Allergen Compliance for Online Food Businesses: The Complete Guide
Running a food business online comes with a responsibility that goes far beyond great recipes and fast shipping. Every year, thousands of people in the UK and US experience allergic reactions to food
Running a food business online comes with a responsibility that goes far beyond great recipes and fast shipping. Every year, thousands of people in the UK and US experience allergic reactions to food — and for roughly 200 people in the UK alone, those reactions prove fatal. If you sell food products through your Shopify store, allergen compliance is not optional, a nice-to-have, or something you can address later. It is a legal requirement, and the consequences of getting it wrong range from enforcement notices to life-altering lawsuits.
The challenge for most small and medium food businesses is that allergen law is genuinely complex. UK food law under Regulation (EU) No 1169/2011 — retained into UK law post-Brexit — mandates clear disclosure of 14 major allergens on prepacked and non-prepacked food. In the United States, the Food Allergen Labeling and Consumer Protection Act (FALCPA), updated in 2023 to add sesame as a ninth major allergen, sets its own distinct standards. Operating across both markets, or simply keeping up with one, requires systems rather than guesswork.
This guide walks you through exactly what online food businesses need to know: the legal requirements in the UK and US, how to build compliant product labelling, what "may contain" really means, how to manage ingredient changes, and how technology can make compliance manageable at scale. Whether you sell three SKUs or three hundred, the principles apply.
Understanding the 14 UK Allergens and 9 US Major Allergens
The first step to compliance is knowing precisely which substances you are required to declare. Under UK law, the 14 major allergens are: celery, cereals containing gluten (wheat, rye, barley, oats), crustaceans, eggs, fish, lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulphur dioxide and sulphites (at concentrations above 10mg/kg), and tree nuts. Each of these must be emphasised — typically in bold — whenever they appear as an ingredient in a prepacked product's ingredient list. Failing to emphasise them, even if they are listed, is a labelling offence under UK Food Standards Agency guidelines.
In the United States, FALCPA originally identified eight major food allergens: milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, and soybeans. As of January 2023, sesame joined that list, bringing the US total to nine. Unlike the UK system, US law does not require allergens to be typographically emphasised within an ingredient list — but it does require that the allergen be declared either within the ingredient list itself or in a separate "Contains" statement immediately following it. The regulatory approach differs, but the underlying goal is identical: informed consumer choice.
For businesses selling into both markets, the practical implication is that a single label often cannot serve both jurisdictions. A product containing lupin — a legume increasingly common in gluten-free flours — must declare it under UK law but faces no equivalent federal requirement in the US. Molluscs are separately listed in the UK but fall under the broader shellfish category for US purposes. Building a compliance matrix that maps each product's ingredients against both regulatory frameworks is the only reliable way to manage this complexity without errors.
Prepacked, PPDS, and Non-Prepacked: Why the Category Matters
Not all food products fall under the same labelling rules, and misclassifying your product category is one of the most common compliance mistakes online food businesses make. Prepacked food is food placed in packaging before being offered for sale, where the packaging fully or partially encloses the food and cannot be altered without opening. The vast majority of products sold through Shopify food stores — jars of sauce, bags of granola, boxed confectionery — fall into this category and require full ingredient and allergen labelling.
Prepacked for direct sale (PPDS) is a distinct category introduced into UK law under Natasha's Law, which came into force in October 2021. PPDS food is food that a business packs and sells at the same premises — think a deli counter, a bakery, or a market stall. Under Natasha's Law, PPDS food must carry the product's name and a full ingredient list with allergens emphasised. This law was introduced following the death of Natasha Ednan-Laperouse, who died after eating a baguette from a Pret a Manger outlet that contained sesame seeds not declared on the packaging. The law was named in her memory.
Non-prepacked food — food sold loose, such as pick-and-mix sweets at a counter or bread sold unpackaged — requires allergen information to be available orally or in writing, but does not require a full label. For online sellers, this category is the least common, since products must be packaged for safe transit. However, if you operate a hybrid model — selling both online and at farmers' markets or pop-ups — you need to understand which rules apply to which channel and ensure your staff can provide accurate verbal allergen information for any loose products.
Writing Compliant Allergen Labelling for Your Product Pages
For online food businesses, your product page is both your marketing asset and your legal document. Under UK law, distance selling regulations require that allergen information for prepacked food sold online must be provided before the customer completes the purchase and at the point of delivery. This means your Shopify product descriptions must include full allergen information — not a note saying "contact us for allergen details" — and that information must be visible without the customer needing to click through to a separate page.
The most practical approach is a structured allergen block within every product description. This should include the full ingredient list, allergens emphasised in bold, a "Contains" statement listing all major allergens present, and a "May Contain" advisory if your production environment handles other allergens. For a product like a chocolate chip cookie, that might read: Contains: wheat (gluten), milk, eggs, soya. May contain: peanuts, tree nuts. Presenting this information consistently across every listing reduces the risk of human error and makes it easier for customers with allergies to shop your store safely.
