QR Codes Explained
Not all QR codes are the same. The difference between a safe code and a legacy one matters, and brands have a 2027 deadline to catch up.
Two kinds of QR code
When you pick up a product at a grocery store and scan the QR code on the label, you're interacting with one of two very different technologies, and the difference affects your safety.
GS1 Digital Link
A standardised, verifiable QR code format. The URL structure is governed by GS1, the global standards body that also manages barcodes. The destination is cryptographically tied to the product. Harder to spoof, easier to verify.
Legacy static QR code
An older format where any URL can be encoded. The destination can't be independently verified. A scammer can create an identical-looking QR code pointing to a fraudulent website, with no standard way to tell the difference.
What is Sunrise 2027?
GS1 has set a global deadline called Sunrise 2027, by which all retailers' point-of-sale systems must be capable of reading 2D codes like QR codes instead of, or alongside, the traditional 1D barcode.
For brands, this is an operating requirement: if your product still uses a legacy static QR code after 2027, retailers may have trouble scanning it at checkout.
For shoppers, this transition is an opportunity: as brands migrate to GS1 Digital Links, QR codes on products become safer and more trustworthy by default.
Why this matters right now
As of 2026, most products in Canadian grocery stores still use legacy static QR codes. A scammer who wants to impersonate a brand only needs to generate a QR code with any URL. There is no standard to forge against.
The QRbolt Shelf Index tracks which brands are leading the shift to GS1 Digital Links. This data gives consumers, journalists, and regulators a clear picture of Canada's QR readiness in real time.
The three states you'll see in the Shelf Index
GS1 Digital Link
The brand is using the verified GS1 standard. Codes follow a structure that's independently verifiable and harder to spoof.
Dynamic non-GS1
The brand uses dynamic (redirectable) QR codes but not the GS1 standard. Better than static, but not fully verifiable.
Legacy static
The brand is still on an older static format. The destination is fixed at print time and can't be verified or updated.
What you can do
You don't need to be a technology expert to benefit from this. QRbolt's app does the classification automatically when you scan. Every scan you contribute helps build a more accurate Shelf Index for every Canadian shopper.