Digital Product Passport: what an online store has to prepare, and by when

What is a Digital Product Passport?

A Digital Product Passport (DPP) is, in the words of the Ecodesign for Sustainable Products Regulation (ESPR), “a set of data specific to a product” that is “accessible via electronic means through a data carrier”. The data carrier is a barcode, a QR code or another machine-readable symbol placed on the product, its packaging or the documents that come with it. Scanning it opens the passport.

The passport is not one document with one fixed layout. The ESPR, which entered into force on 18 July 2024, sets the frame: each passport is linked to a persistent unique product identifier, the data must be accurate and up to date, and different users see different parts of it. What the passport contains is decided separately for each product group. The European Commission’s passport page lists the kinds of information involved: safety, origin, materials, repairability, environmental performance, reuse and recycling.

Three parts of the system matter to a company that sells online:

• The passport itself is stored by the economic operator responsible for it or by a passport service provider, and a back-up copy has to be kept with a service provider.
• The EU registry stores the unique identifiers. According to the Commission, the registry became operational on 20 July 2026. The company that places the product on the market uploads the identifiers, and customs can check them for imported goods.
• The data carrier connects the physical product to the passport. Online, where nobody can scan the product, the store has to offer the same access another way.

Which products need a Digital Product Passport, and when?

A product needs a Digital Product Passport only when a legal act for its product group applies. There are two routes: a delegated act adopted under the ESPR, or separate legislation such as the Batteries Regulation. The table shows the dates the European Commission publishes on its passport page, which it describes as an indicative timeline.

The last column for ESPR groups is our arithmetic, not an official date. The regulation says a delegated act may not apply earlier than 18 months after it enters into force, except in duly justified cases, so we added 18 months to the planned adoption. Until an act is published, neither the date nor the required data is final.

Two details in the battery row matter for online stores. A light means of transport battery is a sealed battery of 25 kg or less that drives a wheeled vehicle such as an e-bike or an e-scooter, so a bike shop is among the first retailers to sell products with passports. Trade associations asked in 2026 for the battery date to be postponed, but as of this review the date in the regulation has not changed.

The Commission’s page also names toys, detergents, packaging and critical raw materials as areas where separate legislation brings its own passport requirements. Food, feed and medicinal products are outside the ESPR.

Who has to create the passport: the manufacturer, the importer or the store?

The company that places the product on the EU market creates the passport, and the company that sells it to the end customer makes the passport accessible. The ESPR assigns the duties by role, and one company can hold different roles for different product lines.

The role that surprises store owners is the first one. Article 34 of the ESPR treats an importer or a distributor as the manufacturer when it places a product on the market under its own name or trademark, or modifies a product in a way that affects compliance. A store with a private label line is a dealer for the brands it resells and a manufacturer for its own.

A store that buys directly from a factory outside the EU is an importer. An importer does not write the passport, but it carries the risk if the passport does not exist.

What does an online store have to show on the product page?

An online store has to make the Digital Product Passport easily accessible to customers and potential customers, including in distance selling. That is the wording of Article 31 of the ESPR, and Article 9 adds the timing: the passport has to be accessible before the customer is bound by the contract. In a store, that means the product page, not the order confirmation email.

The regulation also gives the store a way to get what it needs. Under Article 10, the company that places the product on the market has to give dealers and marketplaces a digital copy of the data carrier or the unique product identifier, so they can show it to customers who cannot physically access the product. It has to do so free of charge and within five working days of a request.

For products covered by a delegated act, Article 36 lists what the offer has to show clearly and visibly in distance selling:

• the manufacturer’s name, registered trade name or trade mark, and the postal and electronic address where it can be contacted,
• when the manufacturer is outside the EU, the name, postal and electronic address and telephone number of the responsible economic operator in the EU,
• information that identifies the product, including a picture, its type and any other product identifier.

How exactly the passport is presented online (a link, a QR code image, a block of data) will be specified in each delegated act. What is already certain is the direction: per product, before purchase, on the page where the customer decides.

What is already in force: GPSR, the accessibility act and unsold stock

Three EU obligations already apply to online stores, and two of them use the same product data the passport will need. A store that meets them has done part of the passport work.

Product safety information on every listing (GPSR)

The General Product Safety Regulation (GPSR) has applied since 13 December 2024. Article 19 requires every online offer to indicate clearly and visibly: the manufacturer’s name and its postal and electronic address, the EU responsible person when the manufacturer is outside the EU, information identifying the product including a picture, and any warning or safety information in a language consumers in that country understand.

The GPSR covers products intended for consumers and products consumers are likely to use even if they are not intended for them. A B2B store that sells tools, chemicals or electrical equipment a consumer could buy and use should not assume it is outside the scope.

The manufacturer block in the GPSR is almost the same as the one in Article 36 of the ESPR. Fill it properly once, per brand or per product, and the passport rules reuse it.

Accessibility of consumer stores (European Accessibility Act)

The European Accessibility Act has applied to e-commerce services provided to consumers since 28 June 2025. It is a directive, so each member state has its own law, authority and penalties. Service providers with fewer than 10 employees and an annual turnover or balance sheet of no more than 2 million euro are exempt. A store that sells only to companies is outside the definition, which covers services offered with a view to concluding a consumer contract.

