Tag Architecture and Consumer Privacy — Why GCN Tags Carry No On-Tag Data
The core design choice
GCN's RFID tags carry only two things on the physical chip:
TID (Tag Identifier) — a factory-burned, unchangeable serial number set by the chip manufacturer (Impinj) at the point of manufacture.
EPC (Electronic Product Code) — a short identifier that GCN writes once, during provisioning, and which acts purely as a pointer/lookup key.
Neither of these fields contains product data, ownership history, material composition, certification records, or any other Digital Product Passport content. That information lives entirely in GCN's backend (Supabase, Frankfurt), accessed only when someone scans the tag and the app looks up the corresponding record.
This is a deliberate architectural choice, not an incidental one — and it happens to be reinforced by the M830 chip specifically having zero user memory available, which makes "writing data onto the tag" not just discouraged by design, but physically impossible on that chip.
Why this matters for privacy
1. The tag itself reveals nothing if intercepted. Anyone with an RFID reader in range can read a passive tag's EPC and TID — that's inherent to how RAIN RFID works, and no amount of encryption on our end changes that fact. But if the tag carries no actual data, an intercepted read yields only an opaque identifier, not a product's history, materials, certifications, ownership, or any personal or commercial information. The identifier is meaningless without access to GCN's backend, where GCN controls exactly who can see what.
2. Access control lives in one place, not scattered across every physical tag. If data were written onto tags directly, protecting it would mean controlling every physical tag in circulation — impossible once a garment leaves a facility. By keeping all substantive data in the backend, GCN can apply role-based access, audit logs, and permission changes centrally, and can update or revoke access without needing to touch a single physical tag.
3. Nothing is "leaked forward" as a garment changes hands. A tag that only carries an identifier doesn't accumulate a readable history on the object itself. Downstream holders, resellers, or recyclers scanning the tag see only what GCN's backend permissions allow them to see at that moment — not a static, unerasable record baked into the tag from manufacture.
4. This aligns with data minimisation principles. Storing the minimum necessary identifier on the physical object, rather than the underlying data itself, is consistent with data minimisation as a privacy principle — collecting/storing only what's needed for the stated purpose (identification and lookup), not more.
What this is not
This is not encryption, and it doesn't prevent someone from reading the EPC/TID itself — those are inherently readable by any compatible reader in range, by design of the RAIN RFID standard. The privacy protection comes from what's absent from the tag (no substantive data) combined with backend-side access control, not from making the identifier unreadable.