At every industry conference in 2025 and 2026, vendors have been claiming Digital Product Passport capability. Most of what they are claiming is a QR code generator linked to a product page. Some are linking to a PDF. Some are linking to a brand’s sustainability section. None of these is a digital product passport in the regulatory sense. They are QR codes pointing to content that happens to live online. The distinction is not technical pedantry. It is the difference between a delivery mechanism and the thing being delivered.
The clearest formulation of this distinction comes from practitioners working directly on DPP compliance: the QR code is the last 2% of what a Digital Product Passport actually is. The QR code is how someone accesses the DPP. The DPP is the structured product record behind it. A QR code linking to a PDF brochure is not a DPP. A QR code linking to a marketing page is not a DPP. The QR code is the easy part. The data infrastructure behind it is the compliance requirement.
This matters now because the EU DPP Registry went live on 19 July 2026, creating the centralised index of unique product identifiers required under ESPR Article 13. The registry’s existence does not mean fashion brands must issue DPPs immediately; the textile delegated act that defines the specific data fields for fashion is planned for Q3 to Q4 2027. What it does mean is that the DPP infrastructure is no longer a future regulatory concept. The registry is live. Brands issuing product identifiers today can register them. Brands using a QR code on a hang tag as their DPP strategy are building on the wrong foundation.
A QR code linking to a marketing page is not a Digital Product Passport. This analysis explains what a fashion DPP must include, the role of the QR code, and the difference between a carrier and a passport for brands preparing for F7 compliance.
What a Digital Product Passport Actually Is
The structured record, not the access mechanism
A digital product passport is a structured digital record that travels with a product. The word ‘structured’ carries specific technical meaning in this context. A structured record is one whose data is organised in a defined schema that machines can read, query and process without human interpretation. A JSON-LD file whose fields are named according to a schema and whose values are in formats that allow automated processing is a structured record. A PDF document containing the same information is not: a machine cannot reliably extract ‘cotton: 60%, polyester: 40%’ from a PDF and use it in an automated sorting system without human intervention.
The ESPR’s data infrastructure standards specify that the DPP be built on GS1 Digital Link and JSON-LD so data is usable by machines, apps, and search engines. GS1 Digital Link is the globally standardised URL-based format that embeds a product’s unique identifier and links to structured product data. The format is designed for interoperability: a recycling facility’s automated sorting system, a customs authority’s import inspection system and a consumer’s mobile phone scanning the garment’s QR code can all access the same underlying structured data and use it for their respective purposes, because the data is structured to be machine-readable rather than human-readable only.
The DPP also requires the data to be dynamic: updated throughout the product’s lifecycle rather than fixed at the point of issue. A static QR code points to a fixed URL; if the brand updates the product record, the static QR code still points to the original record. A dynamic QR code points to a URL that resolves to the current version of the product record, which the brand can update as the product’s status changes from manufactured to sold to repaired to returned. ESPR Article 10 requires the data carrier to use open, interoperable formats without vendor lock-in, which the dynamic QR code satisfies in ways the static QR code does not.
What the passport must contain
On 13 May 2026, the Joint Research Centre published its Science for Policy report providing the first complete specification of DPP content for textile apparel under ESPR. The report identified 49 data points that every textile product will need to carry. These 49 data points are the JRC’s technical groundwork for the textile delegated act; they represent the most detailed available preview of what the binding legal text will require when the textile delegated act is adopted in 2027, but they are not yet the delegated act itself.
The data points span four functional areas. The first covers product identity and physical connection: the unique product identifier, the carrier technology (QR code, NFC, RFID), the product name and model, the batch or production run identifier, and the link between the physical product and its digital record. The second covers communication and APIs: the standardised interfaces through which the DPP’s data is exchanged between systems, including the brand’s own system, the EU registry and third-party operators such as recycling facilities and resale platforms. The third covers architecture and data continuity: the long-term storage requirements that ensure the DPP remains accessible throughout the product’s lifecycle and does not become unreachable if the brand changes its technology infrastructure. The fourth covers security and trust: role-based access rights that determine which data fields are visible to which parties (some fields are public; some are accessible only to regulators or authorised operators), digital authentication mechanisms, and integrity verification that prevents retrospective alteration of a product’s record.
