What Actually Happens When Someone Scans Your QR Code?

GS1 Digital Link QR Codes Resolver Technical How It Works
What Actually Happens When Someone Scans Your QR Code?

Every article you have read about Sunrise 2027 focuses on the QR code. The shape of the squares. The encoding format. Where to put it on the package. How to make it scannable under shrink wrap.

Nobody explains what happens after the scan.

That is a problem, because the QR code is the least interesting part of the entire system. It is a printed image. It does one thing: encode a URL. The real work - the part that determines whether your packaging investment pays off for the next decade - happens in the infrastructure behind that URL.

Let us walk through it, step by step, so you can see exactly where the value lives and why it is not in the barcode.

Anatomy of a Scan

A consumer is standing in a grocery store. They pick up a jar of olives, see a QR code on the label and point their phone camera at it. Here is everything that happens in the next 300 milliseconds.

Step 1: The phone extracts a URL

The phone’s camera decodes the QR code and finds a URL. Not a product page. Not a marketing landing page. A URL that looks like this:

https://gtin.one/01/09506000134352/10/ABC123

This URL follows the GS1 Digital Link standard. It is structured, not arbitrary. The path segments encode specific identifiers:

  • /01/09506000134352 - the GTIN (Global Trade Item Number), the universal product identifier that replaces the old UPC barcode number
  • /10/ABC123 - the batch or lot number for this specific production run

The phone does not know or care about any of this. It sees a URL and offers to open it in the browser. The consumer taps.

Step 2: The request hits a resolver

This is where everything interesting happens.

The browser sends an HTTP request to gtin.one. That domain is not a product page. It is not a marketing site. It is a GS1 Digital Link Resolver - a specialized piece of infrastructure whose entire job is to look at the request, figure out what the scanner needs and send them to the right place.

The resolver inspects several things simultaneously:

The identifiers in the URL. The GTIN tells the resolver which product this is. The lot number tells it which batch. If a serial number were included, it would know the exact individual item. These are not decorative path segments - they are structured data that the resolver uses to make routing decisions.

Who is scanning. The HTTP Accept header tells the resolver what kind of client is making the request. A consumer’s web browser sends text/html. A point-of-sale system might send application/json. A supply chain application might request application/linkset+json to get the full set of available links for this product. The same QR code serves all of them differently.

Where they are scanning from. The request includes geo-location signals - IP address, language headers and sometimes explicit locale parameters. A consumer in Germany and a consumer in the United States scanning the same QR code on the same product can be sent to entirely different destinations, in their own language, with region-appropriate regulatory information.

When they are scanning. The resolver checks time-based rules. Is there a holiday promotion running? Has a recall been issued since this product shipped? Is a limited-time experience active? The same QR code printed six months ago can lead somewhere completely different today than it did the day the product left the factory.

Step 3: Content negotiation

With all of that context assembled, the resolver performs content negotiation. This is the formal term for the decision: given everything I know about this request, what is the single best destination?

The resolver checks its rules in priority order. A product recall overrides everything - if this lot has been recalled, the consumer goes to the recall notice regardless of any other rules. Below that, promotional campaigns, regional pages and default product information each have their place in the hierarchy.

The resolver does not serve content itself. It makes a decision and issues a redirect.

Step 4: The 307 redirect

The resolver responds with an HTTP 307 Temporary Redirect, sending the browser to the final destination URL. The “temporary” part is important - it tells the browser (and any caches along the way) not to remember this redirect permanently, because the destination might change next time.

This is a deliberate architectural choice. A 301 Permanent Redirect would be cached by the browser, meaning future scans would skip the resolver entirely. A 307 ensures the resolver is consulted on every scan, which is what makes time-based rules, recall overrides and dynamic routing possible.

Step 5: The consumer sees a product page

The browser follows the redirect and loads the final destination - a product page, a promotional experience, a recipe, nutritional information, whatever the brand has configured.

The entire process took a fraction of a second. The consumer saw a QR code, scanned it and landed on a product page. They have no idea that a resolver sat in the middle, inspected six dimensions of context, applied a cascade of rules and made a routing decision. Nor should they. The experience should be invisible.

But that invisible layer is the entire point.

Why This Matters More Than the QR Code

Here is the mental model shift that most Sunrise 2027 coverage misses:

The QR code is a one-time print decision. The resolver is permanent, living infrastructure.

Once that QR code is printed on packaging, it is immutable. You cannot change the URL encoded in it without reprinting every label. If you encoded a direct URL to your product page, you have made a bet that the URL will work, unchanged, for the entire shelf life of that product - and potentially longer if the packaging sits in warehouses, on slow-moving retail shelves or in consumers’ pantries.

A resolver decouples the printed URL from the final destination. The QR code always points to the resolver. The resolver always points to wherever you need it to point right now. This means:

You change your website. Maybe you rebrand, migrate platforms or restructure your URLs. Every QR code already in the market still works. You update the destination in the resolver, not on the packaging.

A product is recalled. You do not have to hope consumers visit your website and notice the recall banner. The resolver automatically redirects every scan of the affected lot numbers to the recall notice. The QR code on the recalled product becomes a direct line to safety information.

You enter a new market. The same product, same packaging, same QR code - but the resolver detects the consumer’s language and region and sends them to a localized experience. No region-specific SKUs required.

You run a holiday promotion. You configure a time-based rule: between November 15 and December 31, scans of this product go to the holiday campaign page. January 1, they revert to the standard product page. The packaging does not change.

None of this is possible if the QR code contains a hardcoded URL to a product page.

What Happens Without a Resolver

If you skip the resolver and encode a direct URL in your QR code, you are making a specific bet: that nothing about your digital presence will change for as long as that QR code exists in the world.

That is a bad bet.

The average CPG product has a shelf life measured in months or years. Packaging gets printed in massive runs. Products sit in distribution centers, on retail shelves and in consumers’ homes. A QR code you print today might get scanned three years from now.

In three years, will your website have the same URL structure? Will you be on the same e-commerce platform? Will the product page still exist at that exact path? Will your domain even be the same?

Without a resolver, a broken URL means a broken experience. The consumer who bothered to scan your QR code - someone who was actively interested in your product - gets a 404 page. You have turned a moment of engagement into a moment of frustration.

With a resolver, you update a configuration and every QR code ever printed for that product works again. That is not a nice-to-have. That is basic infrastructure resilience.

How Closient Handles This

Closient operates a GS1 conformance-tested Digital Link Resolver. Here is what that means in practice:

Full GS1 Digital Link compliance. Our resolver understands the complete GS1 identifier system - GTINs, lot numbers, serial numbers, GLNs and every other GS1 Application Identifier. URLs are structured according to the standard, which means they work with any conformant system in the supply chain.

Content negotiation. The same QR code serves different responses to different clients. A consumer gets a web page. A POS system gets structured data. A supply chain application gets a full linkset. One code, many audiences.

Geo-routing and language detection. Requests are routed based on the scanner’s location and language preferences. A single global SKU can deliver localized experiences without separate packaging.

Time-based rules. Configure promotions, seasonal content and campaign-specific experiences with start and end dates. The resolver handles the switching automatically.

Automatic recall overrides. When a recall is issued, affected lot numbers are immediately redirected to recall information. No manual intervention required beyond flagging the recall.

API-first architecture. Every capability of the resolver is accessible through a documented API. Manage products, configure rules, update destinations and monitor scan analytics programmatically. Integrate with your existing systems rather than managing another dashboard.

The resolver is the infrastructure that makes your Sunrise 2027 investment durable. The QR code gets you through the door. The resolver makes sure the door leads somewhere useful - today, next year and for every scan in between.