Online Cosmetic Sales Increase Marketplace Compliance Risks

Introduction

The rapid growth of online cosmetic sales, accelerated by the COVID-19 pandemic and changing consumer shopping behaviors, created significant compliance challenges for enforcement authorities and Responsible Persons during 2023 [1]. Online marketplaces such as Amazon, eBay, and specialized beauty platforms enabled global distribution of cosmetic products, but also facilitated entry of non-compliant products into the EU market, including products lacking proper Responsible Person designation, products with inadequate safety assessment, and products containing prohibited or restricted ingredients [2]. Article 5 of Regulation (EC) No 1223/2009 imposes obligations on distributors, including online marketplace operators, to verify that products bear required labelling and that the Responsible Person has fulfilled applicable obligations [3]. However, enforcement of these obligations in the online environment proved challenging due to the volume of listings, the cross-border nature of e-commerce, and the difficulty of identifying and holding accountable sellers operating from outside the EU [4].

By June 2023, enforcement authorities across the EU intensified surveillance of online sales channels, conducting coordinated sweeps of major marketplaces and taking action against non-compliant products [5]. The Administrative Cooperation (AdCo) group facilitated information exchange regarding non-compliant products identified online, and several Member States issued guidance to marketplace operators regarding their obligations under Regulation (EC) No 1223/2009 [6]. For Responsible Persons and brands selling through online channels, the evolving enforcement landscape necessitated enhanced due diligence, seller verification procedures, and monitoring systems to ensure that products listed online complied with all applicable requirements [7].

Regulatory Framework and Legal Analysis

Article 5 of Regulation (EC) No 1223/2009 establishes obligations for distributors, defined as “any natural or legal person in the supply chain, other than the manufacturer or the importer, who makes a product available on the market” [8]. Distributors must act with due care to ensure that products bear the required labelling in accordance with Article 19, that the product is accompanied by required information in a language easily understood by consumers, and that the Responsible Person has fulfilled applicable obligations [9]. If a distributor considers or has reason to believe that a product is not in conformity with the regulation, the distributor must not make the product available on the market until it has been brought into conformity, and must inform the Responsible Person and the competent authority [10].

Article 5(3) contains a critical provision for online marketplaces, stating that “a distributor shall be considered to be a responsible person for the purposes of this Regulation if he places a product on the market under his name or trademark or modifies a product already placed on the market in such a way that compliance with the requirements of this Regulation may be affected” [11]. This provision means that marketplace operators who sell products under their own brand (e.g., Amazon Basics cosmetics) or who modify products (e.g., repackaging, relabeling) assume the full obligations of a Responsible Person, including safety assessment, PIF maintenance, CPNP notification, and post-market surveillance [12].

For marketplace operators who facilitate third-party sales without placing products on the market under their own name, the legal obligations are less clear [13]. Article 5 obligations apply to “distributors,” but marketplace operators may argue that they are not distributors because they do not take ownership of products or physically handle them [14]. However, enforcement authorities increasingly take the position that marketplace operators who actively facilitate sales, provide payment processing, and control listing content exercise sufficient control to be considered distributors and therefore must fulfill Article 5 obligations [15].

The EU Digital Services Act (Regulation (EU) 2022/2065), which became applicable in February 2024, introduced additional obligations for online platforms, including requirements to implement “know your business customer” (KYBC) procedures, provide mechanisms for reporting illegal content, and cooperate with enforcement authorities [16]. While the Digital Services Act does not specifically address cosmetic product compliance, its provisions complement Regulation (EC) No 1223/2009 by enhancing traceability and accountability in online sales [17].

Article 21 of Regulation (EC) No 1223/2009 grants competent authorities the right to require the Responsible Person to make available relevant documentation and information demonstrating compliance [18]. For products sold online, enforcement authorities may request information from marketplace operators regarding the identity and contact details of sellers, the origin of products, and documentation supporting compliance claims [19]. Article 22 empowers authorities to conduct sampling and analysis, and marketplace operators may be required to facilitate product sampling by providing seller information or purchasing products for testing [20].

Article 25 empowers competent authorities to take measures to prohibit or restrict the making available on the market of non-compliant products, including requiring withdrawal or recall [21]. For online sales, enforcement actions may include requiring marketplace operators to remove non-compliant listings, block sellers who repeatedly list non-compliant products, and implement enhanced monitoring systems to prevent future violations [22]. The AdCo group coordinates enforcement actions across Member States, and products identified as non-compliant in one Member State may be subject to coordinated removal across multiple marketplaces and jurisdictions [23].

