A QR code printed on a label is a promise of an unusual kind. It cannot be corrected, it cannot be updated, and it goes on existing in somebody's wardrobe long after the collection was discounted.
Here is a demonstration passport as a customer opens it: composition, origin, care, certification, batch number. The question that page raises is not what it looks like. It is who will answer its address in 2036.
The European regulation has a partial answer, more interesting than the usual summaries, and it leaves a gap nobody flags.
What the regulation actually allows
Start with the point traceability platforms consistently forget to quote. Article 11 of the ESPR regulation says, at point (c), that the passport "shall be stored by the economic operator responsible for its creation or by digital product passport service providers".
Self-hosting is explicitly permitted. You are under no obligation to hand your passports to a third party, and a sales pitch implying otherwise is describing its own product, not the law.
The article goes on to require that access be free of charge and easy for a long list of actors, that authenticity and integrity of the data be ensured, and that providers neither sell nor reuse your data beyond what is necessary. It sets no availability requirement, no redundancy rule, no backup frequency. No service guarantee at all.
What it demands when the company disappears
Here the text is more precise than you would expect, and the duty falls on the merchant rather than on the provider.
Article 11(e) requires that the passport "remain available for the period specified in delegated acts, including after an insolvency, a liquidation or a cessation of activity in the Union" of the operator that created it.
Article 10(4) sets out the concrete act: the economic operator, when placing the product on the market, "shall make available a back-up copy of the digital product passport through a digital product passport service provider". The same condition reappears among the manufacturer's and the importer's obligations, specifying that it must be the most up-to-date version.
As for how long, article 9 leaves each delegated act to fix the period, with a floor: it must correspond to at least the expected lifetime of the product. For a garment that is counted in years, not months.
The gap: nothing protects the printed address
Now the part I have seen nowhere else, and which is checked by reading the text rather than summarising it.
The word "persistent" is defined nowhere. Article 10 requires a persistent unique product identifier, and the regulation never says what persistent means. No duration, no criterion.
The regulation never mentions a web address. Neither URL, nor hyperlink, nor internet address appears anywhere in its enacting terms. The identifier must "enable a web link to the digital product passport", and that is all. Nothing requires the address encoded in a printed code to be stable, transferable, or resolvable by anyone else once the original host is gone.
The rules for service providers do not exist yet. Article 11 empowers the Commission to set them by delegated act, and to provide "where appropriate" for a certification scheme. That is an empowerment, not a rule. A provider presenting itself as certified today is anticipating a text that is not written.
The result fits in one sentence. The regulation requires the passport to outlive the company, it obliges you to lodge a backup with a third party, and yet nothing makes the address carved into the QR survive. If that code points at your provider's domain, the backup may well exist somewhere, and the garment will still lead to an error.
The EU registry will not save you
It is tempting to treat the registry that opened in July 2026 as a safety net. It is not one, and the detail is worth knowing.
The registry does not hold passports. It records the identifier, the commodity code, a reference to the host and, where relevant, the link to the backup. It is the verified economic operator who must keep that information "accurate, complete and up to date at all times".
Three things jam. Verified operator status expires after three years, and an operator who is no longer verified can no longer modify its data: a dissolved company will therefore never update its entry. No provision covers a dead reference, one pointing at a server that has been switched off. Verification happens at submission, with no recheck and no takeover mechanism for an orphaned registration. A recital does contemplate transferring a registration to another verified operator, with no article and no procedure to organise it.
Finally, registry data is deleted ten years after registration where Union law sets no other period. A coat can outlive its own registration.
What this means for a store
One decision really matters, and it is taken before anything is printed: which domain name goes into the code.
If the QR encodes your provider's address, your passports live as long as your contract with them. Changing tools will mean reprinting, which is only possible for the garments still in stock. The others have already left.
If the QR encodes your own domain, the address is yours. You can change software, rebuild your site, move host, as long as the path keeps answering. The domain becomes the one thing not to lose, which is a far simpler problem to manage.
The European standard EN 18221, published in May 2026, covers exactly this: data storage, archiving and persistence. It sits behind a paywall, so what circulates about its detail is second-hand, including here, and the fifteen-year horizon that gets repeated comes from commercial posts rather than from the text.
And when the garment changes hands
The regulation says little about second life, and what it does say is worth knowing.
When a new passport is created for a product that already has one, it must be linked to the original. That is the remanufacturing case: a remanufactured product is a new product, but its chain of passports stays connected.
Repairers, remanufacturers and recyclers appear in the text only as readers. They consult, they do not write, unless a delegated act decides otherwise, since it is the delegated act that will name the actors allowed to create or update the data.
Second-hand goods, for their part, circulate without having to comply with delegated acts adopted after they were placed on the market.
There is nothing, however, about a brand being acquired or the passports themselves being transferred. If your company is bought, the fate of your passports will be settled by the sale agreement, not by the regulation. One more reason for the address to rest on a domain that is identifiable as an asset.
What you can do now
Four moves, none urgent, all cheap.
Treat the domain as an asset. It carries the printed promise. Renew it for several years and list it where you list your other assets, not only on a hosting invoice.
Look at the path, not just the domain. An address built on an internal shop id dies at the first migration. An identifier belonging to the passport survives a change of platform.
Check that you can get your data out. Whatever the tool, you should be able to retrieve your passports as readable files without asking permission.
Know that the third-party backup is coming. The obligation is written, it will fall on you rather than on your software, and its detailed rules are not set yet. Nothing to do today, except avoid locking yourself into a provider that would make that deposit impossible.
What DPTag does, and what happens if you stop paying
The question deserves a plain answer, because it can be checked.
Passport pages are served by the free plugin, from your own WordPress and your own domain. The public page checks no licence. Translations already written are stored with the passport, and served by the free plugin too.
So if a Pro subscription lapses, the passports already published keep answering, translations included. What you lose is the ability to produce new ones faster: bulk export, vector QR, the translation editor and AI filling. Not the pages, not the addresses, not the data.
One nuance, for completeness. The add-on also brings extra page palettes, your own brand colour and your logo. Those go with it, and the page falls back to one of the themes shipped in the free plugin. It changes appearance, it does not stop answering.
Three questions to ask any tool
They apply to DPTag as much as to its competitors, and the answers can be checked in minutes.
Which domain appears in the QR code you generate? If it is theirs, the lifetime of your labels is the lifetime of their company.
What happens to published passports if I stop paying? An acceptable answer says what keeps working, not only what stops.
Can I export my passports and rehost them without changing the address? The regulation already requires data to be transferable without vendor lock-in. A tool that cannot answer that today will not answer it better in five years.
For what a printed code should carry, see labels and QR codes. For the starting point, see the passport seen from WooCommerce.