What Is a Digital Product Passport (DPP)?

A Digital Product Passport (DPP) is a set of product-specific data (identity, materials, compliance documents, the responsible economic operator) made accessible electronically through a data carrier on the product, usually a QR code. In the EU, its legal basis is the Ecodesign for Sustainable Products Regulation (ESPR). For any given product group, the obligation arises only once that group’s delegated act applies.

Where the obligation comes from: the ESPR

The DPP arrives through a regulation, not a directive: Regulation (EU) 2024/1781 on ecodesign for sustainable products. It was adopted on June 13, 2024, published in the Official Journal on June 28, 2024, and entered into force on July 18, 2024. As a regulation, it is directly applicable in every Member State with no national transposition, so a company selling across the single market faces one rulebook rather than twenty-seven national variants.

The ESPR, however, does not by itself require a passport for any product; it sets up a framework. Which product groups need a passport, what data goes into it, whether it is kept at model, batch or item level, and which actors may access which data are all left to delegated acts the Commission adopts product group by product group (Articles 4, 8 and 9). Article 9(1) states the core rule: where a delegated act imposes a DPP requirement, a product may be placed on the market only if a passport is available.

A delegated act cannot apply earlier than 18 months after its own entry into force, except in duly justified cases (Article 4). The real compliance date for any product group therefore runs forward from the adoption of its delegated act, not from the ESPR itself.

What data a passport contains

Annex III of the ESPR lists the types of information a passport may hold; the delegated act for each product group decides which become mandatory. The Annex III categories group into:

• Identity: a unique product identifier; the Global Trade Item Number (GTIN) under ISO/IEC 15459-6 or equivalent; relevant commodity codes such as TARIC.
• Product information: information required under Article 7 by the delegated act, such as environmental performance and substances of concern, depending on the product group.
• Compliance documentation: the EU declaration of conformity, technical documentation or conformity certificates.
• Use information: user manuals, instructions, warnings and safety information.
• Operators and facilities: manufacturer information and unique operator identifier, other operator identifiers, unique facility identifiers.
• Importer and responsible operator: importer information including the EORI number; name and contact details of the responsible economic operator.
• Back-up: a reference to the DPP service provider holding the back-up copy.

There is no separate heading called “supply chain.” The chain enters the passport through facility identifiers and compliance documents, and the evidence behind those documents usually sits with the supplier rather than with the operator placing the product on the market. A sample passport shows how these data groups look on a textile product; it is built on fictional data.

Data carrier: QR codes and GS1 Digital Link

The regulation keeps two concepts apart. The passport is a data set; the data carrier is the medium that leads to it: a linear barcode, a two-dimensional symbol or another automatic identification medium a device can read (Article 2). A QR code is not the passport. Labels can change, while the passport lives on through the product’s persistent identifier.

The delegated act specifies which carrier is used, where it sits on the product and how it is presented (Article 9(2)). The ESPR requires carriers and identifiers to rest on open, interoperable standards. GS1 Digital Link is a widely used answer: it turns a GTIN into a web address, so one QR code can serve both retail and passport access. Still, the ESPR does not mandate GS1 by name, and Annex III refers to the GTIN “or equivalent.” The Commission’s DPP timeline schedules an implementing decision on six DPP standards for July 2026; which standards become mandatory for a given product group will be settled in the delegated acts.

Persistence is secured by the back-up rule: when placing a product on the market, the economic operator must make a back-up copy of the passport available through an independent DPP service provider (Article 10(4)).

Which product groups, and when

The Commission adopted the first working plan required by Article 18 on April 16, 2025 (COM(2025) 187). The years in the plan are indicative dates for adopting delegated acts; application follows at least 18 months later. The Commission’s own DPP pages state that timelines may evolve.

Footwear is not in the first plan; the Commission has scheduled a study to be completed by the end of 2027. On the infrastructure side, two dates are fixed. Article 13 required the DPP registry by July 19, 2026, and according to the Commission’s timeline it became operational on July 20, 2026. Article 25 of the same regulation bans the destruction of unsold apparel and footwear for large enterprises from July 19, 2026, and for medium-sized enterprises from July 19, 2030. That ban is a separate obligation from the DPP, but it reaches the textile chain from the same source.

For textiles, “2027” is not a compliance date but the earliest adoption date for the delegated act; the passport becomes a legal requirement at least 18 months after that.