Toxicological and Safety Science Considerations

From a toxicological perspective, non-compliant products sold online may present genuine safety risks if they contain prohibited or restricted ingredients, lack adequate safety assessment, or are manufactured under inadequate quality control conditions [24]. Enforcement sweeps have identified products containing prohibited substances such as mercury (used illegally in skin-lightening products), hydroquinone above permitted concentrations, and prohibited colorants [25]. These substances pose well-documented health risks, including nephrotoxicity (mercury), ochronosis and renal damage (hydroquinone), and carcinogenicity (certain azo dyes) [26].

The absence of a proper safety assessment under Article 10 is a critical compliance failure that may indicate inadequate evaluation of ingredient safety, formulation compatibility, and exposure scenarios [27]. The SCCS Notes of Guidance (10th Revision, SCCS/1602/18) require that safety assessment address all relevant toxicological endpoints, including acute toxicity, irritation, corrosivity, skin sensitization, dermal absorption, repeated-dose toxicity, mutagenicity, carcinogenicity, reproductive toxicity, and photo-induced toxicity [28]. Products lacking a CPSR may not have been evaluated for these endpoints, creating uncertainty regarding safety [29].

Counterfeit cosmetic products, which are prevalent in online marketplaces, present particular safety concerns because they are manufactured outside regulated supply chains and may contain undeclared ingredients, contaminants, or adulterants [30]. Studies of counterfeit cosmetics have identified high levels of heavy metals (lead, arsenic, cadmium), microbial contamination, and presence of prohibited ingredients [31]. Dermal absorption of heavy metals can result in systemic toxicity, including neurotoxicity (lead), carcinogenicity (arsenic), and nephrotoxicity (cadmium) [32]. Microbial contamination can cause skin and eye infections, particularly in products applied to mucous membranes or compromised skin [33].

The SCCS has emphasized that safety assessment must consider the quality and purity of ingredients, and Part A of the CPSR must include information on impurities and contaminants [34]. Products manufactured under inadequate quality control may contain impurities such as residual solvents, heavy metals, or polycyclic aromatic hydrocarbons (PAHs) that pose health risks [35]. The margin of safety calculation assumes that ingredients meet specified purity standards, and the presence of contaminants may reduce the MoS below acceptable levels [36].

Practical Compliance Guidance

For Responsible Persons selling through online channels, ensuring compliance requires a multi-layered approach addressing seller verification, listing monitoring, and enforcement cooperation. First, brands should implement robust seller authorization programs, limiting online sales to authorized distributors who have been verified to understand and comply with Regulation (EC) No 1223/2009 [37]. Authorized seller agreements should include provisions requiring compliance with all applicable regulations, accurate product listings, and cooperation with enforcement authorities [38]. Brands should conduct periodic audits of authorized sellers, including review of online listings and mystery shopping to verify that products are accurately represented and properly labeled [39].

Second, brands should actively monitor online marketplaces for unauthorized sellers and non-compliant listings [40]. Monitoring tools and services are available that scan major marketplaces for brand names, product images, and keywords, identifying unauthorized listings for investigation and takedown [41]. Article 20 claims substantiation becomes particularly important in the online environment, as product listings often include marketing claims that may not appear on physical packaging, and these claims must comply with Commission Regulation (EU) No 655/2013 [42].

Third, for brands selling directly through their own e-commerce platforms or through authorized marketplace storefronts, Article 19 labelling requirements must be satisfied [43]. While physical products must bear required labelling on containers and packaging, online product listings should also provide key information such as ingredient lists, warnings, and Responsible Person contact details to enable informed consumer choice [44]. Article 21 grants consumers the right to request information from the Responsible Person, and brands should provide accessible contact mechanisms on their websites and online listings [45].

Fourth, marketplace operators should implement enhanced due diligence procedures for cosmetic product sellers, including verification of Responsible Person designation, confirmation of CPNP notification, and screening for prohibited ingredients [46]. The Digital Services Act’s KYBC requirements provide a framework for seller verification, and marketplace operators should adapt these procedures to address cosmetic-specific compliance requirements [47]. Automated screening tools can flag listings containing keywords associated with prohibited ingredients (e.g., “mercury,” “hydroquinone,” “skin lightening”) or making non-compliant claims (e.g., “cures acne,” “removes wrinkles”) [48].

