GS1 Digital Link: the web address that turns a GTIN into a product passport

GS1 Digital Link is GS1's standard for writing GS1 identification keys, such as a Global Trade Item Number (GTIN), as an ordinary web address. A QR code holding such an address can be read at the till as an item number and opened in a phone camera as a web page. That makes it a natural way to address digital product passports for goods that already carry a GTIN.

This article is for those deciding how a brand's product passports should be addressed. It explains what the standard actually says, how the keys for variant, batch and serial number are used, and where GS1 Digital Link fits among the EU's standards for product passports.

What the standard covers

The standard is called GS1 Digital Link Standard: URI Syntax. The latest release, 1.7.0, was ratified in August 2026. It defines what web addresses (HTTP URIs) carrying GS1 identifiers look like, so that software can extract the keys from the address and interpret them. According to GS1, the syntax conforms to the international standard ISO/IEC 18975 on encoding and resolving identifiers over HTTP.

A GS1 Digital Link has three parts:

• A domain, which can be GS1's own or the brand's.
• A path with a primary identification key, such as /01/ followed by a GTIN, and optionally key qualifiers that refine it.
• A query string with data attributes, such as a best-before date, where needed.

A GTIN is always written with 14 digits in the address. Shorter GTINs, such as GTIN-13, are padded with leading zeros. Earlier versions of the syntax allowed shorthand such as "gtin" instead of "01". That has been removed.

The keys in a product passport

For trade items the primary key is the GTIN, with Application Identifier (AI) 01. Three qualifiers can be added, and they must appear in this order:

AI	Name	Used for
01	GTIN	The trade item
22	Consumer Product Variant (CPV)	A variant of the item
10	Batch/lot	A batch
21	Serial number	A single unit

All three qualifiers are optional, but the ones used must come in the order 22, 10, 21. An example from the standard: https://id.gs1.org/01/09520123456788/22/2A is the canonical address for GTIN 9520123456788 with variant 2A. A real item-level product passport can look like this: https://lindex.dpp.dppagent.com/01/07314781685466/21/002, a GTIN and a serial number.

This connects to ESPR. Article 9(2)(d) says the delegated acts shall specify whether the passport is to be established at model, batch or item level. With GS1 Digital Link that is expressed in the path: a GTIN on its own, a GTIN with a batch, or a GTIN with a serial number. Note that a model in the ESPR sense does not always equal one GTIN. A sweater in five sizes often has five GTINs. How the levels are defined for a product group is set by the delegated act, not by GS1's standard.

ModelGTIN on its own

https://brand.example.comdomain, the brand's own/01/09520123456788AI 01 · GTIN, 14 digits

BatchGTIN + batch

…/01/09520123456788/10/AB12AI 10 · batch

ItemGTIN + serial

…/01/09520123456788/21/1001AI 21 · serial number

CPV is a variant code, not a procurement code

Here CPV stands for Consumer Product Variant, AI 22. It has nothing to do with the EU's Common Procurement Vocabulary, which is also abbreviated CPV. Anyone mapping columns in a product data sheet should treat a CPV column as part of the identifier, next to GTIN, batch and serial number.

Your own domain and the canonical form

The standard explicitly allows the address to sit on the brand's own domain, for example https://brand.example.com/01/09520123456788. What makes an address a GS1 Digital Link is the path, not the domain. For cases where a single reference form is needed, the standard defines a canonical address: HTTPS, the domain id.gs1.org, no shorthand, and the GTIN padded to 14 digits. The query parameters linkType and context are not part of the canonical form.

For product passports the brand's own domain is the natural choice, for example dpp.brand.com/01/<GTIN>. The address then belongs to the brand, and any GS1-aware system can still read it.

Resolvers and link types

An address that follows the syntax does not necessarily point to a resolver. The standard says applications shall not assume that it does. A separate standard, the GS1-Conformant Resolver Standard (release 1.2.1, ratified August 2026), describes how a resolver receives a GS1 Digital Link and redirects to the right information. A conformant resolver publishes a description file at /.well-known/gs1resolver.

A resolver can hold several links for the same identifier, each labelled with a link type. The client asks for a given type with the linkType parameter. The whole set, a linkset as defined in RFC 9264, is returned for linkType=linkset or for the Accept header application/linkset+json. If the address has qualifiers, links from every level up to the primary key are included.

GS1 publishes the canonical list of link types. It held 60 types when we fetched it, one of them deprecated. Some that matter for product passports:

• gs1:dpp, a link to a digital product passport.
• gs1:pip, a product information page aimed at consumers.
• gs1:sustainabilityInfo, information on sustainability and recycling.
• gs1:certificationInfo, certification information.
• gs1:instructions, instructions such as assembly guides.

Types such as gs1:materials and gs1:recycleInfo appear on published passport pages but are not in the list. A conformant resolver does not recognise them.

A GTIN is never reused

Under ESPR Article 10(1)(a), a product passport shall be connected to a persistent unique product identifier. GS1's rules support that. Since 1 January 2019, a GTIN assigned to a trade item may not be assigned to another. The exception is GTINs discontinued before 2019, which the older rules allowed to be reused one final time. An item that is withdrawn and later reintroduced without changes keeps its original GTIN, because it is the same item. So /01/<GTIN> points to the same item for as long as the address exists, which an address built on a product name does not.

How it relates to the other standards

ISO/IEC 15459. GS1 is a registered issuing agency under ISO/IEC 15459, holding the issuing agency codes 0 to 9. That is why a GTIN counts as an identifier under the series that Annex III of ESPR and Article 77(3) of the Batteries Regulation refer to. More in the article on ISO/IEC 15459.

EN 18219. The harmonised standard for unique identifiers has five schemes for product identifiers. The first (clause 5.2), a web-enabled structured path, is the route GS1 Digital Link takes: it requires GS1 Application Identifiers or ASC MH10.8.2 Data Identifiers and a registered issuing agency code. For GS1 keys the standard refers to release 1.6.0 of the syntax, from 2022. GS1 Digital Link is therefore one of several accepted routes, not a requirement. See the article on EN 18219.

EN 18220. The data carrier is a separate question from the address. CEN and CENELEC list QR code, Data Matrix, NFC, HF RFID and RAIN RFID as carriers that EN 18220 deals with. A GS1 Digital Link can sit in a QR code or a Data Matrix, or be written to an NFC tag. See the article on EN 18220.

EN IEC 61406. The Identification Link is a self-issuing alternative that needs no issuing agency. See the article on IEC 61406.

The whole family is described in DPP standards: an overview.

Common misunderstandings

"GS1 Digital Link is a QR code"

No. GS1 Digital Link is an address syntax. The QR code is one of several data carriers that can hold the address.

"The address has to be on id.gs1.org"

No. The brand's own domain is valid. The canonical form on id.gs1.org is a reference form, not a rule about where the passport must live.

"The law requires GS1"

Neither ESPR nor EN 18219 requires GS1. ESPR names the GTIN as information that can be included in the passport, and EN 18219 accepts five identification schemes.

"A GTIN can be reused after a few years"

The old reuse rule was abolished on 1 January 2019. A GTIN in use then, or assigned since, is not given to another item.

How this looks in practice

DPP Agent, built by Blippa, addresses each passport as a GS1 Digital Link when the brand has a valid GTIN, with the check digit tested. The address sits on the brand's own domain, and the same address returns a readable page on a phone or machine-readable JSON, depending on what the caller asks for. The resolver writes only link types that exist in GS1's list and translates older spellings into the canonical ones, such as gs1:dpp and gs1:sustainabilityInfo.