Turn a shampoo bottle around. The back reads “Aqua, Glycerin, Parfum”, in exactly those words, whether the bottle was filled in Seoul or in Paris. That list has been mandatory on every pack in the EU since 2013, complete and in a fixed order. The cosmetics sector has therefore lived for more than a decade with what the Digital Product Passport now asks of everyone else.
This article shows what cosmetics got right along the way, where it left gaps, and which three things a sector should copy when it is only now setting up its own passport.
Why cosmetics was early
The EU Cosmetics Regulation 1223/2009 has required since July 2013 that every product package carries a complete ingredient list, written in the shared technical language INCI, the International Nomenclature of Cosmetic Ingredients. That is the EU’s first “product passport on paper”: printed, in a fixed dictionary, complete.
More than a decade before the ESPR. The sector had time to make mistakes. The other sectors are making them now. Avoidably.
What cosmetics got right
INCI as a common language: the INCI dictionary has been maintained for 30 years. “Aqua” is on every bottle, whether made in Seoul or Paris. For the route to a passport the lesson is: agree on your dictionary before you talk about data models.
Anyone setting up a textile passport today should consider: what is my INCI? Is it EN ISO 2076 for synthetic fibres? Is it BS 8903 for an ethical supply chain?
Without a common language, every technical connection is a translation project.
Order by concentration: ingredient lists are sorted in descending order by concentration. A simple rule that gives end consumers real information: ingredients above 1 per cent appear in descending order of weight, those below 1 per cent may follow in any order (Art. 19(1)(g)). That is transparency without giving away a trade secret.
Transferable to the passport: show the main components individually, small additives in a summarised section. Nobody needs the exact quantity of every adhesive additive in a shoe.
Liability sits with the manufacturer or importer: Article 4 of the Cosmetics Regulation defines a “responsible person”, a natural or legal person in the EU who answers for compliance. No matter where the product was made, there is exactly one EU address for queries and liability claims.
The ESPR adopts the model. Anyone who imports products needs a responsible person established in the EU. Whoever underestimates this buys, in the worst case, customs problems.
What cosmetics got wrong
Fragrance in one word: a perfume or aromatic composition is named as “Parfum” or “Aroma”; only the fragrance allergens the regulation lists have to be named individually, roughly 80 of them since Regulation (EU) 2023/1545. That is transparent about the presence of a fragrance, but not about what is in it. Whoever reacts to a substance outside that list does not find it in the ingredient list, even though it is in the fragrance.
The lesson for other sectors: catch-all entries made of trace amounts create blind spots. The passport should name trace amounts, even if the percentage is small. Transparency is not only quantity, but also identity.
The Parfum gap: perfume compositions are legally one single constituent (“Parfum”), even though they consist of dozens of individual substances. More than 80 fragrance allergens must be named separately under the EU list expanded in 2023, nothing else. A trade secret that remains a blind spot for health.
The passport must not take this route. If the material composition stays hidden, the recyclability assessment fails. The middle way: all constituents present in the data model, access tiered (public: the category; authority: complete).
Traceability down to the raw material: the Cosmetics Regulation does not require traceability down to the raw-material source. The entry “Palmitic Acid” does not care whether the palm kernels come from Sumatra or a sustainably certified source. This is now recognised as a gap in the cosmetics sector, but it has never been closed by law.
The ESPR closes this gap. Origin data is mandatory. Anyone planning transparency on the cosmetics model is planning too little.
What we learned in almost two decades
Cosmetic Analysis, the predecessor platform from which Transpareo emerged, has analysed and assessed cosmetic raw materials since 2008. Along the way we learned a few things that are reusable for passport projects.
Data quality is not black or white. A data set is not “right” or “wrong”. It is 70 per cent complete, 80 per cent current, 50 per cent checked. Better: data with visible quality marks. Then the reader knows what they can take from the value.
Anyone who waits for perfect data before publishing a passport never publishes.
Translation does not grow evenly. The first 5 EU languages are work. The next 15 are a grind. Anyone who waits until the German version is perfect before starting the Dutch version has, after three years, 27 half-finished languages and zero complete ones. Parallel start, one shared glossary, an accepted 85-per-cent solution is the faster route.