Fifth, Responsible Persons and marketplace operators should cooperate with enforcement authorities under Article 21 and Article 22, providing requested information and facilitating product sampling [49]. Proactive engagement with authorities, including voluntary reporting of non-compliant products identified through internal monitoring, demonstrates good faith compliance efforts and may reduce enforcement risk [50]. The AdCo group increasingly coordinates cross-border enforcement actions, and cooperation with authorities in one Member State may facilitate resolution of issues in other jurisdictions [51].

Sixth, consumer education is essential to reduce demand for non-compliant products [52]. Brands and marketplace operators should provide information to consumers regarding how to identify compliant products, including verification of Responsible Person designation, CPNP notification (which can be checked through national competent authority websites in some Member States), and presence of required labelling [53]. Consumer reporting mechanisms, such as “report this listing” buttons, enable crowdsourced identification of non-compliant products and facilitate enforcement [54].

Conclusion

The growth of online cosmetic sales during 2023 created significant compliance challenges, as the ease of global distribution and the volume of online listings facilitated entry of non-compliant products into the EU market. Article 5 obligations on distributors, including marketplace operators, require verification that products comply with Regulation (EC) No 1223/2009, but enforcement in the online environment remains challenging. Responsible Persons must implement robust seller authorization programs, actively monitor online listings, and cooperate with enforcement authorities to ensure compliance. Marketplace operators must enhance due diligence procedures, implement automated screening tools, and facilitate enforcement actions. As the Digital Services Act and evolving enforcement strategies increase accountability for online platforms, the cosmetic industry must adapt compliance programs to address the unique risks and opportunities of e-commerce while maintaining the consumer protection objectives that underpin Regulation (EC) No 1223/2009.

References

[1] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[2] Regulation (EC) No 1223/2009, Article 5.

[3] Regulation (EC) No 1223/2009, Article 5.

[4] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[5] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[6] Regulation (EC) No 1223/2009 on cosmetic products. OJ L 342, 59–209.

[7] Regulation (EC) No 1223/2009 on cosmetic products. OJ L 342, 59–209.

[8] Regulation (EC) No 1223/2009, Article 5.

[9] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[10] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[11] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[12] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu

[13] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu

[14] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[15] Regulation (EU) 2022/2065 (Digital Services Act).

[16] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu

[17] Regulation (EC) No 1223/2009, Article 21.

[18] Regulation (EC) No 1223/2009, Article 21.

[19] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[20] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[21] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[22] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[23] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[24] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[25] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[26] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[27] SCCS. (2018). Notes of Guidance (10th Rev.). SCCS/1602/18. European Commission.

[28] SCCS. (2018). Notes of Guidance (10th Rev.). SCCS/1602/18. European Commission.

[29] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[30] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[31] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[32] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[33] Scientific Committee on Consumer Safety. European Commission. https://health.ec.europa.eu/scientific-committees/scientific-committee-consumer-safety-sccs_en

[34] Scientific Committee on Consumer Safety. European Commission. https://health.ec.europa.eu/scientific-committees/scientific-committee-consumer-safety-sccs_en

[35] SCCS. (2018). SCCS/1602/18 — Notes of Guidance (10th Revision).

[36] SCCS. (2018). SCCS/1602/18 — Notes of Guidance (10th Revision).

[37] Regulation (EC) No 1223/2009 on cosmetic products. OJ L 342, 59–209.

[38] Regulation (EC) No 1223/2009 on cosmetic products. OJ L 342, 59–209.

[39] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[40] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[41] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[42] Commission Regulation (EU) No 655/2013 on cosmetic claims criteria.

[43] Commission Regulation (EU) No 655/2013 on cosmetic claims criteria.

[44] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[45] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu

[46] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu

[47] European Commission. Cosmetic Products Notification Portal (CPNP). https://cpnp.ec.europa.eu

[48] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[49] Regulation (EC) No 1223/2009 on cosmetic products; SCCS/1602/18. European Commission.

[50] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[51] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[52] Administrative Cooperation Group (AdCo) for Cosmetic Products. European Commission.

[53] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu

[54] European Chemicals Agency. Restriction proposal (REACH Annex XV). https://echa.europa.eu