One specific pitfall to avoid is the temptation to copy allergen information from a supplier's specification sheet without verifying it against your actual recipe. Supplier specs are a starting point, not a finished label. If you use a third-party manufacturer, you need a product specification agreement in writing that confirms allergen status, and you need to review that agreement every time the manufacturer changes an ingredient or production process. The legal responsibility for accurate labelling sits with you as the business putting the product on the market.
Managing the "May Contain" Advisory Correctly
Precautionary allergen labelling (PAL) — commonly seen as "may contain traces of" statements — is an area where confusion is widespread and the consequences of getting it wrong are serious in both directions. Under current UK guidance from the FSA, PAL statements are voluntary, but when used, they must be truthful and based on a genuine risk assessment, not applied as a blanket disclaimer to avoid liability. Using "may contain" statements on products that pose no realistic cross-contamination risk is considered misleading under the Food Safety Act 1990 and erodes trust with the allergic community, who often rely on the absence of PAL statements to identify products they can eat safely.
A credible PAL statement requires documented evidence: a written assessment of your production environment, cleaning procedures, shared equipment, and ingredient handling. For a home baker producing nut-free cakes in a kitchen that also handles walnuts, the "may contain" advisory is not only appropriate — it is essential. For a manufacturer whose nut-free line runs on dedicated equipment in a separate room, applying the same advisory without justification is both inaccurate and potentially harmful to sales, since allergic consumers will avoid the product unnecessarily.
In the United States, PAL statements are not regulated by FALCPA and remain voluntary. However, the FDA has published guidance encouraging manufacturers to use them consistently and accurately, and several states have introduced or are considering their own PAL regulations. If you are selling to the US market, treating PAL as seriously as you would in the UK is not just good practice — it is increasingly the direction of regulatory travel, and building accurate cross-contamination documentation now will position your business ahead of any future requirements.
Building a System for Ingredient Change Management
One of the highest-risk moments in allergen compliance is not the initial product launch — it is what happens six months later when your oat milk supplier quietly reformulates their product and the new version contains a trace allergen that the previous one did not. Ingredient change management is the process of monitoring, documenting, and communicating changes to your formulations in a way that keeps your labels and product listings accurate at all times. Without a system, changes fall through the gaps.
A workable system starts with your supplier relationships. Every supplier should be contractually required to notify you in writing before making any formulation change, including changes to processing aids, carriers, and flavour compounds — which are common hidden sources of allergens like sulphites and celery derivatives. Request updated ingredient specifications at least annually, and after any notification of a site or process change. File every specification with a date stamp so you have a clear audit trail if a question is ever raised about a specific product batch.
On your Shopify store, the practical implication is that product descriptions and labels must be updated simultaneously — not sequentially. If your label changes on the 1st of a month but your product page is not updated until the 15th, customers who order in that window are receiving inaccurate information. Tools like Allergen Matrix are designed specifically to help Shopify merchants manage this synchronisation, mapping ingredient data to product listings and flagging where updates are needed when formulations change. Building a quarterly review into your operations calendar — where every product's specification is cross-checked against its live listing — will catch the gaps that ad hoc processes miss.
Handling Customer Allergen Enquiries Professionally
Even the most complete product page cannot anticipate every question a customer with a food allergy will ask, and how your team handles those enquiries matters both legally and commercially. Under UK law, food businesses have a duty to provide accurate allergen information when asked. If a customer contacts you through your Shopify store's chat function or by email asking whether a product is safe for someone with a tree nut allergy, you cannot guess, deflect, or give a vague answer. Your response needs to be accurate, documented, and traceable.
The foundation of a good enquiry process is a centralised allergen information system that every member of your team can access quickly. This might be a shared Google Sheet mapping every SKU to its allergen profile, a dedicated section of your internal wiki, or a purpose-built app that integrates with your Shopify admin. Whatever format you use, the key requirement is that the information is current, consistent with your product labels, and accessible to whoever is responsible for answering customer questions — whether that is you, a virtual assistant, or a customer service team member.
Training is the other half of this equation. Anyone answering allergen queries on behalf of your business needs to understand the difference between "does not contain" and "may contain," know how to look up accurate information rather than relying on memory, and understand when to escalate a query rather than answer it directly. A customer with a severe sesame allergy asking whether your tahini-free hummus is produced on shared equipment deserves a precise, checked answer — and providing that answer correctly builds the kind of trust that turns first-time buyers into long-term customers.
Conclusion
Allergen compliance for online food businesses is demanding, but it is also entirely manageable when you treat it as a system rather than a checklist. The key principles are consistent across UK and US markets: know your legal obligations, document your ingredient data accurately, communicate that information clearly on your product pages, and build processes that catch changes before they create risks.
The businesses that do this well are not necessarily the largest — they are the most organised. They maintain current supplier specifications, write accurate PAL statements based on real risk assessments, and update their Shopify listings the moment a formulation changes. They train anyone who speaks to customers to answer allergen questions accurately and know when to seek confirmation rather than guess.
Start with an audit of your existing product listings against your current ingredient specs. Identify the gaps. Fix the labels. Then build the processes that prevent those gaps from opening again. Your customers' safety depends on it — and so does your business.
Try Allergen Matrix free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.