GTINs in GS1 Digital Link QR codes

This page is the technical reference for putting a GTIN into a QR code that a retail till can scan and a phone can open. It covers the identifier, the URI that carries it, what each kind of scanner does with it, and what to check before artwork goes to print. The generator itself is described in Create a Digital Link.

It follows GS1 Digital Link URI Syntax 1.7.0 and the GS1-Conformant Resolver Standard 1.2.1, both ratified in August 2026, and the GS1 General Specifications 26.0. Where this page and a standard disagree, the standard wins.

Why the till is changing

Sunrise 2027 is the industry target, coordinated by GS1, for retail point-of-sale systems to accept GS1 2D barcodes, alongside the EAN-13 and UPC-A barcodes they already read, by the end of 2027. For consumer goods the 2D symbol in question is a QR code carrying a GS1 Digital Link URI, because the same symbol also opens in a phone's camera. GS1 DataMatrix, which carries GS1 element strings rather than a web address, remains the norm in healthcare and is not covered here.

It is a readiness date for scanners, not a withdrawal date for linear barcodes. A pack that carries only a 2D barcode is safe only once every retailer that sells it scans 2D at every till; until then, the two symbols live side by side on the pack. The migration section below covers that period.

The timeline, the retailers involved and what to prepare are covered on the blog, in GS1 Sunrise 2027: the QR code deadline, and what to prepare in 2026. This page sticks to the encoding.

From barcode number to 14 digits

A GTIN comes in four lengths. A Digital Link URI accepts only one of them.

GTIN-8 (EAN-8): small packs where an EAN-13 does not fit.
GTIN-12 (UPC-A): mainly North America.
GTIN-13 (EAN-13): consumer units in the rest of the world.
GTIN-14: trade units, such as cases and outers, where the first digit is an indicator for the packaging level.

Since version 1.4.0 of the URI syntax, the GTIN in a Digital Link URI is always written with 14 digits: a GTIN-8, GTIN-12 or GTIN-13 is padded on the left with zeros. The alphabetic shorthand /gtin/ in place of /01/ was deprecated in 1.2 and removed in 1.3.0. Both older forms are legacy, and new scanning software is not expected to accept them.

Padding does not change the number. The same GTIN, as printed under the linear barcode and as written in the URI:

GTIN-8 01234565 → /01/00000001234565
GTIN-12 614141000012 → /01/00614141000012
GTIN-13 9520123456788 → /01/09520123456788

The check digit is the last digit, and padding leaves it valid because it is computed from the right. Leave the check digit aside, multiply the remaining digits by 3 and 1 alternately, starting with 3 on the digit next to it, and add them up. The check digit is whatever brings that sum up to the next multiple of ten. For 952012345678 plus its check digit: the weighted sum is 102, so the check digit is 8.

A wrong check digit does not stop a phone: the URI opens regardless. It stops the till, which validates the GTIN it parses out of the code. The generator checks the GS1 data before it produces a code, which is one reason to build Digital Link URIs with a tool rather than by hand.

Three rules about which GTIN goes in the code:

It must be yours. The GTIN has to come from your GS1 Company Prefix or a single-GTIN licence from your GS1 Member Organisation. Validation checks the structure, not the owner: a well-formed GTIN that is not licensed to you still makes a QR code that opens, but retailers' systems and Verified by GS1 will not match it to your company.
It must identify the unit it is printed on. A code on a consumer unit carries the consumer unit's GTIN, the one the till prices. A GTIN-14 belongs on the case it identifies.
A new barcode does not mean a new GTIN. Adding a 2D barcode to existing artwork is a change of marking, not of product. Under the GTIN Management Standard, the GTIN changes when the product does, not when its barcode does.

