
Digital Product Passport for cosmetics
No ESPR delegated act covers cosmetics, yet the sector has carried a full ingredient declaration, a responsible person and a notified product file since 2013. Deadlines, required data, official sources and answers - the reference work on the DPP for cosmetics.
No passport duty, and the strongest case for one
Cosmetics has no Digital Product Passport duty, and that makes it the most interesting sector to look at.
Where the law stands
Since 11 July 2013 every cosmetic product sold in the EU has carried most of what a passport asks for anyway.
A full ingredient declaration in INCI names sits on the pack. A named responsible person inside the Union answers for the product. A product information file with the safety assessment is kept for ten years after the last batch. A notification in the Cosmetic Products Notification Portal is filed before the first unit is sold.
The data exists. It is just spread across a folded leaflet, a supplier’s PDF and a notification screen.
The label keeps getting fuller
That is why the sector reads differently from batteries or textiles. The pressure comes from the label itself, and the label keeps getting fuller.
Nobody here is waiting for a delegated act.
Commission Regulation (EU) 2023/1545 raised the number of fragrance allergens that have to be named individually from 24 to roughly 80. Since 31 July 2026 the extended declaration is binding for products newly placed on the market, and from 31 July 2028 the last old stock has to be off the shelves.
All of that has to remain legible on a 30 millilitre tube, in the language of every market it is sold in.
What a passport brings you now
The label is out of room, and the passport is the surface that never is: the full ingredient list at readable size, the function of every substance, the allergen declaration at the new thresholds, the certificate behind the organic or vegan claim, in 24 official EU languages and 16 more instead of the three on the carton.
A passport does not replace any of this. It puts the same information where the pack cannot go.
Every scan is a contact with a customer who cared enough to look, on a page with your branding rather than a retailer’s, with a form for questions or a newsletter if you want one. And the notification, the safety file and the supplier declarations sit behind the same code, visible only to the people entitled to them. Cosmetics does not need a passport by law; it needs one by label.
The three biggest hurdles in practice
- The label is out of room. Every new allergen and every new warning competes for the same millimetres. Brands solve it with smaller type until legibility itself becomes the compliance problem, which is exactly the point at which a second, digital surface starts to pay for itself.
- The ingredient data sits with the suppliers. Fragrance compositions are trade secrets held by the fragrance house, not by the brand. The allergen figures arrive as declarations, in different formats, on different update cycles. Keeping them current across a few hundred references is a data problem long before it is a labelling problem.
- Claims have to be justified. Regulation (EU) No 655/2013 sets six common criteria, and evidence that lives in an email thread is not evidence. Every claim needs a filed source that someone can find in three years without asking the person who wrote it.
More on this: Cosmetics: 20 years of product transparency as a blueprint for DPPs and What the DPP obligation really costs, and what penalties cost.
Timeline for Cosmetics
Every date the regulation sets for Cosmetics, in order, from the day it entered into force to the duties of the next decade. Dates that hang on acts the Commission has not adopted yet are marked as such.
- 11 March 2013Animal-testing ban complete
The last transitional period of Art. 18 ends. From this day no cosmetic product may be placed on the EU market whose finished form or whose ingredients were tested on animals for cosmetic purposes, wherever in the world the test was carried out.
- 11 July 2013Cosmetics Regulation applies
Regulation (EC) No 1223/2009 replaces the Cosmetics Directive. Every product needs a responsible person established in the Union (Art. 4), a product information file (Art. 11), a notification in the Cosmetic Products Notification Portal before it is placed on the market (Art. 13) and the ingredient list on the label (Art. 19). Regulation (EU) No 655/2013 on the justification of claims applies from the same day.
- 26 July 2023Fragrance allergen labelling extended
Commission Regulation (EU) 2023/1545 raises the number of fragrance allergens that have to be named individually in the ingredient list from 24 to roughly 80. The thresholds stay at 0.001 per cent in leave-on and 0.01 per cent in rinse-off products.
- 3 April 2024New restrictions on Vitamin A, arbutin and endocrine disruptors
Commission Regulation (EU) 2024/996 restricts Vitamin A, Alpha-Arbutin and Arbutin and several substances with potential endocrine-disrupting properties. Every entry carries its own dates for placing on the market and for making available, listed in the annex rather than in one deadline.
