Selling cosmetics to EU customers from Shopify or Etsy: GPSR and the Cosmetics Regulation
A cosmetic sold to EU customers online is caught by two regulations: the Cosmetics Regulation (EC) 1223/2009, which asks for a responsible person, a safety report, a file and a CPNP notification, and the General Product Safety Regulation (EU) 2023/988, which — for a cosmetic — mostly steps back but still sets rules for how the offer is shown online. The marketplace asks about GPSR; your product needs the Cosmetics Regulation.
How GPSR and the Cosmetics Regulation fit together
GPSR has applied since 13 December 2024 (Art. 52, Reg. (EU) 2023/988). It gives way to more specific Union law:
Where products are subject to specific safety requirements imposed by Union law, this Regulation applies only to those aspects and risks or categories of risks which are not covered by those requirements. — Art. 2(1), Reg. (EU) 2023/988
For products under "Union harmonisation legislation", it goes further and switches off whole parts of itself: Chapter II for the risks that legislation already covers, and Chapter III Section 1 (Articles 9 to 18), Chapters V and VII and Chapters IX to XI entirely (Art. 2(1)(a)–(b)).
The Cosmetics Regulation counts as Union harmonisation legislation. GPSR defines the term by reference to Annex I of Regulation (EU) 2019/1020 (Art. 3(27), Reg. (EU) 2023/988), and Regulation (EC) 1223/2009 is entry 35 in that Annex.
Whose name goes in the "EU responsible person" field
For a cosmetic, GPSR's own responsible-person article (Art. 16, Reg. (EU) 2023/988) does not apply: it sits in Chapter III Section 1, which Art. 2(1)(b) switches off. Nor does the equivalent article of Regulation (EU) 2019/1020 (Art. 4), whose list of covered legislation in Art. 4(5) does not include the Cosmetics Regulation.
So, for a cosmetic, the responsible person is the one designated under Art. 4 of Regulation (EC) 1223/2009 — and that is the name and address a marketplace's "EU responsible person" field should carry. This is our reading of the texts quoted above, set out so you can check it; we have not found an authority stating it in these words.
What it does not do is fill in the rest. Filling in the marketplace field does not give you a responsible person under Art. 4, and having one does not, by itself, populate the form. How the responsible person role works →
Check my product — free
Paste the product's public listing URL. We check which of the eight obligations are visibly met — free, while you wait — a screen of the public words, not a safety assessment.
No public page, or the list is only on the pack? Paste it instead
What your product page itself has to show
GPSR's rule on distance sales sits in Chapter III Section 2, which is not switched off for cosmetics. Where a product is made available online, the offer must "clearly and visibly indicate at least" (Art. 19, Reg. (EU) 2023/988):
- (a) the manufacturer's name, registered trade name or registered trade mark, and the postal and electronic address at which they can be contacted;
- (b) where the manufacturer is not established in the Union, the name, postal and electronic address of the responsible person;
- (c) information allowing the product to be identified, including a picture of it, its type and any other product identifier;
- (d) any warning or safety information to be affixed to the product or packaging, in a language consumers can easily understand, as determined by the Member State where it is sold.
That is the Shopify or Etsy product page itself, not only the pack. Whose address goes on the pack →
Shipping from outside the EU, direct to EU customers
Regulation (EU) 2019/1020, which applies to products under the legislation in its Annex I — cosmetics included — has a rule for online offers:
Products offered for sale online or through other means of distance sales shall be deemed to be made available on the market if the offer is targeted at end users in the Union. An offer for sale shall be considered to be targeted at end users in the Union if the relevant economic operator directs, by any means, its activities to a Member State. — Art. 6, Reg. (EU) 2019/1020
A store that ships to EU addresses is, on that article, making its products available on the EU market. Making available is not the same as placing on the market — who imports, and how the goods travel, still matter for that — but it is enough for the online offer to be in scope. Already selling to the EU? →
What the product needs, whatever the platform
- A responsible person designated within the Union (Art. 4).
- A safety report (Art. 10) — what a CPSR is.
- A product information file (Art. 11) — the PIF checklist.
- A CPNP notification (Art. 13) — how CPNP works.
Questions people ask
Does Etsy's or Shopify's GPSR form cover my cosmetic?
No. The form asks about one regulation; your product needs both. The cosmetics obligations — responsible person, safety report, file, notification — come from Regulation (EC) 1223/2009. If what you sell is a bar soap or another wash-off, do I need a CPSR for handmade soap? → answers it directly.
Since when does GPSR apply?
From 13 December 2024 (Art. 52, Reg. (EU) 2023/988).
Is GPSR's responsible person the same as the cosmetics responsible person?
For a cosmetic, GPSR's responsible-person article (Art. 16) does not apply, because GPSR steps back for products under harmonisation legislation (Art. 2(1)(b)). The responsible person is the one under Art. 4 of Regulation (EC) 1223/2009.
Start with the free check — see what your listing is missing, while you wait.