Anatomy of the URI

A GS1 Digital Link URI is an ordinary HTTPS address. What makes it a Digital Link is that its path and query string carry GS1 Application Identifiers (AIs) and their values in a fixed grammar:

https://id.example.com/01/09520123456788/10/ABC1/21/12345?17=271231

https://id.example.com: any domain. It decides where a phone goes, not what the product is. The identity is everything after it.
/01/09520123456788: the primary key, which is AI (01) followed by the 14-digit GTIN. It always comes first.
/10/ABC1/21/12345: key qualifiers, which narrow the GTIN to a variant, a batch or a unit. The three available for a GTIN are (22) consumer product variant, (10) batch/lot and (21) serial number. All are optional, but any that are present must appear in that order: /21/…/10/… is invalid.
?17=271231: data attributes, in the query string and keyed by their AI. Here (17) is the expiry date as YYMMDD. Attributes describe the item; they do not identify it, which is why they never go in the path. A URI such as /01/…/17/271231 is malformed.

That URI holds exactly the same data as the GS1 element string (01)09520123456788(17)271231(10)ABC1(21)12345, the form a GS1 DataMatrix or a GS1-128 barcode would carry. Scanning software can convert one into the other without a network connection.

Four rules catch most hand-built URIs:

Values are case-sensitive. ABC1 and abc1 are two different batches. Only the scheme and the domain are case-insensitive.
Reserved characters are percent-encoded inside a value. A lot written A/1 is encoded as A%2F1; likewise # becomes %23, % becomes %25, & becomes %26 and + becomes %2B.
Nothing needs to come before the AIs. A path prefix such as /products/ is permitted, but it identifies nothing and every character of it enlarges the symbol.
linkType and context are reserved. They are query-string keywords for the resolver, described below, and cannot be used for anything else.

Every Digital Link URI also has a canonical form: the same AIs on https://id.gs1.org, with linkType and context removed. Two codes on two different domains that reduce to the same canonical URI identify the same thing. The example above reduces to:

https://id.gs1.org/01/09520123456788/10/ABC1/21/12345?17=271231

What happens at the till

A 2D-capable till does not go online to ring up a product. The scanner decodes the QR code and reports it with the symbology identifier ]Q1, the one for a plain QR code. Its software then recognises the decoded text as a GS1 Digital Link URI by its structure, extracts the AIs from the path and the query string, and passes the host system the same data a linear barcode would have produced, GTIN first. The price lookup runs locally, as it always has.

That is why the grammar is strict: the till is parsing the URI, not browsing to it. A code with a 13-digit GTIN, the /gtin/ shorthand or qualifiers out of order may still open on a phone and fail at checkout.

It is also why an ordinary dynamic QR code cannot stand in for a Digital Link one. A short URL such as opn.to/abc123 carries no GTIN, so there is nothing for the till to read.

Encoding a batch (10) or an expiry date (17) lets a till do what an EAN cannot, such as refuse to sell an expired or recalled batch. It works only if the retailer's system acts on that data, and it means the code changes with every batch: the pack becomes a variable-data print job rather than a fixed plate.

What happens on a phone

A phone's camera sees an HTTPS address and opens it. The request reaches the resolver behind the domain, which decides where to send it. For a Unitag Digital Link, that resolver is Unitag's. The GS1-Conformant Resolver Standard fixes how it behaves:

One default link. Every identifier has exactly one default link, and a plain scan is redirected there.
A requested link type, or a 404. A client can ask for a specific kind of content with the query parameter linkType, for example linkType=gs1:allergenInfo. If an active link of that type exists, the resolver redirects to it. If none does, the resolver answers 404 Not Found; it does not fall back to the default link, which is a change from Digital Link 1.1.
The linkset on request. linkType=linkset, or an Accept: application/linkset+json header, returns every link for the identifier as a linkset (RFC 9264) instead of redirecting.
The query string is passed on. Data attributes in the URI reach the destination page with the redirect.
A description file. A conformant resolver publishes a JSON description of itself at /.well-known/gs1resolver on its domain. Unitag's is public:

https://opn.to/.well-known/gs1resolver

Link types are terms from the GS1 Web Vocabulary, such as gs1:pip for the product information page, gs1:nutritionalInfo or gs1:recallStatus. They are set on a code's Link types tab, described in Manage Digital Links. The Read more articles at the end of this page cover what each type is for and how fallback down the identifier hierarchy works.

