Product identifiers: how many you need, what they cost, and which rules are law

A beginner crosswalk: identity, number, carrier and link

These terms sit in different layers. Keeping the layers separate prevents a catalogue field, a printed symbol and a web link from being treated as the same thing.

A SKU is not a GTIN, a GTIN is not the barcode or QR carrier, and none of them is a GS1 Digital Link. One product record can use several of these together. The useful question is which job each layer is doing.

Need your first identifier?

If you are still deciding what a new product needs, start with Your first product identifier: GTIN, SKU, barcode, EAN and UPC. That guide owns the action sequence. This page stays the technical dictionary.

Five words people use, and what each one is

Most identifier confusion is vocabulary. A supplier, a platform and a piece of legislation will use different words for overlapping things, and the words are not interchangeable even where the numbers are.

The last row is where most product pages in this category go wrong. The framework's term describes a job, and a trade number is one candidate for doing it, so a sentence claiming that the law requires a particular kind of number is a sentence about a scheme rather than about the law. Which attributes sit beside the identifier in a passport is set out across the attributes we track.

Start here if nothing has been allocated to you

This page is written for a reader who has internal stock codes and no allocated identifier of any kind. That is the ordinary starting position for a brand selling through its own store, and it is not a failure. It does mean the first decision here is not which identifier goes where; it is whether to be allocated any at all, and from whom.

What you have today is a set of codes nobody outside your business can resolve. What the framework asks for is a string issued in accordance with internationally recognised standards, and it names no scheme in the provisions we read. That silence is why there is more than one route, and why nobody can honestly tell you the route is settled.

• Join a national member organisation of the numbering scheme. You are allocated a prefix and form numbers under it, and the fee shape is the subject of the section below. This is the route most catalogue systems and marketplaces already assume.
• Use a different scheme that conforms to a recognised standard. The framework's silence makes this a route rather than a loophole. We cannot tell you which schemes satisfy the European standard on unique identifiers, because that standard is sold by national standards bodies and we have not read it.
• Do not put an internal stock code into a barcode field. It makes a form accept your listing today and it is the most common identity defect we meet, because the code then travels into artwork, into a feed and eventually onto a garment.

What the framework asks, and which standards carry a presumption

Three provisions do the work. The identifier has to be persistent and the carrier has to be connected to it. The carrier has to be physically present on the product, its packaging or the documentation that accompanies it, which rules out a passport that exists only on a website. And carrier and identifier have to meet standards the framework cross-refers to, or equivalent European or international standards, until harmonised standard references are published in the Official Journal.

That last clause is the one that changed. A joint technical committee produced eight passport standards and a Commission implementing decision of July 2026 published the references for six of them, two of which are the standard on unique identifiers and the standard on data carriers. What those texts contain we cannot tell you, because they are sold by national standards bodies and we hold neither.

The two standards left without a published reference are not peripheral. One covers access rights management and information system security. The other covers data authentication, reliability and integrity. Those are precisely the properties an access-tiered, authenticating and long-lived passport leans on hardest. They are also the two currently outside the presumption. What a presumption of conformity is worth, and what it is not, is on standards and conformity.

A separate provision covers identifiers for operators and facilities, and it runs the other way round from what people expect. Where an operator identifier is not yet available, the business creating or updating the passport has to request one on behalf of that actor, after first checking that none already exists. It is an obligation to go and look before allocating, which is the same discipline this page recommends for products. Why the operator and facility identifiers behave nothing like a product number, and which of the three is the hard one, is on the three identifiers a passport needs.

A correction: a resolver standard is not a passport standard

This page has previously described a standard as a passport standard when it is nothing of the kind, and correcting that quietly would be the wrong way to do it on a site whose whole proposition is claim precision. The international standard on encoding and resolving identifiers over HTTP is a resolver and identifier-encoding standard. So is the conformant resolver standard published by the numbering organisation. Neither is a product passport standard, and neither carries a presumption of conformity under the framework.

The distinction is not pedantry, because the underlying claim survives it and gets better. What somebody is claiming when they invoke either of those documents is resolver conformance: that the service answering the code behaves in specified ways, returns specified errors and publishes a description of itself. That is real, it is checkable from outside in about ten minutes and it is a good thing to claim. It is a different claim from conformance to a passport standard, and a procurement conversation that cannot tell the two apart will buy the wrong one. What a conformant resolver must do, and the five things it does not specify at all, is taken apart on what happens when you scan.

Where the identifier stack is worked through in detail

For the URI, resolver and domain-control decision, see GS1 Digital Link for Digital Product Passports.

