DPP Agent docs

EN 18216 — Digital Product Passport identifier and data carrier

EN 18216 is the first practical decision every brand implementing a Digital Product Passport has to make. It answers: how does a physical product point to its passport, and how does a scanner — consumer, regulator, recycler — get from that pointer to the URL where the data lives?

The standard is deliberately narrow. It does not specify what data the passport contains (that is EN 18223) or how the resolver behaves once the URL is requested (that is EN 18219). It specifies two things: the identifier that goes on the product, and the physical carrier that encodes the identifier.

What EN 18216 requires

Three technical requirements sit at the core of the standard.

1. The identifier is a URI, not an opaque token

Every passport is addressed by a URI. The URI must resolve using standard HTTP over TLS 1.2 or higher, and it must be human-readable enough that a printed version is usable if a scanner fails. This rules out proprietary tag formats, closed-loop numeric identifiers, and blockchain hashes as the primary identifier — those may sit inside the passport data, but they cannot be what the label carries.

The URI is required to follow the GS1 Digital Link structure. In practice, this means:

https://<resolver-host>/01/{GTIN}/22/{CPV}/10/{BATCH}/21/{SERIAL}
  • <resolver-host> — the domain that operates the EN 18219 resolver for this brand. Either the brand's own subdomain (e.g. dpp.brand.com) or a shared platform host (e.g. brand.dpp.dppagent.com).
  • /01/{GTIN} — GS1 Application Identifier 01 (Global Trade Item Number). GTIN-13 or GTIN-14 padded to 14 digits with a leading zero. Mandatory.
  • /22/{CPV} — GS1 AI 22 (Consumer Product Variant). Optional but strongly encouraged for anything with variants (colour, size). Note: in the DPP context this is Consumer Product Variant, not the EU procurement code with the same acronym.
  • /10/{BATCH} — GS1 AI 10 (batch or lot number). Required for regulatory categories that mandate lot traceability (batteries, cosmetics, foodstuffs).
  • /21/{SERIAL} — GS1 AI 21 (serial number). Required for item-level DPPs (individual batteries, PPE, high-value goods).

2. The data carrier is a scan-first symbol

EN 18216 mandates that the identifier be encoded in a two-dimensional data carrier that survives at least the expected lifetime of the product. In practice this means one of:

  • GS1 QR Code — the recommended default. Wide reader compatibility. Print reliably from 15 mm at the minimum quiet zone.
  • GS1 Data Matrix — better for small marking on batteries, tyres, PPE. Standard for medical-device UDI, so infrastructure exists.
  • GS1 DotCode — for direct-part marking on metal or plastic where laser or dot-peen is the only option (industrial equipment).

RFID (EPC UHF Gen2) is optional and must never be the only carrier — the standard explicitly requires an optical fallback because consumers do not carry RFID readers. If a brand deploys RFID, the tag encodes the same GS1 Digital Link URI so a warehouse or repair-shop reader gets the same identifier as a consumer with a phone.

3. Error-correction and print quality are testable

The identifier must survive real-world abuse: crumpled hangtags, scratched labels, faded print, laundry cycles. EN 18216 defers to the ISO/IEC 18004 (QR) and ISO/IEC 16022 (Data Matrix) print-quality grades. The minimum acceptable grade is:

  • Grade B (1.5) for care labels, hangtags, and any surface subject to abrasion or moisture
  • Grade C (1.0) for interior labels and printed manuals

Below Grade C the standard treats the carrier as non-conformant. Brands using DPP Agent's label templates hit Grade B by default at 300 DPI; direct-thermal printers below 203 DPI need larger modules to compensate.

Common mistakes

Three implementation errors show up in nearly every early-stage DPP project.

Using a shortened URL as the identifier. The bit.ly/xyz or brand's own /p/xyz URLs are attractive for humans but they violate the standard — the URL must be a GS1 Digital Link, not a redirect target. Shortened URLs also break the machine-readability requirement in EN 18219 because they need a round-trip to resolve.

Skipping the CPV for variants. A textile brand puts the same GTIN on Small, Medium and Large versions of the same shirt and expects the resolver to figure it out from context. The resolver cannot — it needs the CPV in the URL to serve the correct size-specific care instructions or fibre composition.

Printing at insufficient resolution. The 200 DPI point-of-sale printers many brands already own do not produce Grade B carriers at the module sizes needed for a 25 mm hangtag. Either upgrade the printer or use a larger tag. Do not simply ignore the grade requirement; import controls at EU borders will scan for grade compliance.

How DPP Agent implements EN 18216

The identifier work happens in three places in the platform:

  1. DPP creation — when a brand creates a DPP through the admin, Studio v2 or a PIM sync, the platform validates the GTIN, generates the URI, and refuses to save if a required application identifier is missing for the product category. Battery-category DPPs cannot be saved without a batch number (/10/). PPE cannot be saved without a serial (/21/).

  2. Label design — the QR designer emits GS1-compliant QR codes at Grade B or better by default. Label templates for care labels, hangtags, tyre sidewalls and battery casings are pre-scaled to the appropriate module sizes for each surface.

  3. Multi-tenant resolver — dpp.brand.com/01/{GTIN}/... is served by DPP Agent's edge resolver, but the URL structure is entirely brand-owned. If the brand later migrates off the platform, the URLs continue to work because they are addressed to the brand's own DNS.

Practical checklist

  • Every product SKU has a valid GTIN registered in GS1
  • Consumer Product Variant is used for size, colour or configuration variants
  • Batch number is populated for regulated categories (batteries, cosmetics, food, chemicals)
  • Serial number is populated for item-level DPPs (individual batteries, PPE, high-value goods)
  • Print quality is verified at Grade B on abrasion-exposed surfaces
  • RFID is a supplement to the optical carrier, never a replacement
  • Sub-domain used for the resolver host is one the brand controls, not a shortener
  • Same identifier is used across marketing collateral, hangtags, packaging and receipts

Standard reference

CEN/CENELEC JTC 24. EN 18216:2025 — Digital Product Passport — Data carrier and unique identifier. Available from national standards bodies (SIS in Sweden, DIN in Germany, SFS in Finland, BSI in the UK). List price around €120 per copy.

Companion standards frequently cited alongside EN 18216:

  • ISO/IEC 18004 (QR Code print grades)
  • ISO/IEC 16022 (Data Matrix print grades)
  • GS1 Digital Link specification (URI structure)
  • GS1 General Specifications (Application Identifier registry)