The Living Passport: own what happens after the scan.

ESPR obliges you to put a QR code on your product that anyone can scan, anywhere, for the product's whole regulated life. Most DPP platforms treat "publish" as the finish line. We think that misses the point entirely: the mandated QR is the first owned, zero-acquisition-cost media channel to appear in consumer goods since the barcode. The Living Passport is PassPer's answer to the only question that matters next — what happens after the scan?

Last updated: 25 July 2026

In one line: every other DPP platform sells you a legal obligation; the Living Passport turns the same mandated QR code into an owned channel — compliant data served first and tracking-free, insight and engagement built underneath it.

A legal obligation that is secretly a channel

Under ESPR (Regulation (EU) 2024/1781), in-scope product groups must carry a data carrier — in practice a GS1 Digital Link QR code — linking to the product's Digital Product Passport, and that passport must stay accessible for the product's regulated lifetime. Read as compliance, that is a cost. Read as media, it is remarkable: a scannable, brand-owned entry point printed on every unit you sell, reachable by any consumer, repairer, reseller or customs officer with a phone — with zero acquisition cost per contact. Nothing like it has been mandated onto physical products since the barcode, and the barcode never pointed anywhere you controlled.

Compliance-safe by construction — the feature, not the fine print

ESPR is explicit that the mandated passport data must be accessible without commercial barriers, and consumers scanning it must not be tracked. PassPer builds the Living Passport around that rule rather than against it:

Mandated data first, always. The regulated passport content loads at the top of the page, tracking-free — no consent wall, no cookies, no login.
Everything else sits below. Analytics and (in future) engagement modules live underneath the compliance layer and never gate it.
Aggregate and pseudonymous by design. The analytics layer works on scan events with coarse location only — no personal data, no individual profiles.

This is not a limitation we tolerate; it is the moat. A platform that bolts a marketing tracker onto the mandated page has built something a market-surveillance authority can shut down. A platform that is compliant by architecture has built a channel that cannot be taken away.

What is live today: scan analytics

The first Living Passport capability is shipping now. Every scan of your passport QR generates a compliant, pseudonymous signal, and PassPer turns those signals into distribution intelligence: item-level scan counts, distinct-device estimates per passport, per-SKU geography showing where in the world each product line is actually being scanned, and a grey-market concentration signal that flags SKUs whose scan geography looks wrong. For most brands this is the first post-sale, real-world view of their own distribution they have ever had. See DPP scan analytics for the detail.

Where it goes next — and where to start

The roadmap extends the same architecture into engagement: warranty registration, authenticated resale and take-back modules that live below the mandated data and turn a scan into a relationship. These are coming — they are not available today, and we won't pretend otherwise. What is available today is the foundation: a compliant, eIDAS-seal-ready (QTSP onboarding in its final stage), registry-filed passport that already tells you where your products live in the world. If you are starting from zero, run the free readiness check; if you want to see the Living Passport in action, take the interactive walkthrough.

Frequently asked questions

Is it legal to put anything besides the mandated data behind the DPP QR code?

The mandated passport data must be freely accessible — ESPR does not permit commercial barriers or consumer tracking on it. PassPer serves that data first, with no consent wall, no cookies and no tracking. Anything else — analytics, engagement content — sits below it and works on aggregate, pseudonymous signals only, so the compliance layer is never compromised.

What does "Living Passport" actually include today?

Today it is the compliant passport itself plus scan analytics: item-level scan counts, distinct-device estimates and per-SKU geography, including a grey-market concentration signal. Engagement modules — warranty registration, resale, take-back — are on the roadmap and not yet available.

Does scan analytics require consent banners on the passport page?

No. The mandated page is served tracking-free, and the analytics layer is aggregate and pseudonymous by construction — coarse location only, no personal data, no cookies. There is nothing to consent to, which is precisely the point: the channel works without a consent wall degrading it.

We just need to be compliant. Why should we care about any of this?

Because you are paying for the passport either way. Once the QR code is on the product, every scan is a moment of contact with a real customer or handler in the field. Treating that as a dead legal artefact leaves the only owned, zero-acquisition-cost channel in your category unused.

See where you stand — three ways, all free.

Take the 2-minute readiness check, watch the 10-minute interactive walkthrough, or download the full 2026 compliance guide. No account needed.

Free readiness check → See it in action Get the guide (PDF)