Two adopted regulations prohibit tracking or analysing any usage information beyond what is strictly necessary to serve the passport. Scan telemetry's privacy reasoning answers a different half of that rule.
The rule
Toy Safety Regulation (EU) 2025/2509, Art. 20(10), verbatim:
"Economic operators shall not track, analyse or use any usage information for purposes other than what is absolutely and strictly necessary for providing the information on the digital product passport online. In particular, personal data related to the customer shall not be stored in the digital product passport without the explicit consent of the consumer or other end user in compliance with Article 6 of Regulation (EU) 2016/679."
Detergents Regulation (EU) 2026/405, Art. 22(h) says the same in the same two limbs.
🚨 Read the structure. The personal-data rule is the second sentence, introduced by "in particular" — it is an instance of the first, not the whole of it. The first sentence is broader and does not mention personal data at all: no tracking, analysing or using any usage information beyond strict necessity.
What we ship
dpp-types/src/scan.rs and the resolver's scan counter store per-passport, per-day, per-surface resolution counts and serve them as operator statistics.
The module header is admirably clear about what it is:
"The stored records are aggregate counts keyed by (passport, day, surface) only. There is no column for anything about the scanner. The refusal to model an IP/agent/session is enforced by the schema, not by policy prose — there is nothing to leak because nothing to leak is representable."
✅ That fully answers the second sentence. No personal data is representable, let alone stored. It is genuinely good design and nothing here suggests otherwise.
⚠️ It does not answer the first. An aggregate count of how often a passport was resolved is usage information, and analysing it is not "absolutely and strictly necessary for providing the information on the digital product passport online".
The same header concedes the point without meaning to:
"Whether a deployment counts how often its passports are resolved is operational, not part of the DPP standard — the standard defines the public view, not analytics over it."
That sentence is the correct reading of why the port lives engine-side. It is also, read against Art. 20(10), an argument that the analytics are outside strict necessity.
Stated precisely
| Limb |
Posture |
| No customer personal data stored without explicit consent |
✅ Structurally satisfied |
| No tracking, analysing or using any usage information beyond strict necessity |
⚠️ Unanswered |
What this is not
Not a claim the feature is unlawful today. Toys binds from 1 August 2030, detergents from 23 September 2029, and neither rule reaches battery or ESPR passports — no equivalent sentence appears in Regulation (EU) 2023/1542 Art. 78 or in Regulation (EU) 2024/1781 Arts. 10–11.
Not a claim the feature should be removed. For battery and ESPR passports nothing prohibits it.
The finding is that the feature was built against a privacy standard we set ourselves; two adopted regulations set a different and stricter one for two product groups the catalogue models; and nobody has compared them.
Three defensible answers
- Scope the counters by product group — no resolution counting for toy and detergent passports. Cleanest, and the port already keys on passport, so the filter has somewhere to live.
- Argue that aggregate operational metrics fall inside "providing the information online" — capacity planning and availability monitoring are arguably necessary to serve the passport at all — and write the argument down with its limits, so it is a position rather than an assumption.
- Drop resolution counting for consumer-facing product groups generally, on the view that the toys and detergents wording is where the horizontal rule is heading.
⚠️ The one indefensible answer is the current one: no position, in a product whose pitch is that its compliance claims are checkable.
Filed as a decision, not a defect. Nothing needs to change this year; a recorded position does.
Two adopted regulations prohibit tracking or analysing any usage information beyond what is strictly necessary to serve the passport. Scan telemetry's privacy reasoning answers a different half of that rule.
The rule
Toy Safety Regulation (EU) 2025/2509, Art. 20(10), verbatim:
Detergents Regulation (EU) 2026/405, Art. 22(h) says the same in the same two limbs.
🚨 Read the structure. The personal-data rule is the second sentence, introduced by "in particular" — it is an instance of the first, not the whole of it. The first sentence is broader and does not mention personal data at all: no tracking, analysing or using any usage information beyond strict necessity.
What we ship
dpp-types/src/scan.rsand the resolver's scan counter store per-passport, per-day, per-surface resolution counts and serve them as operator statistics.The module header is admirably clear about what it is:
✅ That fully answers the second sentence. No personal data is representable, let alone stored. It is genuinely good design and nothing here suggests otherwise.
The same header concedes the point without meaning to:
That sentence is the correct reading of why the port lives engine-side. It is also, read against Art. 20(10), an argument that the analytics are outside strict necessity.
Stated precisely
What this is not
Not a claim the feature is unlawful today. Toys binds from 1 August 2030, detergents from 23 September 2029, and neither rule reaches battery or ESPR passports — no equivalent sentence appears in Regulation (EU) 2023/1542 Art. 78 or in Regulation (EU) 2024/1781 Arts. 10–11.
Not a claim the feature should be removed. For battery and ESPR passports nothing prohibits it.
The finding is that the feature was built against a privacy standard we set ourselves; two adopted regulations set a different and stricter one for two product groups the catalogue models; and nobody has compared them.
Three defensible answers
Filed as a decision, not a defect. Nothing needs to change this year; a recorded position does.