The video above, about the move from the striped barcode to the 2D barcode, recently went viral, and the reaction to it was louder than the video itself. Scroll through the comments and the same worries surface again and again. Would this be used to scam people? Would the shop grind to a halt when the internet went down? Would the new code follow them around?
Those are fair questions, and they deserve straight answers rather than marketing. So we went through the comments under that video, grouped the recurring fears, and set out to address the seven that come up most. No spin, no scare tactics. Where the honest answer is "it depends on how a brand builds it", we say so.
One note before we start, because it sits under almost every worry on the list. The industry shift people are reacting to is called Sunrise 2027. It is an industry initiative to make retail checkouts able to read 2D barcodes, not a law, not a hard switch-off date, and not something that forces any shopper to do anything differently.
Can product QR codes be used to scam me?
A random QR code sticker can absolutely be used to scam you, but that is exactly the problem a GS1 Digital Link code is built to avoid. The scam people are describing has a name, quishing, and it works because most QR codes are anonymous. Anyone can generate one and slap it over a real one, and the code itself carries no proof of who made it or where it should lead.
A GS1 Digital Link code is a different animal. It is tied to a product's official identity in an accountable chain, issued against a real company that licensed that identity from GS1, and resolved through a known address rather than a mystery URL. A fraudulent sticker slapped on a shelf cannot fake that chain. It can only ever be a copy pointing somewhere it should not, which is the same risk that already exists with printed web addresses and phone numbers on packaging.
The practical advice does not change much either. Be wary of codes stuck on top of other codes, or codes taped to a lamppost or a parking meter. A code printed directly into the packaging by the brand, resolving to that brand's own domain, is the safe end of the spectrum, and that is precisely what the transition is standardising.
What happens when the server is down and I cannot buy milk?
Nothing. You can still buy the milk, because the checkout does not need the internet to ring it up. This is one of the fears that comes up most, and it rests on a misunderstanding of how the code works at the till.
The product's identity, the same number the old striped barcode carries, is printed inside the 2D code itself and read locally by the scanner. The checkout reads that identity off the packaging in front of it, matches it to the store's local price list, and completes the sale. No cloud lookup, no live connection, no dependency on a website being up. If the shop's internet goes down, the till behaves exactly as it does today with the linear barcode.
The web link that a shopper's phone can open is a separate layer sitting in the same code. That layer needs the internet, the same way opening any web page does. But the checkout never touches it. Selling you milk and showing you a product page are two different jobs, and only one of them needs to be online.
What if the code is damaged? Today the cashier can type the numbers
If the code is scratched or torn, it very often still scans, because 2D barcodes are built with error correction that a human typing digits cannot match. This one is a good instinct, because everyone has watched a cashier squint at a crumpled barcode and key in the numbers by hand.
Here is the part that is not obvious. 2D barcodes store redundant data across the whole grid, so a damaged code can reconstruct itself from what survives. Depending on the settings used when the code is generated, a QR code can tolerate a large share of its surface being lost, often up to roughly 30 percent, and still read correctly on the first try. That is why the little squares can survive a smudge, a fold, or a coffee ring.
And the fallback has not gone anywhere. The human-readable product number can still be printed next to the code, exactly as today, so a cashier can type it in on the rare occasion nothing scans at all. The transition removes a common failure, it does not remove the safety net.
Will this make shopping more expensive?
Not because of the barcode itself, and the real cost risk is one most shoppers never see. Printing a 2D code costs a brand essentially the same as printing the old one. The expensive mistake happens behind the scenes.
Many companies are running their move to 2D barcodes and their work on the European Digital Product Passport as two completely separate projects, with two teams, two budgets, and two sets of product data that say almost the same thing. Both efforts depend on the same underlying product information, so building that infrastructure twice is the cost leak, not the ink on the pack.
Brands that treat it as one job, cleaning the product data once and letting both the checkout code and the passport draw from it, spend less and ship sooner.
