 424 DNA produces a new AES-128 "SUN" message on every tap, which a server can check. The trade-offs are in our B2B anti-counterfeiting playbook and in code lookup vs blockchain verification.

Where RivetChain fits

Every product you register in RivetChain gets a unique ID and a QR code that opens its public verification page, and you can create products and events through the REST API. That QR code encodes our verification URL; it is not a GS1 Digital Link URI, and we don't assign GTINs. Our URL is 66 characters, which gives QR version 5-M (22.3 mm at GS1's retail-POS target X with a 4X quiet zone). Our PNG export uses a 2-module border, so leave extra white space when you print. NFC or RFID tags can carry the same URL if your tag supplier encodes them, or through an external integration on top of our API. Blockchain anchoring on Solana is opt-in per product or series (off by default) and runs in hourly Merkle batches with an IPFS copy; see the technology page. We have no EU registry connection and make no conformity claim for EN 18220 or the GS1 standard.

Checklist

Now

1. Pick an identifier scheme (GTIN with batch or serial, or another ISO/IEC 15459 issuer).
2. For retail-POS items, reserve about 20 × 20 mm for a QR code or 14 × 14 mm for a Data Matrix on the label or packaging; plan for 30–41 mm (QR) or 21–28 mm (Data Matrix) if the item is scanned in distribution.
3. Host the resolver URL on a domain you will keep for the product's whole lifetime.
4. Don't buy NFC or RFID chips for the DPP before your delegated act says what it requires.

When your group's act lands

5. Read its carrier, layout and granularity (model, batch or item) clauses.
6. Check placement: product, packaging or documentation.
7. Print test codes at the minimum X and scan them with ordinary phones.

For dates and the data you'll need, see our DPP timeline and checklist, the EU DPP overview, the manufacturers use case or, for Shopify sellers, the DPP on Shopify.

FAQ

Is a QR code enough for the DPP?

For batteries, yes: it is what the law requires. For other groups it is the safest baseline, but the delegated act has the final word.

Do I need NFC?

No law requires it today. GS1 allows it only in addition to a 2D code.

Can RFID replace the QR code?

Not under GS1's provisional standard: EPC/RFID "SHALL be in addition to QR Code or Data Matrix".

Does the carrier have to be on the product itself?

No. ESPR allows the product, its packaging or accompanying documentation, as the delegated act specifies. For batteries, it goes on the battery unless it doesn't fit.

Do I need a GTIN?

ESPR requires an ISO/IEC 15459 identifier; Annex III lists the GTIN as one option. If you use GS1's DPP standard, the GTIN is its identifier.

General information, not legal advice. Print sizes are our own calculations from GS1's symbol table; verify against your printer and the delegated act for your product group.