If the implementation uses GS1, the machine-readable distinction between GTIN, batch, expiry and serial is covered in GS1 Application Identifiers for Digital Product Passports.

The complete standards-status question remains on DPP Standards and Presumption of Conformity. The three identifier classes are on Product, Operator and Facility Identifiers for a DPP.

The multiplication rule, and what multiplying costs

One shirt, thirty identifiers

The arithmetic surprises people who have priced a passport programme per style. One shirt in five sizes and six colours is thirty sellable combinations. Under the numbering scheme's own management standard, whose worked example turns on exactly this case, that is thirty distinct identifiers rather than one.

It multiplies the identifiers and it does not multiply the evidence. Those thirty combinations share one fibre composition, one country of origin and one set of supplier documents, because a composition does not change when a garment changes size. Catalogue systems have already made this decision for you by putting the identifier field on the variant and the descriptive fields on the product, so the shape is in your data whether or not you have thought about it.

Two things follow, and they pull in opposite directions. Counting variants when you estimate the evidence work inflates it badly. Counting products when you estimate the number of identifiers, or the number of passports, understates the output by the same factor. The level a passport is held at, being model, batch or item, is a question the framework leaves to a product-specific act, and how many passports takes that apart.

What allocation costs, and why the answer depends on your country

This page used to say it had not established what allocation costs. It has now read the published fee pages of three national member organisations, and the finding is not a number. It is that the three price the same thing in three structurally different ways, so a brand with a wide size matrix pays for the width of its catalogue in some countries and does not pay for it at all in others.

The asymmetry is the finding. Two brands with identical catalogues, identical turnover and identical size matrices can face materially different allocation costs because of where they happen to be incorporated, and the wider the size matrix the wider the gap. We looked for a vendor proposal or an industry cost model that prices that difference and did not find one, which is a statement about where we looked rather than a claim that none exists.

Two disciplines go with this, and neither is optional. Any total for a catalogue of a given size is derived from a fee shape rather than quoted from a price list, and it is labelled as derived wherever it appears, including in anything we publish later. And the cost of being allocated identifiers is kept apart from the cost of a code whose destination can be changed after printing. Those are two products with two bills, they are quoted together often enough to be worth separating in writing, and only the first of them is what this section is about.

One member organisation also publishes a continuity statement, and its condition is the part to read: product data remains linked for as long as membership is renewed annually. That is a persistence guarantee, and the conditional half is the half that decides what happens to a code printed on a garment somebody still owns in a decade. When the link dies works through what happens at that point.

Across eight mandatory product data systems we examined, item-level identity had one class of production payer rather than a shared one, and the engine underneath it was recoverable unit value destroyed by uncertainty about what a thing is. That covers the eight systems we looked at and says nothing about systems we did not examine.

What the systems downstream actually check

Two very different regimes sit either side of your catalogue, and merchants routinely mistake one for the other. The catalogue you type into checks almost nothing. The surfaces you feed check a good deal, and they do it after the number has already been printed.

The platform documentation we read describes no check at all on that field. No test of the check digit, no format rule and no duplicate detection are documented for it. That is a statement about what the documentation says rather than a guarantee about what the platform does, and it is the sort of absence worth verifying in your own account rather than taking from us.

Four kinds of check a shopping surface applies

The surfaces that do validate publish their rules in their own product data specifications. We have not registered those specifications as sources here, so this page names the four kinds of rule you will meet rather than reproducing values we have not transcribed. Go and read the specification for the surface you sell on; each of the four has a checkable answer in it.

• Accepted lengths. A small, closed set of digit lengths. A value of any other length is rejected rather than corrected, which is the right behaviour and an unhelpful error message.
• Check digit validation. The final digit is computed from the others, so a surface can tell a typo from a valid number without asking anybody. This is why recomputing check digits across your own catalogue is a morning's work with a real yield.
• Restricted ranges. Certain prefix ranges are reserved for uses that are not trade items sold to the public, and a listing carrying one is refused. A number that works perfectly inside a warehouse can be rejected the first time it meets a shopping surface.
• A caution about certainty. The specifications carry their own warning, and it is the useful part: supply an identifier only where you are confident it is the right one for that product. A confidently wrong identifier is worse than an absent one, because it matches you to somebody else's listing rather than to nothing.

Two products, one number

Nothing happens at first. That is the problem. A duplicate identifier does not throw an error in the catalogue, does not stop a listing going live and does not prevent a passport being generated. It surfaces later, as a marketplace matching your garment to somebody else's listing, a returns process pulling the wrong record, or a scan that resolves to a product the customer is not holding.