Printing it on the pack

The URI is fixed the moment the plate is made. Everything that can change afterwards, such as destinations, link types and languages, lives at the resolver. That split decides what belongs in the code:

A domain you own and will keep. The URI is on the pack for the product's whole life, so the domain has to resolve for as long. GS1 recommends the brand's own domain, ideally a dedicated subdomain such as id.; a branded domain can be selected in the generator.
The shortest URI that does the job. Every character adds modules to the symbol. Encode the AIs a trading partner will read and nothing else; campaign parameters belong at the resolver, not in the code. The scheme and domain are case-insensitive, and upper case encodes more compactly in a QR code, but the rest of the URI is case-sensitive.
Sized for the till, not the phone. The GS1 General Specifications give minimum, target and maximum module sizes (X-dimension) for QR codes scanned at retail point of sale. A phone reads codes that a fixed checkout scanner will not, so a symbol that passes a phone test can still fail at the till.
Quiet zone. ISO/IEC 18004 requires four modules of clear space on every side of a QR code. Artwork that intrudes on it is among the most common causes of a failed scan.
Error correction. A higher level survives scuffs and curvature, but makes the symbol denser at the same size. Choose it for the substrate and the handling, then re-check the module size.
Human-readable text. The GS1 General Specifications and the GS1 HRI Guideline govern what is printed beside the symbol, the GTIN in particular. Follow them rather than printing the whole URL.
One 2D code per pack. GS1's aim is a single 2D barcode that serves both the till and the phone. A separate marketing QR code next to it leaves both the cashier and the shopper with two symbols to choose between.
Verify the print. Grade printed samples against ISO/IEC 15415 with a barcode verifier, and test-scan on your retailers' own checkout hardware where you can.

Migrating from a linear barcode

The transition is dual-marked, and each rule for the period protects the till:

Keep the EAN-13 or UPC-A and add the Digital Link QR code, for as long as any retailer you sell through still scans linear barcodes only.
Put the same GTIN in both. A pack whose two barcodes disagree rings up as whichever the till happens to read.
Agree the change with each retailer, including which symbol its tills read when both are present.
Remove the linear barcode last, once every retailer has confirmed 2D scanning at every till and your GS1 Member Organisation's guidance for the market allows it.

A pack that already carries an ordinary marketing QR code moves to Digital Link at its next artwork change: the Digital Link code replaces it, and the old code keeps working for as long as you keep its destination live.

Before artwork sign-off

Check each of these against the printed proof, not the design file:

The GTIN is licensed to you and allocated to this exact unit.
It follows /01/ as 14 digits, with a valid check digit.
Any qualifiers appear as /22/, /10/, /21/, in that order, with reserved characters percent-encoded.
The query string holds only data attributes a trading partner will read.
The domain is HTTPS, belongs to you, and will outlive the product.
A plain scan lands on a page about this product, not on a home page.
If a linear barcode is still printed, it carries the same GTIN.
Module size, quiet zone and error correction follow the GS1 General Specifications, and printed samples have been verified.

Unitag: compliant and certified

Unitag's Digital Link application is fully compliant with the GS1 standards on this page, and certified by GS1:

Compliant URIs. Every code it generates is a GS1 Digital Link URI as defined by the URI Syntax standard: a 14-digit GTIN, qualifiers in order, data attributes in the query string, and GS1 data validated before the code is created.
A conformant resolver. Unitag's resolver implements the GS1-Conformant Resolver Standard: a default link, link types, a 404 for a link type that is not configured, and a public resolver description file.
Certified by GS1. Unitag passed the GS1 France qualification covering the GS1 Digital Link URI Standard structure and the QR Code symbol, and is listed as a GS1 France Solution Provider.

A certificate names who issued it and what it covers. The certification article under Read more explains how to check both for any vendor, Unitag included.

Elsewhere in this documentation:

On the Unitag blog, for the context around this page:

Official sources

The GS1 documents this page is based on. The standards on ref.gs1.org are the normative text; the pages on gs1.org introduce them.