Digital Product Passports Could Transform Cosmetic Labelling
Introduction
The Digital Product Passport (DPP), mandated under the Ecodesign for Sustainable Products Regulation (ESPR, Regulation (EU) 2024/1781), represents a transformative approach to product information disclosure, enabling consumers, enforcement authorities, and supply chain actors to access comprehensive product data through digital means [1]. By April 2025, the European Commission was developing implementing acts specifying DPP requirements for various product categories, with cosmetics anticipated to be included in future phases [2]. The DPP concept envisions a QR code or other digital identifier on product packaging that links to a secure online database containing detailed information on ingredients, sourcing, manufacturing, environmental impact, safety assessment, and end-of-life management [3]. For cosmetic products, the DPP could supplement or replace certain physical labelling requirements under Article 19 of Regulation (EC) No 1223/2009, while providing enhanced transparency and traceability [4].
The DPP initiative aligned with the EU Green Deal’s objectives of promoting circular economy, enhancing product transparency, and empowering consumers to make informed, sustainable choices [5]. For the cosmetic industry, DPP implementation presented both opportunities—including enhanced brand storytelling, improved supply chain traceability, and streamlined compliance with multiple regulatory requirements—and challenges, including data management complexity, cybersecurity risks, and the need for harmonized data standards [6]. The intersection of DPP requirements under ESPR and cosmetic-specific requirements under Regulation (EC) No 1223/2009 necessitated careful coordination to ensure that digital information disclosure satisfied both frameworks without creating duplicative or conflicting obligations [7].
Regulatory Framework and Legal Analysis
The Ecodesign for Sustainable Products Regulation (ESPR, Regulation (EU) 2024/1781), which entered into force in July 2024, establishes a framework for setting ecodesign requirements for products placed on the EU market, including requirements for Digital Product Passports [8]. Article 8 of ESPR empowers the Commission to adopt delegated acts establishing product-specific ecodesign requirements, including DPP requirements specifying the information to be made available, the format and accessibility of the information, and the data carriers (e.g., QR codes, NFC tags) to be used [9].
For cosmetic products, DPP requirements would need to be coordinated with existing labelling and information disclosure obligations under Regulation (EC) No 1223/2009 [10]. Article 19 requires that specific information be indicated on containers and packaging, including the Responsible Person’s name and address, nominal content, date of minimum durability or PAO, precautions for use, batch number, product function, and ingredient list [11]. Article 21 grants consumers the right to request additional information from the Responsible Person, including the quantitative composition and undesirable effects [12].
The DPP could provide a mechanism for disclosing information required under Article 21 in a more accessible and user-friendly format than traditional request-response mechanisms [13]. For example, the DPP could include the full quantitative composition (currently available only upon request), detailed ingredient sourcing information, environmental impact data (e.g., carbon footprint, water usage), and links to safety assessment summaries [14]. This enhanced transparency could support consumer choice and facilitate enforcement, while reducing the administrative burden of responding to individual information requests [15].
However, several legal and practical questions require resolution. First, can DPP disclosure satisfy physical labelling requirements under Article 19, or must physical labelling be maintained in addition to digital information [16]? The Commission’s approach to this question will determine whether DPP enables simplification of physical labelling or creates additional disclosure obligations [17]. Second, how will data security and confidentiality be managed, particularly for proprietary formulation information and personal data [18]? Article 11 requires that the PIF be kept confidential and accessible only to competent authorities, and DPP systems must ensure that confidential information is not publicly disclosed [19].
Third, how will DPP requirements interact with the CPNP notification system under Article 13 [20]? CPNP already provides a digital repository of product information accessible to poison centers and enforcement authorities, and DPP systems should leverage existing data rather than creating duplicative reporting obligations [21]. Fourth, how will accessibility be ensured for consumers without digital devices or internet access [22]? Article 19 requires that labelling information be “easily legible and indelible,” and DPP systems must not disadvantage consumers who cannot access digital information [23].
