CPGShield resources · Federal cosmetic labeling
For small cosmetic brands, label space is expensive.
Every line competes with the logo, product identity, net quantity, ingredients, claims, warnings, directions, and design.
So founders naturally ask:
Can I just put my website on the package instead of a physical business address?
For FDA's traditional name-and-place-of-business requirement, the answer is no.
FDA's small-business guidance specifically says that a P.O. box or website address is not adequate by itself for this labeling requirement.
But MoCRA added another contact-information rule where electronic contact information-including a website-can matter.
Those two rules are easy to confuse. The MoCRA side is covered in the MoCRA label requirement brands should not treat as back-office.
Under 21 CFR 701.12, a cosmetic label must identify the name and place of business of the manufacturer, packer, or distributor.
FDA says the business address generally includes:
There is an old but still relevant exception: the street address may be omitted if the firm is listed in a current city or telephone directory.
That does not mean the entire location can disappear.
A URL alone is not a substitute for the information required by 21 CFR 701.12.
Many indie brands use contract manufacturers.
In that case, the company whose name appears on the label may not be the actual manufacturer.
FDA requires the relationship to be stated accurately.
Examples include:
or similar wording that reflects the facts.
This is why simply placing the brand name and city on a package without considering the supply-chain relationship can be risky.
The wording communicates who the named company is in relation to the product.
The Modernization of Cosmetics Regulation Act added a label-facing adverse-event contact requirement.
Under section 609(a) of the Federal Food, Drug, and Cosmetic Act, cosmetic labels must include:
through which the responsible person can receive adverse-event reports.
FDA's guidance says the electronic contact information may include a website.
This is where founders can accidentally combine two different rules into one.
A website can be relevant to the MoCRA adverse-event contact requirement.
That does not mean the website automatically replaces the separate name-and-place-of-business requirement in 21 CFR 701.12.
Suppose a brand prints a full domestic business address.
That information may potentially function in more than one compliance context if it satisfies each applicable requirement.
But suppose the brand prints only:
cpgbeautybrand.com
That may provide electronic contact information for adverse-event reporting if the site actually facilitates those reports.
It does not by itself provide the full name-and-place-of-business information FDA describes under 21 CFR 701.12.
The correct question is not:
“Can I swap the address for a website?”
It is:
“Which requirements apply to this label, and does each piece of contact information actually satisfy the requirement I am using it for?”
A QR code is attractive because it saves space.
But FDA has cautioned firms to think about accessibility when choosing electronic contact information for adverse-event reporting.
In its MoCRA registration and listing guidance, FDA notes that a QR code is unlikely to facilitate reporting for all consumers because of accessibility limitations.
That does not make QR codes useless.
It means a QR code should not automatically be treated as the answer to every labeling requirement.
This requirement is uncomfortable for some small companies because the business may operate from a home address.
Compliance and privacy can collide.
The answer should not be to silently remove required information.
Instead, founders should evaluate legitimate business-address options and confirm that the selected information actually satisfies the applicable rule.
The label should reflect a real, compliant business arrangement-not a placeholder chosen simply because it fits the artwork.
A pre-print checker should distinguish at least three questions:
Those are related questions.
They are not identical.
FDA says a website alone is not adequate for the traditional name-and-place-of-business requirement.
FDA's small-business cosmetics guidance says a P.O. box alone is not adequate for that requirement.
FDA states that the street address may be omitted when the firm is listed in a current city or telephone directory, while the other required location information remains.
FDA guidance says electronic contact information may include a website, provided it facilitates receiving adverse-event reports.
The manufacturer, packer, or distributor may be identified, but the relationship must be accurately qualified when the named firm is not the manufacturer.
A missing line of business information can be addressed in the draft once the correct details are available.
It is much harder to fix across thousands of finished boxes.
CPGShield checks cosmetic labels for required business information alongside the rest of the federal, state, claims, ingredient, retailer, Proposition 65, and artwork rules in its compliance engine.
See whether the label is missing something while the file is still editable.
→ Run a free cosmetic label compliance scan at CPGShield.com
The cheapest compliance correction is usually the one made before printing.
This article is educational and does not constitute legal advice.
Free cosmetic label compliance check. No demo required, no card. CPGShield LLC provides independent screening. We are not affiliated with, endorsed by, or acting for any retailer, brand, agency or organization we name.