- 8 July 2025Commission proposes the targeted revision
COM(2025) 531 would amend the Cosmetics Regulation together with the rules on chemicals and fertilising products. For cosmetics it deletes the Commission glossary of Art. 33 and has ingredient names follow an internationally recognised nomenclature instead, adds a procedure for listing colourants, preservatives and UV filters, and drops the separate pre-notification for nanomaterials.
- 16 June 2026Parliament and Council agree on the revision
The co-legislators reached a political agreement on the simplification package. Legal-linguistic revision, formal adoption and publication in the Official Journal are still outstanding, so no figure or date in it is final yet. The agreed text does not move the cosmetic ingredient list off the pack.
- 31 July 2026Extended allergen declaration becomes binding
Products that do not carry the extended fragrance allergen declaration may no longer be placed on the Union market (transitional footnotes to the annex of Regulation (EU) 2023/1545). Everything filled after this date needs the new list.
- 31 July 2028Old stock has to be gone
Products placed on the market before the deadline may still be made available until this day. After it, every cosmetic product on a shelf in the EU carries the extended declaration.
- No act yetNo ESPR delegated act for cosmetics
Cosmetics are not excluded from the Ecodesign for Sustainable Products Regulation - Art. 1(2) names food, feed and medicinal products, not cosmetics - but they are not among the priority product groups of the first working plan of 16 April 2025 either. No delegated act is in preparation, so no mandatory product passport is in sight for the sector.
Who is affected?
Which duties fall on each economic operator along the way to the market.
Responsible person
Every product needs one natural or legal person established in the Union who answers for it (Art. 4). This person keeps the product information file, notifies in the portal and is the address for the market surveillance authority. Without a responsible person the product may not be sold, however good the formulation is.
Manufacturer
Produces under good manufacturing practice, supplies the safety assessment and the ingredient data behind it, and updates the responsible person whenever a formulation, a supplier or an allergen threshold changes. Most of what a passport shows begins here.
Importer
Whoever brings a cosmetic product into the EU from a third country places it on the market and normally becomes the responsible person for it (Art. 4(5)). That means the full file, not just the invoice. Settle in the supply contract who delivers the INCI data and the safety assessment, and in what form.
Distributor
Checks before selling that the label carries the required particulars in the language of the market, that the durability information is present and that the batch is not past its date (Art. 6). Keeps no file of its own, but has to be able to name its source.
What goes in the DPP for Cosmetics?
The key data fields required by the relevant EU regulation.
INCI list
The full ingredient declaration in the common names of the International Nomenclature of Cosmetic Ingredients, in descending order of weight, as Art. 19(1)(g) and Art. 19(6) require it on the pack. In the passport it appears at readable size, with the function of each ingredient and the source of the entry.
Fragrance allergens
Roughly 80 fragrance allergens have to be named individually since Commission Regulation (EU) 2023/1545, above 0.001 per cent in leave-on and 0.01 per cent in rinse-off products. Binding for products placed on the market from 31 July 2026, and for everything on the shelf from 31 July 2028.
Animal-testing status
Since 11 March 2013 no cosmetic product may be placed on the EU market that was tested on animals for cosmetic purposes, and neither may its ingredients (Art. 18). The alternative methods behind the safety assessment belong in the file, not in a claim on the pack.
Origin, certificates and claims
Country of origin for imported products, organic, fair-trade and vegan certificates as attachments with their certificate numbers and validity. Every claim has to hold up against the common criteria of Regulation (EU) No 655/2013, which means the evidence has to be filed somewhere findable.
Take it with you
The checklists as PDFs to print and tick off - no account needed.
Cosmetics checklist for the duties that apply today
These duties apply today under existing law; no product passport act covers this industry yet. We update this list as soon as one is published.
Transpareo for Cosmetics
Cosmetics needs no passport by law, so the passport has to pay for itself on the shelf and at the scan. Transpareo carries almost two decades of Cosmetic Analysis experience with ingredient data into a product template built for the fields the Cosmetics Regulation actually asks for. Ingredients are structured rows rather than a paragraph of text, allergens are their own property type with their own thresholds, certificates hang on the product as attachments with their numbers and validity, and every property can carry a source note. You capture the data once, through the interface, by Excel import or via the API, and publish a signed passport that shows the public tier to anyone with a phone and the safety file only to the people entitled to it. Every duty named above has its counterpart below.
Every duty has its counterpart
INCI as structured data
Ingredients are rows, not a paragraph. Each carries its INCI name, its function and its position in the declaration, so the list can be rendered on the passport, exported for the notification and checked against a new allergen threshold without retyping it.