The ESPR Article 8(4) specifies that DPP information must be “accurate, complete, and up to date,” and that economic operators must ensure that information is updated when changes occur [24]. For cosmetic products, this requirement aligns with Article 11(2) of Regulation (EC) No 1223/2009, which requires that the PIF be kept up to date [25]. However, the frequency and mechanism for updating DPP information require clarification, particularly for products with long shelf lives or products already in distribution channels [26].
Toxicological and Safety Science Considerations
From a toxicological perspective, DPP systems offer opportunities to enhance transparency regarding ingredient safety and facilitate consumer access to safety information [27]. The DPP could include links to SCCS opinions on specific ingredients, summaries of safety assessment conclusions, and information on allergens and sensitizers [28]. This enhanced transparency could support informed consumer choice, particularly for individuals with known allergies or sensitivities [29].
However, transparency must be balanced with the need to avoid misleading or alarming consumers with technical information that may be misinterpreted [30]. Toxicological data, such as NOAEL values, MoS calculations, and hazard classifications, require professional expertise to interpret correctly, and presentation of such data to consumers without appropriate context could create unwarranted concerns [31]. The SCCS Notes of Guidance emphasize that “the presence of a hazardous substance in a cosmetic product does not necessarily mean that the product is unsafe,” and DPP systems must communicate this fundamental principle effectively [32].
The DPP could also facilitate post-market surveillance by enabling consumers to report adverse events directly through the digital interface [33]. Article 23 requires reporting of serious undesirable effects, and DPP systems could streamline this process by providing a direct link to reporting mechanisms [34]. Enhanced adverse event reporting could improve detection of safety signals and enable more rapid implementation of corrective actions under Article 25 [35].
Environmental impact information, which is central to the ESPR’s objectives, could include data on ingredient sourcing (e.g., sustainable palm oil, fair-trade shea butter), manufacturing processes (e.g., renewable energy use, water consumption), packaging materials (e.g., recycled content, recyclability), and end-of-life management (e.g., disposal instructions, take-back programs) [36]. This information supports the EU Green Deal’s objectives and enables consumers to make environmentally informed choices [37]. However, environmental claims must be substantiated under Article 20 and Commission Regulation (EU) No 655/2013, and DPP systems must ensure that environmental information is accurate, verifiable, and not misleading [38].
Practical Compliance Guidance
For Responsible Persons preparing for DPP implementation, a proactive, strategic approach is essential. First, companies should assess their current data management systems and identify gaps that must be addressed to support DPP requirements [39]. DPP systems require comprehensive, structured data on ingredients, sourcing, manufacturing, environmental impact, and safety assessment, and many companies will need to enhance data collection and management infrastructure [40]. Product Lifecycle Management (PLM) systems, Enterprise Resource Planning (ERP) systems, and specialized compliance software can facilitate data management and integration [41].
Second, companies should engage with industry associations and standardization bodies to contribute to the development of harmonized data standards and interoperability protocols [42]. The GS1 Digital Link standard, which enables encoding of multiple data attributes in a single QR code or barcode, is a leading candidate for DPP implementation [43]. Cosmetics Europe and other industry associations are developing sector-specific guidance on DPP data requirements and formats [44].
Third, companies should develop governance frameworks for DPP data management, including roles and responsibilities, data quality assurance procedures, update protocols, and security measures [45]. Article 8(4) of ESPR requires that DPP information be accurate, complete, and up to date, and companies must implement systems to ensure ongoing data quality [46]. Data governance should address both technical aspects (e.g., database management, cybersecurity) and organizational aspects (e.g., who is responsible for updating information, how frequently updates occur) [47].
Fourth, companies should design consumer-facing DPP interfaces that present information in an accessible, understandable format [48]. Technical toxicological data should be accompanied by plain-language explanations, and environmental impact data should be presented with appropriate context (e.g., comparison to industry benchmarks, explanation of metrics) [49]. The interface should be mobile-friendly, accessible to individuals with disabilities, and available in multiple languages as required by Article 19(3) of Regulation (EC) No 1223/2009 [50].