So the checking has to happen before anything is published. Our own rule is that an identifier publishes only where two independent sources agree on it, and it exists because of what happened when we relied on one. Across thirty five live cases we looked at, a candidate identifier supported by a single source was right eight times and wrong eight times, which is a coin toss dressed as a data point.

A check digit is worth recomputing on every run and never worth silently correcting. A corrected identifier passes the arithmetic and may now identify somebody else's product, which is a worse outcome than one that is visibly wrong.

The cheap barcode question

Identifiers allocated by a member organisation are allocated under terms that prohibit transferring or reselling them, so a number bought from a reseller was allocated to a different business and stays associated with that business as its licensee of record. Where a surface checks the licensee of record against the seller, a transferred number is exactly what that check is looking for.

We have not established which surfaces run that check, how often they run it or what happens when it fails, so treat this as a risk of unknown frequency rather than a certainty. What is certain is the term itself, which is published and which you agree to when you are allocated a prefix.

The industry target for two dimensional codes at the till

You have probably been told that barcodes are changing and that there is a date attached. There is a target, an industry organisation set it for itself, and it is not a legal requirement: nothing in the framework provisions we read names a symbology, and nothing in them fixes a date for changing one.

The target, the point-of-sale capability threshold it is measured against and the condition that a linear barcode still accompanies the code are worked through on the page that owns them. Treating the target as a deadline is the mistake; planning for it as a printing and artwork problem is not.

What we have not established

Three things, and each is a place where this page could have said something confident and would have been guessing.

Whether an identifier can ever be reused. This is the one that changed, and it changed in the direction of less certainty rather than more. Reuse of a number already printed onto goods in circulation is governed by the scheme's general specifications, which have historically permitted reuse after a defined period for some categories of product while prohibiting it outright for others. We have not read the current release. So this is not established rather than settled either way. It is recorded as an open check, and how the estate handles a question in that state is set out in how we know.

Which numbering schemes satisfy the European identifier standard. The standard has a published reference and a presumption attaching to it, and its text is sold rather than published. We have not bought it, so we describe its citation status and never its content. Its published scope, and the scope of the other five, is on what the six published standards cover.

Whether our own resolver behaves as any standard describes. We make no conformance claim for it, on this page or anywhere else on this site.

Which rules quoted at you are law

Three of the things most often quoted at a business here are scheme practice rather than law, and one is a category mistake. Each is stated once, with the adopted-regime exceptions that make the general answer honest.

• No universal GTIN mandate is established. ESPR Annex III refers to a GTIN under ISO/IEC 15459-6 or equivalent among the information a product-specific measure can select. That is not the same sentence as every passport must carry a GS1 GTIN. GTIN may be the right implementation where it already fits; the question is what the applicable product law and technical implementation require, and whether your existing architecture satisfies it.
• No universal QR-only rule is established. The framework requires a data carrier and leaves the carrier and its placement to product-specific measures. Some regimes are specific: the Battery Regulation uses a QR code for the Battery Passport, which is a real adopted legal requirement in that regime and not the universal carrier for every category. The adopted Detergents and Surfactants Regulation requires the passport to be connected through a data carrier and sets visibility and placement principles, with the detailed carrier rules to be fixed by technical implementing act. The Toy Safety Regulation uses the same data-carrier concept and gives the Commission powers over the detailed technical rules. So: say data carrier for the legal concept, and QR only where the applicable law requires QR.
• No universal Digital Link mandate has been established. GS1 Digital Link can express GS1 identifiers in web-enabled form and can be a valid implementation approach where it satisfies the applicable legal and technical requirements. Current primary law and the July 2026 referenced standards do not establish that every passport must use it. Digital Link has its own page.
• A SKU is not automatically a unique product identifier. A SKU is normally an internal stock or commercial code whose uniqueness, persistence, namespace, granularity and governance depend on the company using it. Before reusing one, check whether it is unique in the required namespace, persists for the required period, identifies the correct model, batch or item, works with the prescribed carrier and Registry process, and is not displaced by a different identifier structure in the applicable law or standard.

For textiles and apparel the scheme and the carrier detail are not fixed, and study proposals are not adopted requirements. Nothing above should be hard-coded as an equivalence: not UPI means GTIN, not every passport uses Digital Link, not every passport uses QR, not one SKU equals one regulatory passport, and not one identifier representing product, operator and factory at once.

