How Long Must a QR Code Link Keep Working? What EU Rules Say

2026-10-17 regulation digital label qr code link

No single rule answers this. In the EU rules compared below, how long the information behind a product's QR code or other data carrier must stay available depends on the product. Digital labels and passports under the CLP amendment, the toy safety regulation and the detergents regulation have a 10-year period (the CLP amendment says at least 10 years). The ecodesign regulation says at least the expected lifetime of the product. For wine, a Commission Q&A from 2023 points to the period the wine is expected to stay fit for consumption.

In each text, the duty sits with the manufacturer, supplier or other operator responsible for the information. This is not legal advice; check the original text that applies to your product and region.

Facts checked on 17 October 2026.

The rules and their periods, side by side

Rows paraphrase the texts published in the Official Journal; "Applies from" is the date each text states, where it states one.

Rule	Applies from	How long the information must stay available	Source
Digital product passport (ESPR, 2024/1781)	Per product group, once delegated acts are adopted	At least the product's expected lifetime; each delegated act sets the exact period. Also after the operator's insolvency, liquidation or end of EU activity	Arts 9(2)(i), 11(e)
Battery QR code and passport (2023/1542)	18 February 2027	No fixed number of years. Stays available if the responsible operator ceases to exist or ceases its activity in the EU; ends once the battery is recycled	Arts 13(6), 77, 78
Wine e-label for ingredients and nutrition (2021/2117)	8 December 2023	The regulation names no period. The Commission's Q&A (technical replies, not an authoritative interpretation) says: at least as long as that category of wine is expected to remain suitable for consumption	Art. 1(32); Q&A, Q40
Digital label, voluntary (CLP, 2024/2865)	1 July 2026	At least 10 years, or longer where other EU law requires	Art. 34b(1)(c)
Toy digital product passport (2025/2509)	1 August 2030	10 years after the toy is placed on the market, including after the operator's insolvency, liquidation or end of EU activity	Art. 19(2)(g)
Detergent and surfactant digital label (2026/405)	23 September 2029	10 years from placing on the market, with the same insolvency wording; longer if other EU law requires	Art. 19(1)(g)

How to read it:

Of the six regulation texts in the table, only the battery regulation requires a QR code in its operative articles (we searched each text for "QR"). The ecodesign text mentions QR codes only in its recitals, and the Commission's passport FAQ says each product group's delegated act will specify the carrier. The CLP, toy and detergent texts say "data carrier"; the wine regulation says "electronic means".
Passport timelines are indicative. The Commission's passport page says so itself, and says operators will have at least 18 months after a delegated act.

Who has to keep the link alive

In each row the duty falls on a named party: the economic operator responsible for a passport, the supplier of a substance or mixture, the toy manufacturer, or, in the wine Q&A, the business operator responsible for the food information. A QR code generator or redirect service is none of these, and none of the texts mentions one.

The passport rules also ask for more than a working link. The ecodesign regulation and the toy rule both require a back-up copy of the passport through a passport service provider. The ecodesign text requires the data carrier and its identifier to follow the ISO/IEC 15459 standards where relevant, and the battery text names the same series ("or their equivalent"). In our reading, a redirect is not a back-up copy of a passport: it only forwards visitors to another address and stores no passport data.

Wine, CLP and detergents also limit tracking

Wine: the regulation says no user data may be collected or tracked. The Q&A adds that consent is no exception and that access should be direct, without forms or intermediate sites. It does not say whether a short-link redirect counts as one.
CLP and detergents: tracking, analysing or using usage information beyond what is absolutely necessary for the digital label is prohibited.

QR Maker AI records scan statistics for dynamic codes (country, device type, browser and similar). Whether that conflicts with a given clause is for a professional to say, but it is why we do not suggest dynamic codes from us for these labels. A static code that encodes the address directly has no redirect service in the middle, though the page it opens can still track visitors. For scan-data practices in general, see QR code tracking and privacy.

