What is product identity? (for physical products)

The usual meaning is about design: the name, logo, colors and packaging that make a product recognizable on a shelf. That is a real discipline, and this page is not about it. For a physical product the phrase can also be taken literally, as the identity of one specific object, which the object carries with it and which anyone can check.

This explainer sets out that second meaning: what it is made of, how it differs from brand identity and from the identity platforms that manage logins, and how it relates to the EU's Digital Product Passport.

For a physical product, product identity is a verifiable identity for one individual item. It has three parts, and each does a different job.

• A secure tag in the product. It is fitted where the product is made, so the identity is part of the object itself: inside a watch behind the dial, behind a handbag's logo or in a fabric patch, or in a garment's label.
• A digital certificate for that one item. A tap with a phone opens it in the browser and shows that the item is genuine, who made it and who owns it now.
• A record that keeps going. Each scan, transfer and resale is written to the same certificate, from the maker through the first sale to every owner after.

Remove any one of the three and the identity stops working. A record with nothing on the product can be attached to any object. A tag with no certificate proves the tag is real and says nothing about the product. A certificate with no history is little more than a receipt.

Most product numbers name a kind of thing rather than a thing. GS1's General Specifications, the standard that defines how its identification keys and barcodes are used in business, separate class-level identifiers, shared by every unit of a product, from instance-level identifiers that pick out one individual occurrence, such as a trade item number combined with a serial number. GS1's own illustration is a returnable pallet: its dimensions and material apply to every pallet of that type, while its current location and its damage history belong to one pallet alone.²

Product identity in the sense used here is instance-level by design. Authenticity, ownership and history only mean something for a single object. Two bags of the same model can have different owners and different histories, and one of them may be a copy.

A number printed on a label identifies an item but cannot defend itself, because anyone can copy it. Secure near-field communication (NFC) tags are designed to close that gap. Each time a phone reads one, it produces a new authentication code with standard cryptography, using a key that cannot be read out of the tag.

No identity system makes copying impossible. What a secure tag changes is that a copy of the link is no longer enough to pass for the original.

In marketing and design, product identity usually means the visual and verbal system that makes a product recognizable: its name, logo, packaging, color, typography and tone. It is part of brand identity, and every unit carrying the design shares it. Its job is recognition.

The identity of a physical product has a different job, which is proof, and it sits at the level of the single item. The two depend on each other more than they seem to. A distinctive design is exactly what counterfeiters reproduce, and an item-level identity is how the genuine article is told apart from a good copy.

Software sold as an identity platform, an identity provider or identity and access management (IAM) does something else again: it manages the digital identities of people, so that they can sign in to applications. The Digital Identity Guidelines of the US National Institute of Standards and Technology (NIST) define a digital identity as an attribute or set of attributes that uniquely describes a subject within a given context, and in those guidelines the subject is a person. Their subject matter is the identity proofing, authentication and federation of users.³

Product identity borrows two ideas from that world, a credential that can be checked and a history of who held what, but the subject is an object. The product never logs in. It proves what it is when someone taps it, and its owner can change many times while its identity stays the same.

Digital product identity and digital identity for products are other names for the same idea, with the weight on the record rather than the tag. The digital part is the certificate and its history. On its own that is only data. It becomes an identity when something physical binds it to one object and lets anyone confirm the binding with a tap.

The EU's Ecodesign for Sustainable Products Regulation (ESPR) defines a digital product passport as a set of data specific to a product, reached electronically through a data carrier. A data carrier can be a barcode, a two-dimensional code or another automatic identification medium a device can read, and the passport must be connected through it to a persistent unique product identifier.¹

The overlap with product identity is real: both need a physical link on the product and an identifier that resolves to a record. The scope is different. A passport's contents are set product group by product group, and the law's stated aims are that actors along the value chain can find product information, that authorities can verify compliance, and that products can be traced. Each product group's rules also decide whether the passport is kept per model, per batch or per item. ESPR requires the data to be authenticated, reliable and secure, and the passport to stay available for at least as long as the product is expected to last.¹

Product identity in Vera's sense is always per item, and it is built for authentication, ownership and resale as well as for information. A passport adds the product-group data each act sets. Vera provides the item-level identity and lifecycle record a Digital Product Passport is built on, and the Digital Product Passport explainer covers what the law requires and when.

Vera is the product identity infrastructure, made of three products. Vera Tags give the object its identity. Vera Certificates connect that identity to each owner and, through the owner, to the brand. The Vera Platform turns every scan and transfer into information the brand can see and act on.

The work follows the same order: verify, connect, understand, capitalize. A tap verifies the item. The certificate connects it to its owner. The platform shows the brand where its products are and how they move. And a record that buyers can check gives the brand something to build on in resale and in its own decisions.

It starts before the sale. Tags can be bound to their products before a box leaves the factory, so the identity exists before anyone buys the item and stays with it through every owner afterwards. Products that carry an identity like this are what we mean by connected products.

Each read of a Vera Tag produces a signed, single-use response, and the secret that signs it cannot be extracted from the tag. A copied or screenshotted link replays an old code, so it is recorded as an invalid scan instead of being shown as verified, and the brand can see where that scan happened. The brand owns its data and can export it in full.

• Is it per item? A code that every unit shares identifies a model, not an object.
• What happens when the link is copied? If a screenshot or a forwarded URL still looks verified, the identity can be borrowed.
• Does it start where the product is made? An identity added later cannot speak for the part of the product's life before it existed.
• Can the owner stay private? An owner should be able to hold the record without being named publicly.
• Who holds the data, and can the brand take it elsewhere? A brand should be able to export its data in full.