In practical terms, a real DPP for a fashion garment contains roughly 25 to 35 structured data fields. The minimum fields for Phase 1 textile compliance, based on consultation documents and the JRC report, cover fibre composition by percentage, country of manufacture, chemical compliance status, sustainability certifications and recycling route guidance. Phase 2, expected between 2027 and 2028, adds carbon footprint and water consumption data. A brand issuing a DPP that contains only fibre composition and origin has built the beginning of a compliant record. A brand issuing a QR code that links to a page describing its sustainability commitment has built a marketing asset whose relationship to the DPP requirement is cosmetic.
The Gap Between What Brands Have and What the DPP Requires
From internal files and PDFs to structured, verified data
The key shift DPP compliance requires is moving from PDFs and internal files to structured, digital data. Most fashion brands store product data in the formats that serve the production process: Excel spreadsheets for BOMs and specifications, PDF tech packs for factory communication, and internal databases for costing and sourcing. None of these formats is structured in the sense the DPP requires. They are structured for human reading and internal processing, not for machine-readable exchange across multiple systems and stakeholders with different access requirements.
The data extraction challenge is significant. A brand that holds its fibre composition data in an Excel spreadsheet whose columns are not standardised across its product range, whose values use inconsistent abbreviations for fibre names and whose historical records differ in format from its current records has a data transformation problem whose resolution requires either manual data cleaning at scale or automated transformation tools whose outputs must be verified for accuracy. The transformation is not technically complex in concept; it is operationally significant in volume for brands with large product ranges and accumulated historical records whose formats have not been standardised.
The supply chain data depth problem
The DPP data requirement does not stop at the brand’s own records. ESPR’s framework for what the DPP must carry includes production information that comes from the supply chain rather than from the brand’s own files: country of manufacture, which requires confirmation from the Tier 1 factory; chemical treatments applied at finishing, which may require confirmation from a Tier 2 chemical supplier; and recycled content certification, which requires documentation from the fibre mill. The brand’s own product record may hold some of this data. Verified, structured versions of this data that meet the DPP’s accuracy requirements require engagement across multiple supply chain tiers.
This is where the QR code strategy’s gap becomes most visible. A brand that has printed a QR code on its hang tag linking to its sustainability page has not engaged its Tier 2 or Tier 3 suppliers to provide the verified composition and treatment data the DPP will require. It has created a consumer communication asset whose data depth is the brand’s own marketing claims. The DPP’s data, by contrast, must be verified: the record’s accuracy is a compliance requirement, not a marketing claim, and verification must trace back to the data source, not a brand’s claim.
The QR code is the consumer-facing part. The data infrastructure is the compliance requirement. A brand that has printed a QR code on its hang tag and called it a DPP has completed the visible part of the task and left the consequential part undone.
What the EU DPP Registry’s Launch in July 2026 Means
The EU DPP Registry, which went live on 19 July 2026 under ESPR Article 13, is a centralised index of unique product identifiers. It is not a database of DPP content. It does not hold passport data. It holds the unique identifiers assigned to products, linked to the location where the product’s DPP data can be found. The registry’s function is to make product identifiers discoverable across the EU’s product data ecosystem: a customs authority checking an imported garment can look up the product’s identifier in the registry and follow the link to the brand’s DPP record.
The registry’s existence confirms that the DPP infrastructure is now operational in the EU. Brands can now register their product identifiers for the EU market. The textile delegated act that makes DPP issuance mandatory for fashion products is still planned for Q3 to Q4 2027, with mandatory compliance expected from mid to late 2028 for large enterprises. The registry’s July 2026 launch does not create an immediate compliance deadline for fashion brands whose product category has not yet received its delegated act. It does create an operational infrastructure against which brands can test their product identifier and data systems before the mandatory deadline arrives.
What a Compliant DPP Looks Like in Practice
A compliant fashion DPP for the first mandatory compliance wave consists of a physical carrier (a QR code, NFC tag or RFID chip) physically present on the garment, its hang tag or its packaging; a unique product identifier that meets the GS1 Digital Link standard and is registered in the EU DPP Registry; a structured digital record accessible via the carrier that contains the required data fields in a machine-readable format (JSON-LD aligned with Schema.org or an equivalent standardised schema); verified data for each required field, traceable to its source in the supply chain; role-based access controls that make public fields accessible to consumers scanning the QR code, regulatory fields accessible to authorised authorities and supply chain fields accessible to operators with a legitimate need; and a dynamic record that can be updated as the product moves through its lifecycle from manufacture to sale to repair to resale to recycling.
What this means: scanning the QR code on a garment’s hang tag opens a product page that shows fibre composition, country of manufacture, care instructions, recyclability guidance, and sustainability certifications. This part looks like what many brands are already producing. What it looks like: Tong facility’s automated sorting system, a machine that produces a readable data feed confirming the garment is 60% cotton, 40% polyester, free of specific chemical treatments that would contaminate the recycling stream, and processed through the brand’s take-back scheme. This part is what most brands are not yet producing.
