Selling cosmetics online in 2026: the 5 regulatory requirements before going live
Selling cosmetics online looks simple: a Shopify e-commerce, a domain, some marketing. The regulatory reality is much more complex. Italian authorities (Ministry of Health, AGCM, Tax Police) have intensified controls on digital channels and non-compliance fines start at 5,000 euros and reach over 40,000 euros.
Here are the 5 non-negotiable requirements before opening your beauty e-commerce.
1. CPNP notification of every product sold
EU Regulation 1223/2009 requires every cosmetic sold in the Union to be notified to the CPNP (Cosmetic Products Notification Portal) before being placed on the market. The notification must be made by the "responsible person" indicated on the label, which can be the manufacturer or the importer if you buy from outside the EU.
Without prior CPNP notification, selling is illegal even if the product is safe. The notification status is publicly verifiable: a competitor reporting your brand is enough to trigger a seizure.
2. Product Information File (PIF) available within 72 hours
The PIF is the technical dossier that collects formula, stability tests, dermatological compatibility tests, safety assessment (CPSR) signed by a qualified toxicologist. It must be kept for at least 10 years and made available to authorities within 72 hours of request.
Those who buy cosmetics to resell must obtain a copy of the PIF from the manufacturer or importer. Without a PIF, in case of inspection, the risk of seizure is concrete.
3. Labeling compliant with Article 19
Article 19 of Regulation 1223/2009 lists the mandatory information on every cosmetic: name and address of the responsible person, nominal content, minimum durability date or PAO (Period After Opening), precautions for use, batch number, country of origin for extra-EU products, product function, complete INCI list.
Digital labels (QR code on packaging) are allowed only as a complement, not as a substitute for physical printing. Selling online with non-compliant labels exposes you to sanctions even if the product is correctly notified.
4. GDPR-compliant privacy policy and cookie banner
Your e-commerce collects personal data: name, email, address, payment data. GDPR (EU Regulation 2016/679) requires:
- Detailed privacy policy accessible from every page.
- Cookie banner with granular consent for technical, analytical and marketing cookies.
- Processing register maintained by the controller (you).
- DPA (Data Processing Agreement) with every external supplier: hosting, Shopify, Klaviyo, Facebook Ads.
- Procedure to respond to access/deletion requests within 30 days.
The Italian Privacy Authority has sanctioned more than 50 beauty e-commerce sites between 2024 and 2025, with average fines of 15,000 euros.
5. Distance contract compliant with the Consumer Code
Every online sale is a distance contract. The Consumer Code requires:
- 14-day right of withdrawal from delivery (with exceptions for opened sealed products).
- Clear pre-contractual information: total price, shipping costs, delivery times.
- 2-year legal guarantee of conformity.
- Documented complaint system and downloadable withdrawal form.
- Terms and Conditions of sale explicitly accepted (checkout checkbox).
The absence of a withdrawal form or its excessive complication are frequent reasons for AGCM sanctions.
Pre-launch checklist
Before clicking "publish" on your shop, verify:
- All products are notified to CPNP and you have evidence of the notification number.
- You have a copy of the PIF of each reference, stored digitally.
- Product labels comply with Article 19.
- Privacy policy and cookie banner are installed and configured.
- Terms of sale, withdrawal form and complaint procedure are published.
If you produce with Bellanova Cosmetics, the first three points are handled by our regulatory team. Privacy and terms of sale remain your responsibility, but an experienced lawyer configures them in 1-2 weeks with limited investment. Launching compliant is always cheaper than fixing it after.
