GS1 Digital Link explained for DPP buyers

If you've evaluated DPP vendors, you've seen "GS1 Digital Link" used loosely. This guide unpacks what the GS1 Digital Link standard actually specifies, what it means for product passports, and how to tell a real implementation from a vendor that just generates QR codes.

What GS1 Digital Link actually is

GS1 Digital Link is a standards-based way to encode GS1 identifiers (GTINs, batch numbers, serial numbers) in Web URIs. Instead of a QR code that contains opaque data, the QR points at a URL that any browser can load.

The canonical URL pattern uses GS1 Application Identifiers (AIs):

https://example.com/01/{gtin14}/21/{serial}

• 01 = AI for GTIN
• 21 = AI for serial number (optional)
• Other AIs slot in the same way: 10 for batch, 17 for expiration, etc.

The standard is published by GS1 and is widely supported — Google Search reads it, retail systems understand it, and any modern web browser can resolve it.

Why this isn't "just QR codes"

A non-Digital-Link QR code on a product is opaque. It encodes whatever the manufacturer wants — sometimes a URL, sometimes a serial number, sometimes a vendor-proprietary blob. There's no standard way to interpret it.

A GS1 Digital Link URL is:

• Human-readable — you can paste it in a browser
• Standards-based — any system that knows GS1 AIs can parse the URL
• Routable — the same URL can serve different content based on Accept headers (HTML to a consumer, JSON-LD to a regulator's tooling)
• Future-proof — when EU DPP Registry integration goes live, your URL pattern doesn't change

Resolver behavior

A GS1 Digital Link resolver is the server that handles requests to your Digital Link URLs. Per RFC 9264-aligned linkset patterns, a resolver can return:

• The HTML passport page (default for browsers)
• The JSON-LD machine-readable view (Accept: application/ld+json)
• A specific role-tier view (public, partner, authority, internal)
• Linkset metadata describing what views are available

GS1's /.well-known/gs1resolver discovery endpoint is the conformant way to expose resolver capabilities — though most vendor implementations today don't yet expose it.

How to evaluate a vendor's claim

When a vendor says "GS1 Digital Link," ask:

1. Show me a URL. Real Digital Link URLs follow /01/{gtin14} (or /01/{gtin14}/21/{serial}). If the URL is /passport/abc123 or /p/some-uuid, it's not Digital Link.
2. What happens with Accept: application/ld+json? A real resolver returns JSON-LD. A QR-generator returns the same HTML.
3. Can it route to different views? The whole point of Digital Link is one URL serving many audiences. A vendor that just generates QR images for a single static page is missing the point.

How SellSafely implements it

Sample passport URLs follow the GS1 standard:

https://sellsafely.ai/01/01234567890128       → textile sample
https://sellsafely.ai/01/09506000139995       → battery sample
https://sellsafely.ai/01/09506000142345       → steel sample

Our /sample-passport URL is the marketing entry point that links into these GS1-compliant viewer URLs. The resolver routes the same URL to different views based on the Accept header. The full canonical resolver path (id.sellsafely.ai/01/...) ships with the production passport CDN.

What we don't claim

• We are not GS1-certified — there is no GS1 certification for resolvers today. We follow the standard; we don't have a stamp.
• We do not yet expose the /.well-known/gs1resolver linkset description endpoint. It's on the roadmap.
• The GS1 Digital Link URL alone does not authenticate the product against counterfeiting — that requires NFC chips, cryptographic signatures, or a separate provenance layer (often combined with QR for layered defense).

Quick reference

If you want to verify a vendor's Digital Link implementation in 30 seconds:

1. Open their sample passport
2. Note the URL pattern
3. Open browser DevTools → Network
4. Reload with Accept: application/ld+json (use a curl command if needed)
5. Confirm the response is JSON-LD with a @context referencing GS1 (or UNTP, which references GS1 indirectly)

If all three checks pass, the vendor implements GS1 Digital Link correctly. If any fails, it's QR-with-marketing.

To inspect SellSafely's implementation, /sample-passport has the URL pattern displayed inline mono and a JSON-LD download for each sector.