Product Compliance For Ecommerce Brands.

What Changed on July 8, 2026

The single most consequential compliance change for importers in years, and one many sellers still have not registered.

The rule

The CPSC approved a final rule in December 2024, published in January 2025, revising 16 CFR Part 1110 to require electronic filing of certificates of compliance for imported consumer products. The Commission approved an eighteen-month implementation period. That period ended on July 8, 2026, and eFiling is now mandatory for importers of most regulated consumer products.

What it means operationally

• Certificate data goes to Customs electronically via a Partner Government Agency Message Set, filed with the entry.
• It happens before arrival, not after. This is the change most sellers misunderstand — eFiling is not something that occurs if CPSC asks, it is part of entry filing.
• Roughly sixteen data elements per SKU per shipment, covering product identification, certifier contact details, testing laboratory information and manufacturing traceability.
• The voluntary window has closed. Filing errors made during the voluntary stage between January 2025 and July 7, 2026 carried no punitive consequences. That grace period is over.

Why it matters commercially, not just legally

Beyond the regulatory exposure — which can include civil penalties, shipment refusal at the border, forced export at the importer's cost, and recall liability — major marketplaces have begun cross-referencing eFiling records. Uncertified SKUs face listing removal and account restrictions, which means a filing failure shows up as a commercial problem long before it shows up as a legal one.

The regulation text itself is at 16 CFR Part 1110 on eCFR.

CPSC: Certificates and Testing

What a Children's Product Certificate must identify

• The product it covers, specifically enough to be matched to it.
• Each safety rule the product is certified against, with the legal citation.
• The importer or domestic manufacturer, with contact details.
• The party maintaining the test records, with contact details.
• The date and place of manufacture.
• The date and place of the testing.
• The third-party laboratory that conducted the testing.

The classification trap

Children's product status turns on whether the product is designed or intended primarily for children twelve or younger. That is a judgment about design and marketing intent, not about who happens to purchase it. Packaging imagery, listing copy, category placement and advertised use all feed into it.

Which produces a genuine risk: a general-use product marketed with children in the imagery can be treated as a children's product, pulling it into a third-party testing regime the seller never budgeted for. If you are close to that line, it is worth asking a professional before the marketing goes live rather than after.

The testing rules and the specific citations for each are maintained by CPSC. Note that cpsc.gov blocks automated access, so search the CPSC business guidance pages directly rather than following a deep link.

California Proposition 65

The regime that catches the most sellers by surprise, because it applies to anyone selling into California regardless of where the business sits.

How it works

Proposition 65 requires a clear and reasonable warning before knowingly exposing anyone in California to a listed chemical known to the state to cause cancer or reproductive harm. The list runs to hundreds of substances and is updated. Enforcement is substantially driven by private plaintiffs, which is what makes it a practical business risk rather than an abstract one.

What has been moving

Amendments affecting warning content and format took effect during 2025, particularly around short-form warnings, which had been widely used precisely because they were short. If your warnings were drafted before 2025, they are worth re-checking against the current requirements rather than assumed to still comply.

The practical questions to resolve

• Does any listed chemical appear in your product, including in components, coatings, adhesives or packaging?
• Is a warning required, and in which form? Short-form availability and content requirements have changed.
• Where must the warning appear? For online sales the warning generally needs to be visible before purchase, not only on the product.
• Who is responsible in your supply chain? This is a contract question and it is negotiable.

Primary sources are the official Prop 65 warnings site and OEHHA's law and regulations pages.

FTC Advertising Rules

Less about the product and more about what you say about it, which makes it the regime most likely to be breached by a marketing decision nobody flagged.

Claim substantiation

Advertising claims must be substantiated before they are made. For health, safety and performance claims the expected level of support is higher. The practical failure mode in ecommerce is a listing bullet or an ad headline written by someone who has never seen the underlying testing, asserting something the product cannot support.

