QR codes in retail and the supply chain

The striped barcode on a tin of beans holds one number: which product it is. That number was enough for fifty years of checkouts. It is not enough for a recall of one batch, a best-before date the till can check, or a shopper who wants to know what is in the tin. The retail industry’s answer is to put a QR code on the pack that carries all of that, and to make every till able to read it by the end of 2027. This article explains the pieces.

The problem with the stripes

An EAN-13 or UPC barcode carries the Global Trade Item Number, the GTIN. It identifies a product type: every tin of a given brand and size has the same number. It cannot say which factory, which day, which batch. When a batch is recalled, the retailer has to pull every tin because the till cannot tell them apart.

A QR code can carry hundreds of characters. That is room for the GTIN plus batch, expiry and a serial number, and room for a web address a shopper’s phone can open. The question was how to structure that text so a till, a warehouse scanner and a consumer phone all understand it. GS1, the not-for-profit body that issues GTINs, wrote the answer.

GS1 Digital Link

GS1 Digital Link is a way of writing GS1 identifiers as an ordinary web address. The product number becomes a path segment, and extra identifiers become further segments or query parameters. An illustrative example:

https://id.example.com/01/09506000134352/10/ABC123?17=271231&21=SN0001

The clever part is that it is a URL. A shopper’s phone camera opens it like any link and lands on a product page. A till that understands Digital Link parses out 01/09506000134352 and rings up the product exactly as if it had read the stripes. A warehouse scanner reads the batch and expiry. One code, three readers.

GS1 US describes the model on its Sunrise 2027 pages: brands add 2D codes carrying GS1 Digital Link with the GTIN to their packaging, and retailers install scanners that can extract the GTIN from them (GS1 US).

Sunrise 2027

Sunrise 2027 is GS1’s industry programme with a single target: by the end of 2027, every retail point-of-sale should be able to scan 2D codes as well as the linear barcode (GS1 US). The name echoes “Sunrise 2005”, the earlier GS1 US initiative under which North American tills had to accept 13-digit EAN codes as well as 12-digit UPC from 1 January 2005 (Barcode Graphics).

What it does not mean:

• It does not remove the stripes. GS1 advises brands to add a 2D code alongside the EAN/UPC for a long transition.
• It is not a law. It is a target agreed by retailers, brands and GS1. Nobody fines a shop for a scanner that cannot read QR codes in January 2028; that shop simply cannot ring up products that only carry a 2D code, when such products appear.
• It does not say which 2D code. Two are named: a QR code carrying GS1 Digital Link, and GS1 DataMatrix.

Figures around Sunrise come mainly from GS1 and from label-printing vendors. GS1 US’s 2025 consumer survey reported that 79% of consumers were more likely to buy a product whose QR code gave more information (GS1 US). GS1 is promoting the change, so read that as an industry-body figure. Vendor pages such as Videojet’s summarise the timetable but sell the printers that go with it.

GS1 DataMatrix or QR code?

Both carry the same GS1 data, and the choice is mostly history and space.

Data Matrix has an L-shaped finder along two edges instead of three corner squares, so it fits more data into a small square and survives a lost corner less badly. European medicines rules adopted GS1 DataMatrix for prescription packs before QR codes were common at the till, and it is now fixed there. Its weakness for consumer goods is that it normally carries raw GS1 data rather than a URL, so a shopper’s phone reads a string of numbers and does nothing useful.

A QR code with Digital Link is the consumer-facing choice. It is larger for the same data, but on a cereal box that does not matter, and it opens a web page on any phone.

Serialisation and recalls

Serialisation means every unit gets its own number, the AI 21 field above, instead of only every product type. It is what turns a recall from “every tin” into “these 4,000 tins from line 3 on 14 March”. Prescription medicine packs in the EU have been serialised since 9 February 2019 under the Falsified Medicines Directive, with product code, serial, batch and expiry in a GS1 DataMatrix (TraceLink); that system is the working model for what Sunrise brings to groceries.

Three things serialisation makes possible:

1. A targeted recall. The till refuses only the affected serials and the retailer’s app tells only the customers who bought them.
2. Anti-counterfeiting. A serial that has already been scanned at a till in another country is a fake.
3. Expiry at the checkout. With AI 17 in the code, the till can block a sale of expired stock or discount short-dated items automatically.

The digital product passport programme in the EU builds on the same identifiers, which is why GS1 Digital Link is the expected carrier for those too.

What changes at the till

For the shopper, nothing visible: the cashier scans the pack, it beeps. Behind the beep the scanner is now a camera rather than a laser, because a laser cannot read a 2D code. GS1 US keeps a readiness table of scanner models from the main manufacturers (GS1 US).

For a small brand the checklist is short:

• Keep the EAN/UPC. Add a QR code carrying a GS1 Digital Link with your GTIN.
• Use a domain you control for the link, so it keeps working when you change web agency.
• Print at a size the till can read: modules of 0.5 mm or more, with the quiet zone, and dark on light. The size calculator does the sums.
• Test it on a phone and, if your retailer will allow, on their scanner.