Building the Passport Rather Than the QR Code
As Omiren Styles has established, in its analysis of what an operator must know before a garment can be resold or recycled, the information gap at the end-of-life stage is real and consequential: recyclers need exact fibre composition and chemical treatment data; resale operators need condition history and original specifications; repair technicians need construction details and trim specifications. The DPP is the regulatory mechanism designed to close this gap by making product-level data portable and persistent across the garment’s lifecycle. A QR code pointing to a marketing page does not close this gap. It adds a digital access point to information that was already publicly available in marketing form and that the operators who need accurate, verified, structured data cannot use for their operational decisions.
The practical implication for fashion brands preparing for 2027 is that DPP’s work is data work before it is technology work. Generating QR codes is free and takes minutes. Identifying every product in the brand’s range, establishing and verifying the fibre composition for each, tracing the country of manufacture for each, documenting the chemical treatments applied at finishing for each, and organising all of this data in a format that meets the structured schema requirements takes months. It requires an engagement that most brands have not yet initiated.
As Omiren Styles has established, in its analysis of the EU DPP framework and the textile delegated act timeline, the preparation window between now and the 2027 delegated act adoption is the period for building the data infrastructure rather than waiting for the binding requirements to be confirmed. A brand that starts building its structured product data now arrives at the 2028 mandatory compliance date with a compliance capability. A brand that prints QR codes on its hang tags now and waits for the delegated act before building the data behind them arrives at the same date, having already completed the easy 2% and still needing to complete the consequential 98%.
The Omiren Argument
The confusion between a QR code and a digital product passport is not accidental. It is the product of an industry that moves on aesthetics and has found that the QR code’s visible presence on the hang tag and its scannable interface are the parts of the DPP story that fashion media and brand communications have most readily adopted. The QR code is the part of the DPP story that looks like something. The data behind it is the part that’s the thing.
For independent fashion brands, particularly those from the Global South whose production is in markets with less developed data infrastructure, the DPP represents a compliance challenge whose difficulty is not the QR code. The QR code is available from any number of free generators. The difficulty is the verified, structured, supply-chain-sourced data that the QR code is supposed to provide access to. Building that data requires supply chain relationships that go deeper than the Tier 1 factory, documentation practices that have not previously been required and data management infrastructure that most independent brands have not needed to build.
As Omiren Styles has argued throughout its coverage of material intelligence and the Global South, the Global South made fashion and never got credit. The DPP’s data requirements create an opportunity: a brand that can produce a verified, structured product record that traces its fibre origin, country of manufacture, and supply conditions to documented sources has built the evidence base buyers and consumers have been asking for in informal terms for years. The DPP does not create that evidence requirement. It formalises one that already exists and makes non-compliance visible in regulatory terms rather than merely reputational ones. The QR code is on the hang tag. The passport is in the data. The work is building the passport.
WHAT A COMPLIANT DPP REQUIRES VS WHAT A QR CODE ALONE PROVIDES
A QR code alone provides:
- A scannable access point to whatever digital content the brand has linked to it.
- Consumer-facing product information if the linked page is well-maintained.
- A visual signal that the brand is engaged with digital product communication.
A compliant DPP additionally requires:
- A unique product identifier registered in the EU DPP Registry under ESPR Article 13.
- A structured digital record in a machine-readable format (JSON-LD / GS1 Digital Link) behind the QR code.
- Verified data for required fields, traceable to supply chain sources, not brand assertions.
- Dynamic updating: the record changes as the product’s status changes through its lifecycle.
- Role-based access: different data visible to consumers, operators and regulators.
- Data depth beyond Tier 1: fibre mill certification, chemical treatment records from finishing.
ALSO READ
- Digital Product Passports for Fashion: The EU Framework Exists. Textile Rules Do Not Yet.
- Before a Garment Can Be Resold or Recycled, What Must an Operator Know?
- A Fabric Provenance Claim, Field by Field: What a Buyer Should Ask to See
- The Global South Made Fashion. It Just Never Got Credit.
EXPLORE MORE
Read the full Regulatory Intelligence and Material Intelligence coverage at Omiren Styles for ongoing analysis of digital product passport compliance, supply chain data standards and the regulatory infrastructure reshaping fashion. Discover travel and heritage intelligence across Africa, the Caribbean and Latin America at Rex Clarke Adventures.