Endorsements and reviews

• Material connections must be disclosed. If a reviewer or creator received payment, free product, a discount or affiliate commission, that connection requires disclosure.
• Platform labels are not sufficient on their own. A Sponsored tag says the placement is paid; it does not communicate the person's connection to the brand.
• The brand carries the liability, regardless of who ran the campaign or wrote the copy.
• Fake and incentivised reviews carry substantial penalties. The FTC's rule addressing deceptive consumer reviews and testimonials makes buying, selling or procuring fake reviews and certain review suppression practices actionable with meaningful civil penalties.

The three practices that cause most problems

1. Repurposing organic customer content as advertising without consent or disclosure.
2. Review incentivisation that crosses from permitted solicitation into paying for positive sentiment.
3. Contracts that never address claim substantiation, leaving creators free to say things the brand cannot support.

The cheapest protection available is a contract clause listing the claims a creator may and may not make, plus a pre-publication approval step. Primary guidance is at the FTC's Endorsement Guides and Disclosures 101.

FDA-Adjacent Categories

If you sell cosmetics, supplements or anything device-like, you are in a different regime with different vocabulary and materially higher stakes.

Cosmetics

Modernised federal cosmetics regulation introduced facility registration, product listing, safety substantiation and adverse event reporting obligations. Labeling requirements are prescriptive. The recurring failure is a claim that converts a cosmetic into an unapproved drug in regulatory terms — language about treating, preventing or altering a condition rather than cleansing, beautifying or altering appearance.

Supplements

• Structure and function claims are permitted within limits and require the standard disclaimer.
• Disease claims are not permitted for supplements, and the line is narrower than most marketing teams assume.
• Manufacturing practice requirements apply to the facility.
• Ingredient status matters, and novel ingredients carry their own notification requirements.

The language rule that governs both

A claim can change your product's regulatory classification without changing the product. The identical bottle of cream is a cosmetic or an unapproved drug depending on the sentence next to it. That is why compliance in these categories has to sit with whoever approves copy, not only with whoever manages the supply chain.

Our supplements brand playbook covers that category specifically. Primary sources include FDA cosmetics guidance and FDA dietary supplement guidance.

Marketplace Policy On Top

This is the layer that actually affects your revenue, and it operates on different principles from the law underneath it.

What platforms commonly require

• Certificates of compliance and third-party test reports for regulated categories.
• Supplier invoices and letters of authorisation.
• Ingredient and materials documentation.
• Safety data sheets where applicable.
• Category-specific approvals before listing at all.

The consequential point is that you can be fully compliant with the law and still be delisted for failing to produce documentation in the format and timeframe the platform demands. Those are separate problems requiring separate preparation.

What Actually Triggers a Delisting

In rough order of how often it happens.

1. A customer complaint alleging a safety issue. Frequently the first domino, and it does not need to be well-founded to start the process.
2. A competitor report. Sometimes accurate, sometimes tactical, always investigated.
3. An automated listing scan catching prohibited claim language, a missing warning, or a category mismatch.
4. A category audit where the platform reviews everyone in a category and requests documentation from all of it.
5. A recall or safety notice affecting your product or a component.
6. Certificate data absent or mismatched against import records, which is newly consequential now that eFiling is mandatory.
7. A regulatory action that becomes public.

The pattern worth internalising

Most delistings begin with something you did not control — a complaint, a report, an audit. What you control is how fast you can produce documentation once it starts. Sellers with an organised folder resolve in days; sellers assembling documents reactively lose weeks of sales while suppliers respond slowly or not at all.

The Documentation Folder

Assemble this before you need it. The entire practical value of compliance preparation is response speed.

1. Certificates — CPC or GCC as applicable, current, matching your actual products.
2. Third-party test reports from accepted laboratories, with dates and scope.
3. eFiling records for imported shipments, matched to entries.
4. Supplier invoices that reconcile against your sales volume.
5. Letters of authorisation where you resell branded goods.
6. Ingredient and materials specifications, including components, coatings and packaging.
7. Safety data sheets where applicable.
8. Claim substantiation — for every claim in your listing copy, the evidence supporting it.
9. Labeling artwork approvals with version history.
10. Prop 65 assessments and the reasoning behind warning decisions.
11. Your written compliance process, which is itself part of a credible response.
12. Business registration and identity documents matching your seller account exactly.