Allergens that stay findable
Fragrance allergens are their own property type with their own thresholds. When a supplier declaration changes, you see which products are affected instead of opening 300 specification sheets.
Two tiers, one link
Visibility is a property of every data field. The ingredient list and the claims appear without any login; the safety assessment, supplier declarations and certificates sit behind logged access for the people who are entitled to them.
Certificates as attachments
Organic, vegan, fair-trade and test reports hang on the product with their number and validity, and each property can carry a source note saying where the value came from. That is what turns a claim into a justified claim.
Every scan is a customer contact
The passport page carries your branding, your product story and the full declaration in 24 official EU languages and 16 more, translated automatically and checked by you, and can carry a form for questions, samples or a newsletter. A customer who scans a tube has already decided to trust it; the page is where that trust turns into a relationship.
Every reformulation stays readable
A recipe change is a new signed version of the passport, and the earlier versions stay retrievable. When someone asks what was in the tube they bought two years ago, the answer exists.
Frequently asked questions about the DPP for Cosmetics
Is a Digital Product Passport mandatory for cosmetics?
No. No delegated act under the Ecodesign for Sustainable Products Regulation covers cosmetics, and the first working plan of 16 April 2025 does not list them among the priority product groups. What is mandatory is the older set of duties in Regulation (EC) No 1223/2009 - the ingredient list on the pack, the responsible person, the product information file and the notification. A passport is the place to put all of that where a phone can read it, not a new legal obligation. What makes it worth having anyway is the label - everything that no longer fits on the tube fits on the page behind the code, in every market language, with your branding on it.
Does this apply to importers?
Yes, and more heavily than most people expect. Whoever brings a cosmetic product into the EU from a third country places it on the market, and under Art. 4(5) the importer is the responsible person unless it designates someone else in writing. That means the product information file, the safety assessment and the notification, not just customs paperwork. Agree in the supply contract who delivers the INCI data, the allergen figures and the safety assessment, and in which format, before the first pallet moves.
Who can be the responsible person, and can my distributor take the role?
The responsible person is one natural or legal person established in the Union, named on the label (Art. 4 and Art. 19(1)(a)). A distributor becomes the responsible person only when it places the product on the market under its own name or brand, or modifies it in a way that affects compliance (Art. 4(6)). Otherwise the role stays with the manufacturer, the importer or a designated third party. It is a real liability, not a mailbox, so settle it in writing.
Do I still have to notify in the CPNP if I publish a passport?
Yes. The notification under Art. 13 goes to the Commission’s portal and serves poison centres and market surveillance; it is not replaced by anything public. A passport sits next to it and serves the buyer in the shop. The good news is that both draw on the same data, so once the formulation, the frame formulation and the responsible person are maintained in one place, the notification and the passport stop being two separate data-entry jobs.
What changed for fragrance allergens, and by when?
Commission Regulation (EU) 2023/1545 of 26 July 2023 raised the number of fragrance allergens that have to be named individually in the ingredient list from 24 to roughly 80, above 0.001 per cent in leave-on and 0.01 per cent in rinse-off products. Products that do not carry the extended declaration could be placed on the Union market only until 31 July 2026 and may be made available only until 31 July 2028. In practice the work is not the label but the supplier declarations behind it, because most brands do not hold the fragrance composition themselves.
May the ingredient list move behind a QR code instead of the pack?
Not as a substitute. Art. 19(1) requires the ingredient list on the container or packaging, and the only relief the regulation gives is Art. 19(2) - where that is practically impossible, the list goes on an enclosed or attached leaflet, label, tape, tag or card, referred to by the hand-and-book symbol of Annex VII. The targeted revision that Parliament and Council agreed in June 2026 does not add a digital route for cosmetics either. What a passport does is carry the same list where it is readable - at full size, with the function of each substance and the allergen thresholds, in the 24 official EU languages and 16 more - and keep it current when the pack cannot be reprinted. The pack stays the legal carrier; the passport is the copy people actually read.
Do I need a GTIN?
No. Cosmetics law prescribes no identifier at all, only the batch number and the particulars of Art. 19. If you have a GTIN, the identifier in Transpareo becomes a GS1 Digital Link that other systems resolve too, which is convenient because retail already carries the number. Without one the product gets a unique Transpareo identifier, and the QR code leads to the same passport.
Who sees which data?
