What a Digital Product Passport is, and when the EU requires one

In EU law, a Digital Product Passport (DPP) is a set of data specific to a product, reached electronically through a data carrier on the product. What the set contains is not fixed once for everything: it is written product group by product group, in delegated acts the Commission adopts under the Ecodesign for Sustainable Products Regulation (ESPR).¹

The Commission describes it as a digital container for products, components and materials that stores information to support sustainability and circularity and to make legal compliance easier to show.⁴

Each product group's act also decides the level the passport is kept at: one record per model, per batch, or per individual item. It sets who may read which data, who may add or change it, and how long the passport must stay available, which must be at least the expected lifetime of the product.¹

ESPR, Regulation (EU) 2024/1781, was adopted on 13 June 2024, published in the Official Journal on 28 June 2024, and entered into force twenty days later, on 18 July 2024.¹

ESPR on its own does not put a passport on any product. It lets the Commission set ecodesign requirements for a product group by delegated act, and where those requirements include information requirements, products in that group may only be placed on the EU market if a passport is available.¹

Each delegated act must give businesses time to comply: its date of application may not be earlier than 18 months after it enters into force, except in duly justified cases. An act adopted in a given year therefore does not bite in that year.¹

Some products get a passport under other laws. Batteries have their own under the Batteries Regulation, (EU) 2023/1542, and the Commission lists further legislation that supplements the DPP, including the rules on packaging, toys, construction products and detergents.^2,4

Only the battery date is a compliance date written into law. The product-group years come from the Commission's working plan, which gives an indicative year for adopting each act; compliance follows later, generally at least 18 months after each act enters into force. The quarters come from the Commission's DPP timeline.^3,1,4

The working plan runs to 2030 and is a plan, not a law: years can move, and the content of each act is decided when it is drafted.³

ESPR's Annex III is the menu each product group's act chooses from. Depending on the group, a passport can be required to carry:¹

Access is by role. Customers, repairers, recyclers, authorities and others get free and easy access according to rights set in each act, and only authorized actors may add or change data. Personal data about customers may not be stored in a passport without their explicit consent.¹

A passport must stay available for the period its act sets, including after the business that created it becomes insolvent or stops trading in the EU. When a new passport is created for a product that already has one, the two must be linked.¹

A passport lives online, but it has to be reachable from the object. ESPR requires it to be connected, through a data carrier, to a persistent unique product identifier, and the carrier must be physically present on the product, its packaging or the documents that come with it, as the product group's act specifies.¹

The law defines a data carrier broadly: a linear barcode, a two-dimensional symbol, or another automatic identification medium that a device can read. The Commission gives a QR code as the typical example. Each act names the carrier or carriers allowed, how they are laid out and where they sit, and the carrier and identifiers must follow the ISO/IEC 15459 series or equivalent standards. Harmonized standards on unique identifiers (EN 18219) and data carriers (EN 18220) were cited in the Official Journal on 15 July 2026.^1,4,5

Online sellers are covered too. The business placing the product on the market must give dealers and online marketplaces a digital copy of the carrier or identifier, so the passport can be shown before a customer buys. The identifiers are also uploaded to the Commission's registry, operational since 20 July 2026.^1,4

Vera gives each product a tag, an item-level record that follows it from the day it is made through every owner, and a platform to run both. Here is where that meets what the law asks of a passport. A passport also carries the product-group data each act sets, such as composition, compliance documents and operator identifiers, and its identifiers are uploaded to the EU registry.¹

Vera provides the item-level identity and lifecycle record a Digital Product Passport is built on: the tag on the product, and a record of every transfer, scan and resale.

ESPR already sets rules for how a passport is stored and run, whoever runs it. They make a useful checklist when you compare DPP software, Vera included.¹