Fifth, companies should implement cybersecurity measures to protect DPP data from unauthorized access, tampering, or cyberattacks [51]. DPP systems will contain commercially sensitive information (e.g., formulation details, supplier identities) and potentially personal data (e.g., consumer accounts, adverse event reports), and must comply with GDPR requirements and industry cybersecurity standards [52]. Access controls, encryption, audit trails, and incident response protocols are essential components of DPP cybersecurity [53].
Sixth, companies should monitor regulatory developments regarding DPP implementation timelines, product-specific requirements, and enforcement approaches [54]. The Commission’s delegated acts under ESPR Article 8 will specify detailed DPP requirements for cosmetics, including mandatory data elements, data formats, and implementation deadlines [55]. Early engagement with regulatory authorities and participation in stakeholder consultations can provide clarity and influence policy development [56].
Conclusion
Digital Product Passports represent a transformative approach to product information disclosure, offering opportunities to enhance transparency, support circular economy objectives, and empower consumers to make informed choices. For cosmetic products, DPP implementation must be carefully coordinated with existing requirements under Regulation (EC) No 1223/2009, ensuring that digital information disclosure satisfies both ESPR and cosmetic-specific obligations without creating duplicative or conflicting requirements. Responsible Persons must invest in data management infrastructure, develop governance frameworks, design consumer-friendly interfaces, and implement robust cybersecurity measures to prepare for DPP implementation. As the Commission develops product-specific DPP requirements and implementation timelines, the cosmetic industry must engage proactively to shape policy development and ensure that DPP systems deliver meaningful benefits for consumers, enforcement authorities, and businesses while maintaining the fundamental safety and transparency objectives that underpin EU cosmetic regulation.
References
[1] Regulation (EU) 2024/1781 of the European Parliament and of the Council establishing a framework for setting ecodesign requirements for sustainable products (ESPR). Official Journal of the European Union, L 2024/1781.
[2] European Commission. (2025). Digital Product Passport implementation roadmap. European Commission.
[3] Regulation (EU) 2024/1781 (ESPR), Article 8.
[4] Regulation (EC) No 1223/2009, Article 19.
[5] Regulation (EC) No 1223/2009, Article 19.
[6] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[7] Regulation (EC) No 1223/2009 on cosmetic products. OJ L 342, 59–209.
[8] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[9] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[10] Regulation (EC) No 1223/2009, Article 19.
[11] Regulation (EC) No 1223/2009, Article 19.
[12] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu
[13] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu
[14] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu
[15] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[16] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[17] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[18] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[19] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[20] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu
[21] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu
[22] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[23] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[24] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[25] Regulation (EC) No 1223/2009, Article 11.
[26] Regulation (EC) No 1223/2009, Article 11.
[27] Scientific Committee on Consumer Safety. SCCS opinions. European Commission.
[28] Scientific Committee on Consumer Safety. SCCS opinions. European Commission.
[29] Scientific Committee on Consumer Safety. SCCS opinions. European Commission.
[30] SCCS. (2018). SCCS/1602/18 — Notes of Guidance (10th Revision).
[31] SCCS. (2018). Notes of Guidance (10th Rev.). SCCS/1602/18. European Commission.
[32] SCCS. (2018). Notes of Guidance (10th Rev.). SCCS/1602/18. European Commission.
[33] Regulation (EU) 2019/1020 on market surveillance and compliance of products.
[34] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu
[35] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu
[36] European Commission. (2019). The European Green Deal. COM(2019) 640 final.
[37] European Commission. (2019). The European Green Deal. COM(2019) 640 final.
[38] Commission Regulation (EU) No 655/2013 on cosmetic claims criteria.
[39] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[40] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[41] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[42] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[43] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[44] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[45] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[46] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[47] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[48] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[49] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[50] Regulation (EC) No 1223/2009, Article 19.
[51] Regulation (EC) No 1223/2009, Article 19.
[52] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[53] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.
[54] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[55] Regulation (EU) 2024/1781 (ESPR). OJ EU.
[56] Regulation (EU) 2024/1781 (ESPR). OJ EU.