Regulation is the beginning, not the end. The Cosmetics Regulation describes obligations. The sector’s interesting offers, eco-labels, sustainability-certified product lines, ethical sourcing chains, emerged after the obligation, on its basis. The passport should be thought of this way: obligation as a foundation, added value on top. Not the other way round.
Three things to take with you
Where your sector stands on that path is in our industries reference. If it is just stepping onto it, steal three things from cosmetics:
- Find your INCI: decide now which technical language you recognise as your foundation. That saves you a translation per system later.
- Store individually, show grouped: show trace amounts summarised, but store them individually. If in 10 years an allergen or a new rule is added, you have the data ready.
- Make origin transparent: cosmetics failed to do this and has dragged the gap along for 30 years. Close it from the start.
A retrofit in 5 years typically costs two to three times as much as a single clean set-up.
Everything the regulation asks of cosmetics manufacturers, with the timeline, the roles, the required data, the official documents, is in our reference on the Digital Product Passport for cosmetics.
Questions on this article
Is a Digital Product Passport mandatory for cosmetics?
No. No delegated act under the ESPR covers cosmetics, and the first working plan of 16 April 2025 does not list them among the priority product groups. What is mandatory is the older set of duties in Regulation (EC) No 1223/2009 - the ingredient list on the pack, the responsible person, the product information file and the notification. A passport is where those duties become readable on a phone, not a new legal obligation. Everything the regulation asks for is in our reference on the Digital Product Passport for cosmetics.
May the ingredient list move behind a QR code instead of onto the pack?
Not as a substitute. Art. 19(1) of Regulation (EC) No 1223/2009 requires the list on the container or the packaging, and the only relief is Art. 19(2) - where that is practically impossible, the list goes on an enclosed leaflet, label, tape, tag or card referred to by the hand-and-book symbol. A passport carries the same list to where it is actually readable, at full size, with the function of each substance, in every market language. The pack stays the legal carrier.
Who has to be the responsible person, and can my distributor take the role?
The responsible person is one natural or legal person established in the Union and named on the label (Art. 4 and Art. 19(1)(a)). An importer is the responsible person unless it designates someone else in writing (Art. 4(5)), and a distributor takes the role only when it places the product on the market under its own name or brand, or modifies it in a way that affects compliance (Art. 4(6)). It is a real liability rather than a mailbox, so settle it in the contract before the first pallet moves.
What changed for fragrance allergens, and by when?
Commission Regulation (EU) 2023/1545 of 26 July 2023 raised the number of fragrance allergens that have to be named individually from 24 to roughly 80, above 0.001 per cent in products that stay on the skin and 0.01 per cent in products that are rinsed off. Products without the extended declaration could be placed on the Union market only until 31 July 2026 and may be made available only until 31 July 2028. The work rarely sits in the label but in the supplier declarations behind it, because few brands hold the fragrance composition themselves.
If I store every trace amount individually, do I have to show it to everyone?
No, and the two questions are worth keeping apart. Storing a substance individually is a data-model decision, showing it is an access decision. Cosmetics law already splits it that way - the pack and Art. 21 govern what the public sees, while the product information file under Art. 11 is opened to the competent authority, not to the buyer. In Transpareo visibility is a property of every single field, so the public tier appears without any login and the safety assessment, supplier declarations and certificates sit behind logged access. That is what lets you follow the lesson of this article without giving up a trade secret.
My sector has no INCI. Where do I start?
With whichever list of technical terms your sector already maintains, and before you talk about data models. For synthetic fibres that is EN ISO 2076, for an ethical supply chain BS 8903, for chemistry the CAS number. The point is not that one of them is the right answer, it is that the decision is taken once, centrally, rather than per connection. Without an agreed dictionary every connection between two systems becomes its own translation project, and the effort repeats with every new partner.
How long does the data have to stay available?
The product information file has to be kept for ten years after the last batch was placed on the market (Art. 11 of Regulation (EC) No 1223/2009). A passport carrying the same data sensibly outlives the last jar too, otherwise the printed code leads nowhere. That duty is longer than most software contracts, so ask every provider what happens to your passports after a cancellation - with Transpareo, published passports stay reachable through a permanent address, and our provider checklist names the further questions.