Cosmetics law splits the information in two. The pack and Art. 21 govern what the public may see - the ingredient list, the qualitative and, for hazardous substances, the quantitative composition, and the data on undesirable effects. The product information file under Art. 11 stays with the responsible person and is opened to the competent authority, not to the buyer. In Transpareo, visibility is a property of every data field, so the public tier appears without any login and the safety assessment, the supplier declarations and the certificates sit behind logged access.
How long does the information have to stay available?
The product information file has to be kept for ten years after the last batch was placed on the market (Art. 11). A passport that carries the same data sensibly outlives the last jar as well, otherwise the link printed on it goes nowhere. So ask any provider what happens to your passports after a cancellation - with Transpareo, published passports stay reachable through a permanent address, and our provider checklist names the further questions worth asking.
What does non-compliance cost?
Regulation (EC) No 1223/2009 leaves the penalties to the member states but requires them to be effective, proportionate and dissuasive. The expensive part is rarely the fine. A market surveillance authority can order withdrawal or recall, and in cosmetics a recall over a missing allergen declaration is a public event that outlasts the corrective action by years. Getting the ingredient data right once is cheaper than explaining it later.
Does the targeted revision change what goes on the label?
Not for the ingredient list. The proposal of 8 July 2025 deletes the Commission’s glossary of common ingredient names and points the labelling rule at an internationally recognised nomenclature instead, adds a procedure for listing colourants, preservatives and UV filters, clarifies how substances classified as CMR are handled and removes the separate nanomaterial pre-notification. Parliament and Council agreed politically on 16 June 2026 and the final text is not in the Official Journal yet, so treat every detail as provisional. Nothing in it moves the mandatory particulars off the pack and into a QR code.
Official documents
The legal sources to read for yourself: what each document is and when you need it.
- Regulation (EC) No 1223/2009 on cosmetic productsThe regulation itself, applicable since 11 July 2013. Art. 4 defines the responsible person, Art. 11 the product information file and its ten-year retention, Art. 13 the notification, Art. 19 the labelling and Art. 21 what the public may ask to see. The source for every question this page leaves open.
- Commission Regulation (EU) 2023/1545 on fragrance allergen labellingAmends Annex III and raises the number of individually declarable fragrance allergens from 24 to roughly 80. The footnotes to its annex carry the two dates that matter, 31 July 2026 for placing on the market and 31 July 2028 for making available. Read it next to your fragrance supplier's declaration.
- Commission Regulation (EU) 2024/996 on Vitamin A, arbutin and endocrine disruptorsRestricts Vitamin A, Alpha-Arbutin and Arbutin and several substances with potential endocrine-disrupting properties. The annex gives each substance its own dates, so read the entry for your ingredient rather than the headline.
- Commission Regulation (EU) No 655/2013 on the justification of claimsThe six common criteria every claim has to meet - legal compliance, truthfulness, evidential support, honesty, fairness and informed decision-making. Worth reading before you write anything into a passport that sounds like marketing.
- Proposal COM(2025) 531 on the simplification of chemicals rulesThe Commission proposal of 8 July 2025 that amends the Cosmetics Regulation alongside the chemicals and fertilising-products rules. Parliament and Council agreed politically on 16 June 2026; the final text is not published yet. Read it if you want to know what changes next.
- Commission page on cosmetic productsThe official overview of the sector, with the notification portal, the scientific assessment of ingredients, the animal-testing ban and market surveillance. The place where changes to the annexes appear first.
- Regulation (EU) 2024/1781 (ESPR)The framework regulation behind the Digital Product Passport in the industries that do have one. Relevant here mainly for what it does not say - Art. 1(2) does not exclude cosmetics, so a delegated act remains possible in a later working plan.
Further reading on our blog
Cosmetics: 20 years of product transparency as a blueprint for DPPs
What other sectors can learn from Cosmetic Analysis - lessons from almost two decades of ingredient transparency.
From compliance document to marketing tool
Every QR scan is a consumer interaction. How companies use their DPPs as a lead-generation channel - without greenwashing.
40 languages automatically: how our AI translation handles technical terminology
A look behind the scenes of our automatic product-data translation - and why technical terminology has to be treated differently from a novel.
What the DPP obligation really costs - and what penalties cost
Platform subscription against a fine: why the timely DPP introduction always costs less than the late one.
The label is out of room. The passport is not.
Start free and put the full declaration, the certificates and your story behind the code on the tube.