Testing: When, What, Who

When third-party testing is required

For children's products subject to a children's product safety rule, third-party testing at a CPSC-accepted laboratory is required. For regulated general-use products a General Certificate of Conformity is required and may be based on a reasonable testing programme rather than third-party testing, depending on the rule.

What triggers retesting

• A material change to the product, its components or its manufacturing.
• A change of supplier or manufacturing site.
• Periodic testing requirements under a continuing testing plan.
• A new or amended safety rule applying to your category.

The one sellers miss most often is the supplier change. Moving production to a new factory can invalidate your existing certification even when the product specification is identical, because the certificate speaks to what was tested and where.

Choosing a laboratory

• It must be CPSC-accepted for the specific rules you are certifying against, not merely accredited generally.
• Confirm the scope covers your exact product type.
• Ask about turnaround before you need it urgently, since capacity varies.
• If you sell on Amazon, understand whether their testing request process applies to you in addition to CPSC obligations.

Costs vary widely by category and rule count, so get quotes against your specific product rather than working from a benchmark. Budget the time as well as the money — testing lead time is what pushes launches, and it does not compress under pressure.

Supplier Contract Clauses

Compliance risk mostly originates upstream, so the contract is where it should be allocated. Have a lawyer draft these; the point here is knowing to ask.

• Compliance warranty. The supplier warrants the goods conform to applicable US safety standards and regulations.
• Documentation obligation. Supply of test reports, certificates and materials specifications, with a defined timeframe for producing them on request.
• Notification of change. Advance notice of any change to materials, components, manufacturing site or process. This is the clause that protects your certification.
• Testing cooperation. Provision of samples and access for testing, at defined cost allocation.
• Indemnity for losses arising from non-conforming goods.
• Recall cost allocation, agreed before anyone needs it.
• Audit rights over the manufacturing facility.
• Survival, so obligations outlive the supply relationship — claims can arrive years after the last shipment.

The enforceability caveat worth being honest about

An indemnity from an overseas supplier with no US presence and no US assets may be difficult to enforce in practice. That does not make the clause worthless — it shapes behaviour and it documents the allocation — but do not treat it as insurance. Your practical protection is verification: knowing what is in the product, having the documentation, and testing when the situation calls for it.

The sourcing and cost dimension is covered in our tariffs and Section 301 cost strategy guide, and packaging obligations in the unboxing and packaging playbook.

When You Get a Notice

Whether from a regulator, a marketplace or a plaintiff's attorney, the first hours matter.

1. Read it carefully and identify the source. A marketplace policy notice, a regulatory inquiry and a private plaintiff demand are three different situations requiring three different responses.
2. Do not respond substantively before you understand the exposure. Early admissions are difficult to walk back.
3. For anything regulatory or legal, get a lawyer before replying. This is the point in the article where the disclaimer stops being a formality.
4. Preserve documents. Do not delete anything, including internal communications.
5. Assemble the folder from section eight for the affected products.
6. Assess whether it affects other SKUs. Issues rarely stop at one listing.
7. Note the deadline and calendar it. Marketplace windows are short and missing one converts a solvable problem into an escalated one.

Marketplace notices specifically

These respond to documents rather than to explanation. Provide exactly what is asked for, in the format requested, within the window. A long written justification with no attachments is the most common failed response, and it burns one of a small number of attempts.

Amazon-specific appeal structure is covered in our guides to Section 3 violations and appeals and account health and suspension prevention.

Building the Compliance Calendar

The two habits that matter most

Assess before launching, not after selling. Compliance discovered retroactively is always more expensive, because inventory is already committed, listings are live and the remedy may involve destroying stock.

Treat category expansion as a fresh assessment. The most common way a compliant seller becomes a non-compliant one is adding an adjacent product that sits in a different regime — a children's variant, a supplement version, something with a battery — and assuming existing processes cover it.