The carrier, the identifier, the encoded syntax and the resolver are four separable layers, and the identity map compares them; what a resolver actually does when the code is scanned is worked through separately.

The same four statements read as a comparison, one row per adopted regime. Every cell is a position this section already sets out.

Read the table down the carrier column rather than across. The identifier column is thin on purpose: three of these five regimes settle a carrier and none of them settles an identifier scheme, which is the asymmetry the four statements above are describing.

Sources

Three of the sources below are published by the organisation that runs the numbering scheme this page keeps describing, and a publication guard governs whether such a document may be cited here. They appear because they are registered with a read depth, which is the accepted alternative to that guard: the page states how far each was read rather than resting on the fact of citation. The two standards among them were read at the organisation's reference site and never at its marketing site, because on the day of reading the marketing site was two ratifications behind the reference site on the same standard. The fee and allocation material was read at national member organisations' own published pages.

• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text
  EU lawArts. 2, 9, 10, 12CELEX 02024R1781-20240628In forceRelevant provisions reviewed

  The framework. The definitions of a data carrier and of a unique product identifier, the requirements attaching to both and the provision on operator and facility identifiers were read at the consolidated text. Annex III, which those articles cross-refer to for standards, was not readable, so nothing here describes what it lists.

• Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781
  Delegated or implementing actArt. 1, AnnexCELEX 32026D1736In forceReached through a secondary reproduction, primary text not read

  The implementing decision publishing the harmonised standard references. Its existence and its July 2026 date were confirmed through two independent secondary routes rather than at the Official Journal, and the count of six references against eight standards is held at that strength until somebody reads the Annex at source. It is on this page because two of the published references are the identifier standard and the carrier standard.

• EN 18219:2026, Digital product passport. Unique identifiers
  Standards bodyEuropean StandardBehind a purchase, not bought, not read

  Named so that the reference can be stated. Sold by national standards bodies, not held by us, and nothing on this page describes what it requires or which numbering schemes satisfy it.

• EN 18220:2026, Digital product passport. Data carriers
  Standards bodyEuropean StandardBehind a purchase, not bought, not read

  As above, for the carrier rather than the identifier.

• ISO/IEC 15459, Information technology. Automatic identification and data capture techniques. Unique identification, parts 1 to 6
  Standards bodyInternational StandardPublished abstract read, full text behind a purchase

  The international series on unique identification. Registered so that the series can be named and so that a claim of conformance to it can be recognised as a claim. Six parts, catalogue metadata only, and no sentence of any part has been read.

• ISO/IEC 18004:2024, Information technology. Automatic identification and data capture techniques. QR code bar code symbology specification
  Standards bodyInternational StandardPublished abstract read, full text behind a purchase

  The symbology specification behind the square code most people picture. Read no further than its catalogue entry, which records that the edition in force is already marked to be revised. That matters more than the edition number when the thing is about to be printed onto goods.

• ISO/IEC 18975, encoding and resolving identifiers over HTTP
  International StandardOfficial source confirmed, detailed review pending

  The international standard on encoding and resolving identifiers over HTTP. Cited for its existence and its published scope only, which is all its read depth supports. It is on this page because it is a resolver and identifier-encoding standard rather than a passport standard, and this page previously blurred that line.

• GS1 conformant resolver standard, at the reference site
  Standards bodyStandardRelevant provisions reviewed

  The conformant resolver standard, read at the reference site. Used here for one job only: to name what a resolver standard governs, so that a conformance claim about a resolver is not read as a conformance claim about a passport. What it requires in detail is set out on the page about what happens when a code is scanned.

• GS1 GTIN management standard
  StandardRelevant provisions reviewed

  The allocation standard for the numbering scheme. Read for the rule whose worked example makes each style, colour and size variation a distinct identifier, which is what turns granularity from an opinion into a scheme rule. Reuse of an identifier already printed onto goods is governed by the general specifications rather than by this document, and that release is unread.

• Identifier issuer published fee, allocation and continuity material
  Issuer termsRelevant provisions reviewed

  The published fee, allocation and continuity pages of national member organisations. Read for three fee shapes, for the prohibition on transferring or reselling allocated identifiers, and for a continuity statement that is conditional on annual renewal. Fee variation beyond the organisations read is unknown, and no figures are transcribed on this page.

• Shopify Admin API product and inventory item documentation
  Secondary sourcePlatform documentationRelevant provisions reviewed

  A market participant rather than an authority, and evidence of how one catalogue system behaves rather than of what the law asks. Two claims rest on it here: that the identifier field sits on the variant, and that its documentation describes no validation of what is typed into that field.