Is the DPP Just a QR Code — or Is There More to It?
Almost everyone, at least once, has scanned with their smartphone the QR code on a bottle of olive oil or a pack of rice at the supermarket. A webpage opens: perhaps there is the company’s story, a few photos of the field, a sustainability claim, or a basic product traceability page. Then you close it and move on.
That’s exactly what the Digital Product Passport (DPP) is not.
Or rather — it may use the exact same black-and-white square, but what lies behind it is something completely different: a regulated digital product information system built around traceability, interoperability, ESG compliance, and lifecycle data management.
The QR Code Is the Doorbell, Not the House
Let’s start with a distinction that may sound technical but is strategic: in the Digital Product Passport regulated under ESPR regulation, the QR code — or NFC tag, or RFID chip — is not the passport. It is the data carrier, the physical-digital bridge that allows access to the passport. It is the doorbell, not the house.
The QR code we see today on products for marketing purposes points to a webpage. That page can contain anything, can change tomorrow, and may disappear the day after. There are no mandatory content requirements, no shared standards, no shared data structures, and no verifiability. It is simply corporate communication in digital form.
The DPP data carrier, instead, points to a persistent unique identifier — a digital identity code that follows that product throughout its entire lifecycle, connected to a structured, regulated information system, where data must comply with open and interoperable standards.
When that code is scanned, you are not opening a generic webpage: you are accessing a repository of verifiable data, with differentiated access levels depending on who is viewing it — consumer, repairer, recycler, customs authority or market surveillance authority.
There is also a technical aspect that few consider: the QR code printed on a product must remain readable and functional for decades. But servers change, domains expire, companies restructure, and IT systems evolve. For this reason, the DPP requires a “resolution” infrastructure that decouples the physical code from the location of the data on the network — ensuring that even twenty years later, when that product reaches a recycling facility or circular economy recovery process, the information is still accessible.
Same Object, Completely Different Responsibilities
There is a real-world example that clearly illustrates the difference between a marketing QR code and one approaching the logic of the Digital Product Passport ecosystem. Pietro Coricelli, an Italian extra virgin olive oil producer, has implemented a system where the QR code on the bottle does not lead to a corporate webpage, but to specific information about that particular batch of oil, with data recorded on blockchain to ensure immutability.
It is not yet ESPR-compliant DPP infrastructure, but it shows the direction: structured, traceable, and tamper-proof data.
And yet, even this solution has a limitation: a printed QR code is easy to copy. A malicious actor can replicate it and place it on a counterfeit product. The consumer scans it, accesses real data, but is actually reading the passport of a different product.
This is why, for products where authenticity, anti-counterfeiting protection, and supply chain verification are critical — luxury goods, pharmaceuticals, industrial components — the trend is toward NFC tags with unique identifiers that are extremely difficult to clone, or hybrid digital traceability solutions that combine multiple technologies.
The point is not which technology to use: the ESPR Regulation is intentionally neutral on this. However, Delegated Acts — category by category — may specify which data carriers are allowed or preferred. Today the choice is broad; tomorrow it may be more constrained than expected.
DPP: What Changes in Practice for Manufacturers
A marketing QR code is something you commission from a communication agency, print, and forget. The DPP data carrier is the entry point to a digital product governance system that requires continuous governance: who updates the data, how often, who is responsible for its data accuracy, and how access is managed across different actors in the value chain.
This means the right question is not “should we use a QR code or NFC?” but rather:
“are we ready to manage the information infrastructure behind it?”
The QR code of a DPP and the one on a pack of rice may look identical. The difference is that one is marketing communication, while the other is a legally relevant declaration, a compliance infrastructure, and a verifiable sustainability data system — and someone is accountable for it throughout the entire lifecycle of the product.
