Whether you run a polished Shopify storefront, an Etsy shop or an Instagram page with a checkout link, the rules are the same: if you sell cosmetics online in the EU, every product must be backed by a Cosmetic Product Safety Report before the first order ships. Selling online does not lower the bar — it simply makes your products visible to customers, competitors and market-surveillance authorities across 27 member states at once.
This guide answers the question most new e-commerce brands ask first: do I really need a CPSR to sell online, and what happens if I skip it? It explains what the report is, why digital selling does not exempt you, and how the CPSR fits alongside the other documents an online cosmetic business needs.
Key takeaways
- Yes — a CPSR is mandatory for every cosmetic product sold in the EU, including products sold exclusively online, with no exemption for small batches or handmade goods.
- The legal obligation sits with the “responsible person” named on the product, and applies the moment a product is made available to an EU customer, not when it is physically shipped.
- Selling through a marketplace, your own website or social media makes no difference to the requirement: the channel does not change the law.
- A CPSR must be completed and signed by a qualified safety assessor and kept in your Product Information File, ready for authorities on request.
- Selling without a valid CPSR can lead to product withdrawals, marketplace delisting, fines and, in serious cases, prosecution.
Does selling online change the rules? No — and here is why
There is a persistent myth that online-only brands, home businesses or “small” sellers operate in a grey zone where the full weight of cosmetic law does not apply. They do not. Regulation (EC) No 1223/2009 — the EU Cosmetic Regulation — defines a cosmetic product by what it is and where it is used on the body, not by how it is sold. A face serum is a cosmetic whether it leaves a warehouse or a kitchen table.
The trigger for compliance is the act of “placing on the market” or “making available” a product to an EU consumer. An online listing that an EU customer can buy is, in legal terms, making the product available. That means the safety assessment, labelling, notification and documentation must all be in place before the product goes live — not retrospectively once sales pick up.
“Online-only” is not a regulatory category. Authorities increasingly monitor e-commerce listings and marketplaces directly, and a public product page is some of the easiest evidence a regulator can gather. Visibility cuts both ways.
What exactly is a CPSR?
The Cosmetic Product Safety Report (CPSR) is the formal safety dossier that proves your product is safe for human use under normal and reasonably foreseeable conditions. It is split into two parts: Part A gathers the safety data (ingredient toxicological profiles, the formulation, stability and microbiological information, packaging, and the intended use), and Part B is the assessor’s reasoning and conclusion — their professional judgement that the product is safe, signed off with their credentials.
Crucially, a CPSR cannot be self-certified. It must be carried out by a qualified safety assessor with the right scientific background (typically in pharmacy, toxicology, medicine or a related discipline). The finished report then lives inside your Product Information File, the master folder a responsible person must keep for every product. For a fuller walkthrough, see our guide on how to get a CPSR for your cosmetic product.
The documents an online cosmetic shop actually needs
The CPSR is central, but it does not stand alone. A compliant online store needs the full set working together before launch.
| Requirement | What it covers | Needed before first online sale? |
|---|---|---|
| Cosmetic Product Safety Report (CPSR) | Signed safety assessment of the finished product | Yes — for every product and variant range |
| Product Information File (PIF) | Master dossier holding the CPSR, formula, labelling and proof of effect claims | Yes — must be available to authorities |
| Responsible person | A named EU-based legal entity accountable for compliance | Yes — named on the label and notification |
| CPNP notification | Registering the product on the EU portal before sale | Yes |
| Compliant label | Ingredient list, warnings, batch, PAO and responsible person details | Yes — even if the product is only pictured online |
Notice that the CPSR underpins almost everything else: you cannot complete a CPNP notification properly or finalise a compliant label without the safety assessment behind it. It is the first domino, not the last.
Do marketplaces change anything?
Selling through Amazon, Etsy, a dropshipping arrangement or your own website does not shift the legal responsibility off your shoulders. The platform is a sales channel, not a compliance shield. In fact, larger marketplaces increasingly ask sellers to provide safety documentation and proof of notification, and they will remove listings that cannot produce it. A delisting can happen overnight and freeze your entire revenue stream, so “we will sort the paperwork later” is a risky way to launch.
If your supplier or “private label” manufacturer tells you a CPSR is “included” or “not needed” for online sales, verify it independently. You — as the responsible person or brand owner — are the one an authority will contact, and “my supplier said so” is not a legal defence.
What happens if you sell online without a CPSR?
The consequences are not theoretical. A product placed on the EU market without a valid CPSR is non-compliant by definition, and enforcement can include mandatory withdrawal or recall of stock, removal of listings by the marketplace, financial penalties set at national level, and — where there is a genuine safety risk or repeated breach — criminal prosecution of the responsible person. Beyond the legal exposure, a public recall or a safety incident traced back to missing documentation is exactly the kind of reputational damage a young online brand cannot easily absorb.
Bringing it all together
Selling cosmetics online in the EU is held to precisely the same standard as selling on a shop shelf: a signed CPSR for every product, a complete PIF, a named responsible person, a CPNP notification and a compliant label — all in place before your store opens for orders. The digital storefront is the easy part; the compliance behind it is what keeps the business trading.
If you are preparing to launch and want the safety assessment handled properly the first time, Lexora’s CPSR service pairs you with a qualified assessor, or our Full Compliance Pack brings the CPSR, PIF, notification and label review together so your online shop goes live fully compliant.
Frequently asked questions
Do I need a CPSR if I only sell cosmetics online?
Yes. A Cosmetic Product Safety Report is mandatory for every cosmetic product made available to EU consumers, regardless of the sales channel. Selling exclusively online — through your own website, a marketplace or social media — does not create any exemption. The product must have a signed CPSR before the first order can lawfully be sold.
Does selling on Amazon or Etsy exempt me from a CPSR?
No. The marketplace is just a sales channel; the legal responsibility stays with the brand owner or responsible person. Many marketplaces now actively request safety documentation and will delist products that cannot provide it, so selling on a platform tends to increase, not reduce, the scrutiny on your paperwork.
Can I write the CPSR myself to save money?
No. A CPSR must be completed and signed by a qualified safety assessor with an appropriate scientific qualification (such as toxicology, pharmacy or medicine). You can gather and supply the underlying information — formulation, supplier data and packaging details — but the assessment and conclusion must come from the assessor.
What documents do I need besides the CPSR to sell cosmetics online?
Alongside the CPSR you need a complete Product Information File, a named EU responsible person, a CPNP notification on the EU portal, and a fully compliant label. The CPSR feeds into all of these, which is why it is usually the first document to commission.
What happens if I sell online without a CPSR?
The product is non-compliant, and enforcement can include withdrawal or recall of stock, delisting by the marketplace, fines set at national level and, in serious cases, prosecution of the responsible person. A young brand also risks significant reputational harm if a missing safety assessment is exposed in a recall.