Enforcement has started. In France, disability associations took four grocery retailers to court in November 2025. According to published accounts of the decisions, a court ordered Carrefour on 4 June 2026 to make its website and mobile app fully accessible within six months and rejected the argument that partial conformity was enough, while the claim against Auchan was dismissed in May 2026.

The link to the passport is practical. A passport block added to the product page has to be accessible too: a QR code needs a text link next to it, and a table of passport data needs proper headings.

The ban on destroying unsold clothes and shoes

Since 19 July 2026, large companies in the EU may not destroy unsold apparel, clothing accessories and footwear. Medium-sized companies follow on 19 July 2030, and micro and small enterprises are exempt. The Commission’s notice lists the limited exceptions, such as unsafe, damaged or counterfeit goods, and says companies must keep records for five years.

For a fashion store this is a returns and stock question, not a product page question. It belongs on this list because it comes from the same regulation as the passport and reaches the same companies first.

Which fields does the product catalogue need?

A product catalogue needs six fields to carry the passport and the obligations already in force. The passport link is the only new one. The rest are fields the GPSR already requires, and they often sit in a free-text description instead of structured data.

The level column hides the hardest question. A delegated act decides whether the passport exists per model, per batch or per item. A model-level passport is one link per variant, which any catalogue can hold. A batch-level or item-level passport means the link depends on the physical unit that ships, which the store does not know when the customer is looking at the page. How such a passport is made accessible before purchase is one of the points Article 9 tells each delegated act to specify.

Each field also needs one owner, as with any data shared between systems. Our guide to ERP and ecommerce explains how to assign ownership so that a sync does not overwrite a value someone corrected by hand.

The channel does not have to be an API. For Rader, a supplier of wheels and castors, we built a website with a catalogue of 3,494 technical products that the team keeps current with an Excel import and export in an agreed structure. In a setup like that, a passport link is one more column in the file. When product data already flows from an ERP or a PIM, the link is one more attribute in the integration between the store and those systems.

How to prepare an online store in six steps

Preparing an online store for the Digital Product Passport takes six steps, and only the last two involve building anything. The order matters, because the first four decide whether there is anything to build yet.

1. Sort the catalogue by product group. Mark every product that falls into batteries, iron and steel, construction products, textiles, aluminium, tyres, furniture, mattresses or energy-related products. Everything else has no passport date yet.
2. Write down your role for each line. Reseller, importer or own brand. Private label and direct imports from outside the EU are the lines where the obligation is yours.
3. Ask your suppliers three questions. Will you issue passports for these products, at which level (model, batch or item), and how will you deliver the links: in the product feed, through an API or in a file? Suppliers of e-bikes and other battery products should have an answer now.
4. Close the GPSR gaps. Move manufacturer details, the EU responsible operator and safety information out of free-text descriptions into structured fields. This is required today and it is the same block the ESPR asks for.
5. Add the passport field and its import. One field per variant for the link or identifier, filled by the supplier feed, the ERP, the PIM or a file import. Do not let anyone type links by hand into a product description.
6. Show the block on the product page. A passport link with a clear label, the manufacturer block and the safety information, visible before the add-to-cart decision and accessible to a screen reader. Add the same fields to the product feeds you send to marketplaces.

Whether steps 5 and 6 are a small change or a project depends on the platform. On an open platform they are a small change: Medusa’s product and variant records already carry fields for the EAN, the commodity code, the country of origin and the material, and further fields are added in a custom module that the storefront reads. That is routine work in a Medusa development project. On a hosted platform, check whether you can add structured fields per variant, fill them by import and show them per language without a paid app for each. If you cannot, the passport is one more reason on the list when you weigh an ecommerce platform migration.

If you are building a store now, put these fields in the first data model instead of adding them later. We launch a live store in 30 days on our Medusa foundation, from €10,000 net, and a manufacturer block, a safety information field and a passport link per variant fit into that data model from the start.

Does the Digital Product Passport apply to UK and US sellers?

The Digital Product Passport applies to products placed on the EU market, wherever the seller is established. A UK or US brand that ships to customers in the EU, or supplies EU retailers, will need passports for its covered products on the same dates as an EU manufacturer. The registry is built for this case: the Commission states that for imported products the registration can be checked at customs.

A seller outside the EU also needs an economic operator established in the EU for the products it sells there. The GPSR already requires this responsible person for consumer products, and its contact details have to appear on the listing. A non-EU brand that sells only in its home market is not affected.

When you do not need to act yet

A store does not need a passport project yet when none of its products fall into the scheduled groups, or when it only resells established brands whose passports are still years away. In both cases the useful work is steps 1 to 4: sort the catalogue, know your role, ask suppliers and close the GPSR gaps.

There are also things not worth doing in 2026:

• Do not buy a passport platform before your product group has its delegated act. The act defines the data, the level and the access rules. Software chosen before that is chosen against a guess.
• Do not build item-level tracking for a group that may get model-level passports. Wait for the act, and keep the data model able to hold either.
• Do not create passports for products you only resell. That is the job of the company that places them on the market. Your job is to receive the link and show it.
• Do not treat the passport as a design task. The block on the product page is the small part. Getting a correct link for every variant from every supplier is the real effort.

An audit is enough when your store sells to consumers, is above the microenterprise threshold and has never been checked for accessibility or for GPSR information on listings. Both obligations are already enforceable, and fixing them prepares most of the ground the passport will need.