Why GS1 Sunrise 2027 and EU DPP Compliance is a Headache for Brand Protection

By Mark Manning, iTRACE Technologies, Inc. and Lauren Moïse, AlpVision

Introduction: The Brand Protection Gap in Connected Products

As the global manufacturing and retail landscapes prepare for the dual deadlines of GS1's Sunrise 2027 and the European Union’s Digital Product Passport (DPP) mandate, a fundamental shift in product data and consumer interaction is underway. Under the Ecodesign for Sustainable Products Regulation (ESPR), most products sold in Europe must soon carry a two-dimensional data carrier to provide detailed information on material composition and environmental footprint. However, the brand protection industry is warning of a critical void in this transition: real product security. Brands are mistaking regulatory compliance for absolute security, treating the new mandates as a "floor" for transparency rather than a "ceiling" for brand protection. Because standard data carriers can be copied or transferred, the connection between the digital record and the physical product remains vulnerable to counterfeiting, grey market diversion, and unauthorized production overruns. Technologies from iTRACE and AlpVision can address this gap by securing the digital link and data carrier, as well as the physical product or packaging itself, helping verify that the DPP is being accessed from a genuine item.

What's New with the EU DPP: July 2026 Standards and Registry

The EU’s Digital Product Passport (DPP) represents a sweeping regulatory effort to improve supply chain visibility, support circularity, and expand consumer access to product-lifecycle information. While established in 2024, the DPP framework took a massive leap forward in July 2026, when several crucial elements became operational. On July 15, 2026, the European Commission published references to six harmonized DPP standards. These guidelines cover data-exchange protocols, unique identifiers, data carriers, data storage, APIs, and system interoperability, establishing a concrete technical foundation for technology providers. Additionally, the Commission finalized the decentralized DPP Registry and launched its testing environment, allowing companies to register core identifiers while maintaining actual product data on decentralized servers. While the DPP framework accommodates multiple carrier types—including QR codes, NFC, and RFID—it dictates product-specific rules at the model, batch, or item level. Yet, these standards only establish mechanisms to exchange digital records; they do not prove that the physical item carrying the code is genuine.

Sunrise 2027: The Evolution of Retail Data Carriers

In parallel with regulatory shifts, the retail sector is undergoing a massive voluntary modernization known as Sunrise 2027. Established by GS1, this initiative outlines an industry goal for retail point-of-sale systems to scan and process two-dimensional barcodes—such as QR Codes with GS1 Digital Link —by the end of 2027. Unlike traditional UPC and EAN barcodes that only identify product categories, these 2D carriers hold serialization data, and digital links. The initiatives intersect dynamically because a single GS1 Digital Link QR code can serve as both the point-of-sale barcode and the access point for regulatory DPP content. While consolidating these functions is efficient, it also hands the counterfeiters a simple way to scam consumers at massive scale. As systems and consumers rely more heavily on this printed code, copying or altering that barcode carries severe, wide-ranging operational consequences across the supply chain.

Identification vs. Authentication: The Copying and Redirection Threat

The fundamental flaw in standard DPP and Sunrise 2027 planning is the confusion between digital identification and physical authentication. A digital product identifier simply communicates which model, batch, or item a code represents. It is a system tool to retrieve records, but it does not prove that the physical product carrying that identifier is authentic. Physical authentication means verifying that the item in hand is genuine, rather than simply confirming what its identifier claims it to be. This can be achieved by verifying a security feature applied to the product or packaging, or by authenticating an intrinsic physical characteristic of the item itself. Standard, open-source QR codes are easily duplicated, scanned, or physically transferred from genuine packages to counterfeit, refilled, or diverted items. A counterfeiter can copy a single valid serial number and apply it to thousands of fake products. This vulnerability led to the high-profile failure of the Top 300 drug program in India, where standard QR codes failed to stop counterfeit pharmaceuticals because they lacked a secure, non-cloneable physical authentication layer. Beyond simple cloning, criminals have weaponized QR codes through "quishing" (QR phishing) and "QR-jacking", where attackers place malicious sticker overlays over legitimate QR-Codes. When consumers scan the code, they are redirected to a fraudulent site designed to harvest credit card data or deploy malware. Traditionally scan analytics have helped identify suspicious patterns, like repeated scans of the same identifier in different locations, but these signals only appear after fake goods have already entered circulation, leaving brands vulnerable to immediate damage. In today’s world this is no longer seen as an effective anti-counterfeit tool when more sophisticated options are available and necessary.

Legal Liability and Reputational Risks for Economic Operators

This security gap has profound liability implications for brand owners. Under the ESPR, the legal and financial responsibility for the accuracy and compliance of the passport lies with the economic operator who first places the product on the EU market. Brands are left "liable but powerless" if a counterfeiter clones their valid QR codes, directing customers to look-alike DPP interfaces with fabricated sustainability claims. While "greenwashing" under EU Directive 2024/825 carries hefty fines of up to 4% of annual turnover, counterfeit DPPs present far worse threats. In sectors like pharmaceuticals, medical devices, and aerospace, fake products pose catastrophic life and safety risks. Cyber-fraud is another major threat, with documented scams from Quishing and QR-Jacking of parking meters causing significant financial loss from a single malicious scan. To mitigate these exposures, companies must involve legal, brand-protection, IT, compliance, and packaging teams in the initial carrier and system design stages. Brands must actively evaluate if data carriers can be copied, cloned or QR-Jacked and who will manage security escalations.

Closing the Security Gap: Advanced Non-Cloneable Technologies

To bridge this gap, advanced security layers must supplement standard compliance, as explicitly recommended by the proposed DPP specification EN 18246. Two industry leaders, iTRACE Technologies and AlpVision, offer robust, third-party authentication technologies. iTRACE specializes in a proprietary technology called iTRACE 2DMI®, often described as the "HTTPS" of 2D codes. Printed as small as 100 microns directly on labels, packaging or physical products, iTRACE 2DMI® uses encrypted keys unique to each deployment, making them immune to spoofing and unauthorized redirection. AlpVision provides digital authentication technologies that verify whether a data carrier remains linked to the genuine product or packaging. Cryptoglyph® embeds an invisible security feature directly into printed packaging or labels using standard printing processes, while AlpVision Fingerprint® authenticates a product through the naturally occurring microstructure of its surface. Smartphone-based verification can then provide a physical authentication layer alongside DPP and track-and-trace systems, helping brands detect counterfeiting, diversion, and other suspicious activity.

Strategic Outlook: Maximizing ROI Beyond Compliance

In the era of DPP & Sunrise 2027, basic compliance is only the starting line; secure physical authentication is the true business strategy. Proactively adding security layers generates a clear ROI by preventing grey market diversion, validating product returns to stop false warranty claims, and controlling OEM factory production overruns. How will your organization bridge the gap between compliance and true physical product security? Who in your company is currently bridging the data and brand protection silos before the compliance deadlines arrive?

#Quishing #QRJacking #BrandProtection #Counterfeit #Authentication #SupplyChainSecurity #IllicitTrade #Diversion