Is the new barcode going to track me?
The code identifies the product, not the person holding it. This fear carries the most emotion, and it deserves a careful answer rather than a flat denial.
A 2D barcode on a jar of coffee says, in effect, "I am this coffee, from this brand, this batch". It says nothing about you. It has no idea who scanned it, and it cannot. Scanning a code with your own phone does not hand your identity to anyone, any more than reading a label does.
Tracking, when it happens, is a software choice a company makes on top of the code, the same choice they could already make with a website, a loyalty card, or a cookie. The symbol on the pack is not the thing that tracks you. The barcode is neutral, and the questions worth asking are about a brand's privacy practices and its app, exactly the questions you would ask of any company handling your data.
Does Sunrise 2027 force brands to put URLs on everything?
No. Sunrise 2027 does not force a web link onto any product. This is a point of genuine confusion, even among people in the industry.
The mandatory piece of Sunrise 2027, to the extent anything is mandatory in an industry initiative, is on the retailer's side: checkouts becoming able to read 2D barcodes. What a brand chooses to encode in its code is a separate decision. A GS1 Digital Link, the format that lets a single code carry a web address alongside the product identity, is optional. A brand can move to a 2D code that carries nothing but the same identity the old barcode held, and still be ready for the till.
So the accurate statement is narrow. Retail is preparing its checkouts to read 2D codes. Brands decide whether their code also opens a web page. Nobody is compelled to put a URL on anything.
That said, not mandatory is not the same as no pressure. The real deadline is commercial rather than legal. As retailers move their checkouts to 2D, they increasingly expect the products they stock to be ready, and a brand that lags can quietly lose the shelf to one that is prepared. The law is not forcing the change. The market is.
I am a brand. What should I actually do before 2027?
Start with your product data, because everything else depends on it being correct. The barcode is the easy part, and the data behind it is the work. Here is a sensible order of operations.
| Step | What it means | Why it matters |
|---|---|---|
| Fix your product data first | Make sure your identifiers, attributes and content are accurate and consistent | Both the checkout code and any passport draw from this; errors here multiply everywhere else |
| Plan one transition, not two | Scope your 2D move and your Digital Product Passport work as a single programme | Building the same data infrastructure twice is the real cost, as covered above |
| Test a dual-code phase | Run the old linear code and the new 2D code together with retail partners | Lets checkouts and shoppers adapt without a risky overnight switch |
None of this requires panic buying or a rushed rollout. The 2D code you choose can be a QR code or a Data Matrix depending on your product and surface, and the smart brands are using the runway to get the data right rather than racing to a deadline that, for Sunrise, does not legally exist.
If you want to see how a single Digital Link code can serve the checkout and the consumer at once, you can create a free account and try it.
Frequently asked questions
Are QR codes on products safe?
Yes, when they are part of an accountable system. The risk people worry about, a fake sticker leading somewhere malicious, comes from anonymous codes anyone can print. A GS1 Digital Link code is tied to a product's official identity and resolves through a known address, which a fraudulent sticker cannot fake. As always, be cautious of codes stuck on top of other codes or in odd public places.
Is Sunrise 2027 a legal mandate?
No. Sunrise 2027 is an industry initiative to make retail checkouts able to read 2D barcodes. It is not a law, and it is not a hard switch-off date for the old barcode. Do not confuse it with regulation such as the European Digital Product Passport, which is a separate legal framework and applies first to batteries from 18 February 2027.
Do I need to put a URL on my product?
No. A GS1 Digital Link, the format that carries a web address, is optional. A 2D barcode can carry the same product identity the old linear barcode held and nothing more, and still work at a 2D-capable checkout. Adding a web link is a choice, not a requirement.
Will the checkout stop working if the internet goes down?
No. The product identity is printed inside the 2D code and read locally by the scanner, matched against the store's own price list. Ringing up a sale needs no live connection. Only the optional web page a phone might open depends on the internet, and the checkout never touches that layer.