What GS1 recommends for the link itself

GS1, which defines the GTIN product numbers used in retail barcodes, recommends (2023) that the web addresses in its product QR codes sit on a domain name you own and control, and notes that such codes need no reprint if the brand is sold. It also recommends redirection, so you can change where the code leads without changing the packaging. Its redirection guide (2024) advises asking providers of a "dynamic QR solution" to use your domain rather than theirs, and recommends the temporary redirect code 303. GS1's Digital Link page puts the benefit this way: content can be updated "without the need to change the QR Code".

These are GS1 practices for codes that carry a product's GTIN in the address, not EU legal requirements.

A checklist for a code that must outlast the print run

Read the clause for your product group: the period, what the code must lead to, and whether tracking is restricted.
Print an address on a domain you own, not on a service's domain.
Put a redirect between the code and the page, so a moved page means a changed redirect, not a reprint. Check first that your rule allows it: the wine Q&A asks for direct access without intermediate sites.
Keep the destination alive for the whole period: calendar the domain renewal, hosting and page address.
Scan a printed sample on a schedule and follow the link to the end. QR code link rot covers what usually breaks.
Where the rule demands a passport back-up, arrange it through a digital product passport service provider, as the ecodesign and toy texts require.

Where a dynamic code helps, and where it does not

Outside the wine, CLP and detergent labels above, a dynamic code from QR Maker AI supplies step 3: it holds a short link, and the next scan after you edit the destination goes to the new address. The dynamic vs static guide explains the difference. Its Business plan adds one custom short-link domain on a subdomain you own, such as go.example.com (pricing), which matches step 2.

That does not make a code compliant with any row above. The short links are not GS1 Digital Link addresses or ISO/IEC 15459 identifiers, redirects use 302 rather than the 303 GS1 recommends, scans are recorded, and the destination page is yours to host and keep. A dynamic code also depends on the provider and your account with it; Do QR Codes Expire? lists what to ask any provider before you print. For packaging in general, see QR codes for product packaging; to try the redirect step, create a code.

FAQ

How long does a QR code link have to stay active under EU law?

No single period applies. The toy safety regulation, the detergents regulation and the CLP amendment set 10 years (CLP: at least 10), the ecodesign regulation at least the product's expected lifetime, and the battery regulation no fixed number of years.

Can a wine label link to the winery's website?

For the mandatory ingredients and nutrition information, the Commission's 2023 Q&A answers no for a link to the producer's homepage: a producer's website is typically expected to contain marketing content, and websites normally track users. The Q&A is from November 2023, says it is meant to assist national authorities and businesses, and says only the Court of Justice can authoritatively interpret EU law, so check with your national authority.

Does a dynamic QR code meet these requirements?

A code generator cannot make a label compliant by itself. The duties fall on the operator, some rules need a passport back-up, and others restrict tracking. Ask a professional.

Is a QR code mandatory on EU products?

Only where a rule says so. The battery regulation requires one on all batteries from 18 February 2027; the other rules above speak of a data carrier or electronic means.

Sources

Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2024/2865 (CLP amendment). Published 20 November 2024. Accessed 17 October 2026.
Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2025/2509 (toy safety). Published 12 December 2025. Accessed 17 October 2026.
Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2026/405 (detergents and surfactants). Published 2 March 2026. Accessed 17 October 2026.
Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2024/1781 (ecodesign for sustainable products). Published 28 June 2024. Accessed 17 October 2026.
European Commission — Questions and answers on the implementation of new EU wine labelling provisions (C/2023/1190). Published 24 November 2023. Accessed 17 October 2026.
Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2023/1542 (batteries). Published 28 July 2023. Accessed 17 October 2026.
Official Journal of the European Union (EUR-Lex) — Regulation (EU) 2021/2117 (wine labelling amendments). Published 6 December 2021. Accessed 17 October 2026.
European Commission — Digital Product Passport: Explore our FAQs. Manuscript completed February 2026 (1st edition). Accessed 17 October 2026.
European Commission — Digital Product Passport. Undated. Accessed 17 October 2026.
GS1 AISBL — Best practices for creating your QR Code powered by GS1. Copyright 2023, undated. Accessed 17 October 2026.
GS1 AISBL — Redirection: from scan to content. Copyright 2024, undated. Accessed 17 October 2026.
GS1 AISBL — GS1 Digital Link. Undated; lists URI syntax 1.7.0 (Aug 2026). Accessed 17 October 2026.