This is the question that comes up most, and the one that attracts the most approximation. A Digital Product Passport needs a unique identifier. So do you have to join GS1, buy a company prefix and assign a GTIN to every reference?
The short answer is no, nothing requires it. The long answer is worth the detour, because the technical objection usually raised against that answer was a serious one, and it fell on 15 July 2026 without many people noticing.
What the regulation asks, literally
Article 2 of the ESPR regulation defines the unique product identifier as "a unique string of characters for the identification of a product that also enables a web link to the digital product passport".
A string of characters. Nothing about who issues it, nothing about its format, nothing requiring a third party. The regulation never mentions GS1 at all, and annex III lists the GTIN as a possible data element, followed by the words "or equivalent".
The serious objection, and why it fell
Here is the reasoning you will hear, and it is not absurd.
Article 10 requires the identifier and the data carrier to comply with the standards in annex III, which points at the ISO/IEC 15459 series. Those standards are built around issuing agencies. Part 2 requires every identity to begin with an issuing agency code, and states that an organisation wishing to issue identities must do so through an umbrella organisation such as a trade association, or a public or state agency. The registration authority for the series is not open to individual companies: its approval criterion explicitly demands an umbrella organisation or a public body.
So on that reading, an identifier you mint yourself is not ISO/IEC 15459 conformant. That is correct, and worth saying.
Except that the sentence in article 10 does not stop there. Those standards apply "or equivalent European or international standards, until the references of harmonised standards are published in the Official Journal".
They have been. Commission Implementing Decision (EU) 2026/1736 of 14 July 2026, published the next day, cites EN 18219:2026, unique identifiers, and confers presumption of conformity with articles 10 and 11. The benchmark has moved, and the chain of reasoning that led to issuing agencies stops there.
The regulation explicitly provides for self-issued identifiers
This is the argument that settles it, and it is in the text.
Article 12 empowers the Commission to adopt delegated acts to, on one hand, "establish rules for organisations wishing to become an issuing agency", and on the other "establish rules for economic operators wishing to create their own unique identifiers and data carriers without relying on an issuing agency".
A legislator does not write rules for a practice it forbids elsewhere. Self-issuing is a recognised route, not a tolerance.
The published abstract of EN 18219 points the same way: it says it describes identification schemes "that use issuing agencies, self-issuing systems, or a combination of both". The standard is paywalled, so that quotation is second-hand, including here.
A nuance almost nobody points out
Rereading article 12 turns up something else. The duty to comply with the annex III standards is set there for operator and facility identifiers, not for the product identifier.
Those are different things. The identifier naming your company or your workshop does not follow the same rules as the one naming a t-shirt. The strictest reading of ISO/IEC 15459 therefore does not even bite where most articles place it.
GS1 Digital Link, what it actually is
The term circulates widely, often presented as the expected shape of a passport. It really refers to two things: a web address syntax, encoding an identifier into a structured URL, and a resolver specification, meaning a server able to interpret those addresses and redirect according to who is asking.
It is good technology. It is simply required nowhere. The regulation does not mention it once. GS1 itself is more measured than its relays: its own passport paper says that "among the various identification approaches" its method aligns with ISO/IEC 15459, and acknowledges that other issuing agencies exist.
Because GS1 is one of many. The register of issuing agency codes lists dozens, including sector federations, the Universal Postal Union, and companies such as IBM, Siemens and DHL.
What a GS1 code costs, and when it is worth it
The figures are public, so here they are. At GS1 France in 2026, the first band, for turnover under 50,000 euros, is 120 euros to join then 104 euros a year excluding tax. The next band, up to 500,000 euros, is 130 then 108. The amount does not depend on how many codes you use, and GS1 France does not sell codes individually.
So it is not a crushing expense. The real question is whether you need it for anything other than the passport.
If you sell through retail chains, or on marketplaces that require a standard product code, the answer is probably yes, and it already was before the passport. If you sell on your own store, it is probably no: Google states that a product you are the only seller of, or sold under your own brand, may not need a GTIN, and eBay accepts "does not apply".
What makes a good self-issued identifier
If you take the self-issuing route, four properties matter, and none of them requires buying anything.
Unique in the world, not unique to you. A counter starting at 1 will one day collide with another store's. That is the point of identifiers drawn at random from a very large space: collision becomes improbable without coordinating with anyone.
Meaningless. An identifier encoding the year, the collection or the category becomes wrong the day the product changes category. An identifier does not describe, it designates.
Immutable. It is never corrected, not even to fix a typo. Correcting it breaks every code already printed.
Detached from your shop. If it reuses your product's internal number, it dies with it, at the first migration or the first deleted page.
That is the route DPTag takes: each passport gets a randomly drawn identifier at creation, never reused, never modified, and kept even if the product leaves the catalogue. That does not make it a "compliant" identifier, which nobody can promise while the conditions live in a paywalled standard. It makes it one with the properties everyone agrees to expect.
Three routes, and what they buy
| Route | Cost | What it gives you |
|---|---|---|
| Issuing agency (GS1 or another) | annual membership | Recognised in retail and on marketplaces |
| Self-issued identifier | nothing | Provided for by the regulation, conditions still to come |
| Your shop's internal number | nothing | Avoid: it dies with the product page |
The third row is the one that costs later, and it is also the most tempting, because it asks nothing of anyone.
The EU registry prescribes no format
It is tempting to think the registry that opened in July 2026 settles the question. It does not even raise it.
Its text mentions neither GS1 nor ISO/IEC 15459. It stores "where relevant, the unique identifiers", without prescribing their shape, and separately generates its own registration identifier.
What it does demand costs more than any product code, and nobody talks about it: verified economic operator status, in the eIDAS sense. For a natural person that runs through a qualified electronic signature, an electronic identification means at assurance level high, or an electronic attestation of attributes. For a company the national eID route is not on offer: it takes a qualified electronic seal, issued by a qualified trust service provider after identity vetting. The status lasts three years at most.
That is a real administrative step, with a cost I will not quote since I could not verify it. Nothing to start while your sector has no delegated act, but that is where the actual entry ticket sits, not in a company prefix.
What a store can decide today
Three decisions, none expensive.
Buy nothing for the passport alone. Nothing requires it today, and the conditions for self-issuing will be set by a text that is not written. Buying now means paying for a hypothesis.
Keep an identifier that is stable and yours. That is the only property that really matters, however it is produced, and it is what decides whether a printed QR survives.
If you already have GTINs, use them. An identifier you already own, backed by an issuing agency, ticks every box with no extra effort. The question only arises for those who have none.
For what comes next, see the passport seen from WooCommerce and what is already in force and what is not.