One of the most common — and legitimate — fears about the Digital Product Passport (DPP): "if I print the QR code onto thousands of products now, am I tied to whichever provider I started with forever?" The good news: you are not. With the right setup you can switch providers at any time without reprinting a single label. This article shows exactly the technical how — and the few things you must demand up front so that a switch stays possible.
The problem: a printed QR "lives forever"
Once you stick the QR code onto the product, the box or the label, it is physically immutable. The product leaves the warehouse, reaches the shop, the customer's home, maybe years later a repair shop or a recycling yard. If something happens to the provider behind the QR — it goes bankrupt, raises prices, discontinues the service, or you simply find a better offer — the nightmare appears: tens of thousands of QR codes on already-shipped products would die at once. Reprint? You cannot recall products that have already been sold to give them a new label.
This vendor lock-in is far sharper with a DPP than with ordinary software: there you "just" migrate to another system. Here the lock-in is burned into the physical world — unless you plan well at the start.
The key insight: the QR encodes an ADDRESS, not data
The most important thing to understand: the product data is not inside the QR code. A DPP QR code does not store the material composition or the carbon footprint — it stores just one thing: a web address (URL). When someone scans it, the phone opens that address, and the provider at that address returns the passport page.
So the real question is: who controls the web address printed into the QR? That decides whether you are locked in or not.
The trap: the provider's own domain in the QR
Most DPP providers print their own domain into the QR by default, something like:
provider.com/p/9f3a1c7b
This is a trap for two reasons:
- The domain is not yours. Only that provider can serve
provider.com. If you switch, every such QR points to a dead link — the new provider cannot answer on behalf ofprovider.com. - The identifier is proprietary too. The
/p/9f3a1c7bis an internal code only the old system understands. The new provider has no idea which product it refers to.
If you don't watch for this when signing the contract, your printed QR codes hold you hostage.
Solution 1: your own domain — the address under YOUR control
The most effective protection: the QR should encode not the provider's domain but yours:
dpp.yourbrand.com/01/05991234567890
Technically this is a simple DNS setting (a so-called CNAME record): you point the dpp.yourbrand.com subdomain at the current provider's servers. For the customer nothing changes — they scan the QR, the passport loads. But the point is behind the scenes:
When you want to switch, you just repoint the DNS to the new provider. The printed QR codes never contained the old provider's name — only yours — so they keep working, forever. Zero reprinting.
One nuance: "just DNS" is about 95% true. The rest is on the receiving provider: it must (1) be able to issue a TLS certificate for your hostname, and (2) serve the same GS1 Digital Link path semantics — down to /01/{GTIN}/21/{serial} for serialized items. Thanks to the standard, this is reasonable to expect from any serious provider (see the last checklist item).
This is the only method by which control over the physical label's address stays with you, not the provider.
Solution 2: GS1 Digital Link — a standard, provider-independent address structure
Notice the /01/05991234567890 part of the address above. It is not random: this is the GS1 Digital Link standard. The 01 is the application identifier for the GTIN (the global trade item number), followed by the GTIN itself — the product's globally unique, provider-independent identifier, which you license from GS1.
This matters enormously for a switch:
- The address structure is a standard, not one company's internal format. Any GS1-compatible provider can serve the same
/01/{GTIN}path. - The identifier is the GTIN, which is yours — not a proprietary internal ID. The new provider knows exactly which product it is from the GTIN.
So with GS1 Digital Link + your own domain, the printed QR is effectively portable: the same address denotes the same product, no matter who serves it behind the scenes.
Solution 3: data portability — the address is only half the story
A working address alone is not enough: the new provider also needs the data. So the third requirement: full export at any time, in machine-readable, standard format (JSON-LD and/or GS1). That way you can take your passports' data out of the old system in a single file and import it into the new one — without re-typing anything.
The red flag to avoid: "export only for a surcharge", "PDF export" (which cannot be imported by machine), or no export at all. If you cannot freely take your data out, the portability of the address is worth nothing.
Solution 4: continuity during the switch
Finally, the chain must not break at the moment of the switch either. A good provider gives a continuity guarantee: on shutdown or a switch it notifies you in advance, keeps the public URLs alive for a period, or redirects them to a new resolver you designate. That way the QR codes never 404 while you migrate.
Checklist: what to demand so you never get locked in
Before you sign with any DPP provider — and especially before you print — ask these five:
- ✅ Can I encode my own domain into the QR? (CNAME-based own domain — control over the address stays with you.)
- ✅ Do I get a standard GS1 Digital Link URL? (
/01/{GTIN}— a standard, not a proprietary path.) - ✅ Is the GTIN mine? (You license it from GS1; the provider does not "give" it to you.)
- ✅ Can I export the full data at any time? (JSON-LD / GS1, machine-readable, with no export lock-in.)
- ✅ Is there a continuity guarantee? (Advance notice + keep-alive / redirect during the switch.)
- ✅ Can the new provider serve my own hostname with TLS and the full GS1 DL path hierarchy? (Down to
/01/{GTIN}/21/{serial}for serialized items too — thanks to the standard, this is reasonable to expect.)
If the answer to all five is "yes", then your printed QR codes are not a trap but durable, provider-independent infrastructure.
How does Veridyn solve this?
We designed Veridyn to be lock-in-free from day one — because we believe that with a good product it is value, not entrapment, that keeps a customer. Specifically:
- GS1 Digital Link on every passport. Every product gets a durable, standard
/01/{GTIN}public URL — not a proprietary identifier. - The GTIN is yours. You license it from GS1; we only serve it. You take it with you when you switch.
- JSON-LD / GS1 export at any time, with no export lock-in. Your data can be taken out in machine-readable form with a single click — anytime, at no surcharge.
- Continuity guarantee. This also covers URLs issued on veridyn.eu: if the service is permanently discontinued, at least 90 days' prior notice, a full export, and the public URLs remain accessible for at least 12 months, or are redirected to a new resolver you designate — so the QR does not die. (Section 13 of the Terms.)
- Your own domain (CNAME) — coming soon: so the QR can encode your
dpp.yourbrand.comaddress instead of veridyn.eu, and a switch becomes just a DNS repoint.
We laid it all out in black and white on the Portability & anti-lock-in page.
In summary
A printed QR code does not mean lifelong lock-in — if you plan well. The formula: your own domain (the address is yours) + GS1 Digital Link (a standard, portable path) + GTIN ownership (a provider-independent identifier) + free export (the data is yours) + a continuity guarantee (the switch breaks nothing). With these, your QR codes do not tie you to one provider — they give you durable, standards-based infrastructure in which you choose who serves them.
See how this looks live on a GS1 Digital Link passport, or get started for free and publish your first portable passport link this week.