Who carries the obligation

The ESPR attaches obligations to the economic operator placing the product on the EU market:

• Manufacturer (Article 27): ensures the passport is available in line with Article 9 and the delegated act, with a back-up copy stored by a DPP service provider.
• Importer (Article 29): verifies the same before placing the product on the market, and is the first EU link in the chain for products made outside the Union.
• Authorized representative (Article 28): carries out the tasks specified in the manufacturer’s written mandate.
• Own-brand sellers (Article 34): an importer or distributor placing a product on the market under its own name or trademark, or modifying it in a way that affects compliance, is treated as the manufacturer.
• Supply chain actors (Article 38): where the delegated act so specifies, they must provide manufacturers, notified bodies and competent national authorities, on request and free of charge, with available information on what they supply, and enable authorities to verify its accuracy.

Read this way, the DPP is less a prohibition than an allocation of the burden of proof. The burden starts with whoever places the product on the market, but Article 38 lets it reach upstream to where the data is actually produced. For which product groups that extension will apply remains unknown until the delegated acts are adopted.

The trade secret problem: compliance without disclosure

A passport demands transparency, while supplier lists, facility data and full material recipes are among a company’s most sensitive assets. The regulation acknowledges the tension. When preparing ecodesign requirements, the Commission must take into account the protection of confidential business information (Article 5(10)(d)). Access rights are defined per actor: consumers, repairers, recyclers, market surveillance authorities and customs need not see the same data. Nor is the data handed to a central EU database; it is stored by the economic operator or a DPP service provider (Article 11), while the registry holds at least the unique identifiers (Article 13).

Compliance is not the same as disclosure. Geopedi’s thesis follows from that: record the data once, then split it into access tiers. A public tier shows what the consumer needs to see; an authorized tier opens to auditors and authorities; an evidence tier is verified only on request, and only for the party requesting it. The burden of proof is met without handing a supplier map to competitors. Texprove builds its textile passport on this architecture. Because the delegated acts will decide which data falls into which tier, those tiers have to be configurable rather than fixed.

What changes for non-EU suppliers

The ESPR places no direct obligation on a manufacturer outside the EU; the obligation rests with whoever places the product on the EU market. In practice, it reaches non-EU suppliers through three channels:

• Buyer data requests: an EU brand or importer cannot complete a passport from its own records. The duty Article 38 can impose on supply chain actors will surface as data clauses in supply contracts.
• Customs: to release a product for free circulation, the product’s unique registration identifier is provided to customs, which verify that the identifier and commodity code match the registry (Article 15).
• Market access: a product without a compliant passport cannot be placed on the market, so the first sanction is lost access rather than a fine.

At the moment a customs declaration for release for free circulation is lodged, a mismatch between the identifier and the registry keeps the product out of the EU market, and most of the data behind that identifier originates in the supplier’s own production records.

Food falls outside the ESPR (Article 1(2)). For food and products with geographical indications, origin and traceability demands come from other legislation and directly from buyers; that area is covered on the Origin page, and its export side in the export power of geographical indication products.

DPP readiness checklist

1. Locate the product group in the working plan, note its indicative date, and track the draft delegated act from the day it is published.
2. Decide which identification level (model, batch or item) current production records can actually support, and review GTIN infrastructure.
3. Map Annex III data groups against existing records and list the gaps: material composition, facility data, conformity documents.
4. Turn supplier declarations into evidence: certificates, test reports, batch-level records.
5. Split data into access tiers now: public, authorized, evidence.
6. Add data-sharing, liability and confidentiality clauses to buyer and supplier contracts.
7. Make sure the address behind the QR code will not change during the product’s lifetime, and decide where the back-up copy will be held.

Frequently asked questions

Is the digital product passport mandatory today?

No ESPR product group has a confirmed application date yet; the first delegated act, for iron and steel, is targeted for Q4 2026. The battery passport, which rests on a separate regulation, becomes mandatory for certain batteries on February 18, 2027.

When will the DPP be mandatory for textiles?

The indicative date for the delegated act is 2027, and application begins at least 18 months after adoption. The compliance date has not been set.

Is putting a QR code on the product enough?

No; the QR code is only the data carrier. The obligation covers the data behind it, which must be accurate, complete and up to date, plus a back-up copy held by a DPP service provider.

Are food products covered by the DPP?

No; the ESPR excludes food, feed, and living plants and animals (Article 1(2)). Traceability obligations for food arise from other legislation.

Where is passport data stored?

With the economic operator or a DPP service provider. The Commission’s registry holds at least the unique identifiers, not the full content. More answers are on the FAQ page.

When preparation should start

Once a delegated act is published, there are at least 18 months before it applies; but when much of the data comes from suppliers, most of that window goes into building supplier records. For textiles, the real starting point is therefore not the adoption of the act but the moment the draft becomes public. The Texprove page explains how a textile passport is built on access tiers, and a working example is available in the sample passport; see subscription for scope and pricing, and contact for an assessment of your product group.