FALCPA Compliance for Online-Only Food Businesses
Online-only food businesses — those with no physical retail presence — have the same FALCPA obligations as brick-and-mortar food manufacturers. Here's what applies.
Online-only food businesses — home bakers selling through Shopify, meal kit services, specialty food brands with no physical retail — often assume that FALCPA is primarily a concern for large manufacturers. It isn't. FALCPA applies to any packaged food sold to US consumers, regardless of channel or business size.
The Online Sale Is Still a Sale of Packaged Food
FALCPA defines its scope by the food — "food sold in package form" — not by how it is sold. A home baker selling packaged cookies through an Etsy shop or Shopify store is selling packaged food. A meal kit company shipping boxes of ingredients is selling packaged food. The online-only business model provides no FALCPA exemption.
FDA Guidance for E-Commerce Food Sales
The FDA has published specific guidance on allergen labelling for foods sold through internet and mail-order channels. The guidance requires that: allergen information be available to the consumer before the purchase is made (i.e. visible on the product page); and the physical product arrive with compliant allergen labelling. Both conditions must be met.
State Cottage Food Law Intersections
Many online-only food businesses — particularly home bakers and jam makers — operate under state cottage food laws. These laws allow small-scale home food production with some regulatory relief. However, most cottage food laws do not provide exemption from FALCPA labelling requirements (which are federal, not state). Cottage food businesses selling to US consumers still need to comply with FALCPA allergen declarations.
Practical Steps
For online-only food businesses: create an allergen matrix for every product; ensure physical labels carry "Contains" statements for all nine major allergens; and configure your Shopify product pages to display allergen information before checkout. SaltAI's Allergen Matrix makes this manageable even for very small product catalogues.
Get FALCPA-compliant allergen labelling on your online-only Shopify food store with SaltAI.
Understanding the Nine Major Allergens Under FALCPA
FALCPA originally identified eight major food allergens — milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, and soybeans — and the FASTER Act of 2021 added sesame as the ninth, effective January 1, 2023. Every online food business selling to US consumers must declare all nine on both their physical product labels and their digital product listings. This is not optional, and it applies whether you are shipping one order a week or one thousand orders a day.
Understanding exactly what counts as a major allergen declaration requires reading the ingredient list carefully. Under FALCPA, the allergen source must be declared either in parentheses within the ingredient list — for example, "flour (wheat)" — or immediately after the ingredient list in a clearly formatted "Contains" statement such as "Contains: wheat, milk, eggs." Both formats are acceptable, but the declaration must be unambiguous and cannot be buried in fine print or hidden behind a click-through on your product page.
The sesame addition has caught many small online food businesses by surprise, particularly those who prepared their labels and product pages before 2023. If your Shopify store was built out before the FASTER Act came into effect and you have not reviewed your allergen declarations since, it is worth auditing every product in your catalogue now. Sesame appears in many products — tahini, hummus, certain breads, energy bars, and spice blends — and its presence may not always be immediately obvious from an ingredient name alone.
Digital Labelling: What Your Shopify Product Pages Must Show
The FDA's e-commerce guidance makes clear that the pre-purchase availability of allergen information is a compliance requirement, not a best-practice recommendation. For Shopify stores, this means allergen information must appear on the product page itself — not only in a downloadable PDF, not only in a FAQ page linked from the footer, and not only in a post-purchase email. A consumer must be able to see the allergen declaration before they add the product to their cart and complete a transaction.
In practice, this means you need a structured approach to how allergen data appears across your Shopify storefront. Some merchants use the product description field to list allergens manually, but this approach becomes error-prone as catalogues grow and ingredient formulations change. A dedicated allergen matrix embedded on each product page — one that reflects your current ingredient data — is a far more reliable solution and demonstrates due diligence if your labelling practices are ever scrutinised by the FDA or a state food safety authority.
It is also worth considering the user experience dimension alongside the compliance dimension. Customers with food allergies and intolerances actively look for clear allergen information before purchasing. A Shopify product page that makes allergen data easy to find and easy to read builds trust, reduces pre-purchase enquiries, and decreases the likelihood of a customer receiving a product that triggers an allergic reaction. Compliance and good customer experience point in exactly the same direction here. Allergen Matrix helps Shopify merchants display this information cleanly and consistently across every product listing.
Cross-Contact and "May Contain" Statements for Online Sellers
Cross-contact — the unintentional transfer of an allergen from one food to another during production — is a significant concern for home-based and small-scale online food businesses. Unlike large manufacturers who may have separate production lines for allergen-containing and allergen-free products, most home bakers and small food producers work in shared kitchens where nuts, gluten, dairy, and other allergens are routinely present. FALCPA does not regulate precautionary allergen labelling (PAL) such as "may contain" statements, but this does not mean you can ignore cross-contact risk.
The FDA has issued guidance indicating that precautionary allergen statements should only be used when there is a genuine, identified risk of cross-contact — not as a blanket disclaimer to avoid responsibility. Overuse of "may contain" language, applied to every product regardless of actual risk, is considered misleading under FDA guidance and can undermine consumer trust. Online food businesses should assess cross-contact risk product by product and apply PAL statements only where the risk is real and cannot be adequately controlled through production practices or cleaning procedures.
For online sellers specifically, the cross-contact question also affects how you describe your production environment on your website. Many allergen-conscious customers will read your FAQ or About page looking for information about shared equipment and production facilities. Being transparent about your kitchen setup — whether you use shared equipment, whether you produce allergen-containing and allergen-free products in the same space — is not only honest but legally prudent. Customers who have accurate information before purchasing are in a position to make an informed choice, which reduces both the risk of an adverse event and the potential for a complaint or legal claim.
Keeping Allergen Records as an Online Food Business
Documentation is a part of FALCPA compliance that online-only food businesses frequently overlook. While the regulation itself focuses on labelling, the ability to demonstrate that your labels accurately reflect your ingredients depends on maintaining clear records of what goes into each product. This means keeping records of your ingredient suppliers, the specifications and allergen declarations provided by those suppliers, and any changes to your recipes or formulations over time. If an ingredient supplier changes their product — for example, switching to a facility that now processes peanuts — your allergen declarations may need to be updated accordingly.
For very small online food businesses, record-keeping does not need to be complex. A simple spreadsheet that maps each product to its ingredients, flags the allergen status of each ingredient, and records the date of the last review is sufficient as a starting point. What matters is that the record exists, that it is kept current, and that it is the source of truth for the allergen information that appears on your physical labels and your Shopify product pages. Inconsistency between your records and your published allergen information is the kind of gap that causes problems if a customer has an allergic reaction and questions your labelling.
It is also good practice to keep records of when you last reviewed your product pages for allergen accuracy. Shopify stores can accumulate product listings over time, and a listing created two years ago may not reflect a reformulated recipe or a new ingredient supplier. Building a regular allergen audit into your business calendar — at minimum once a year, and any time a recipe or supplier changes — gives you a defensible position and protects your customers. Allergen Matrix supports this by centralising your allergen data so that updates to your ingredient information flow through to your storefront automatically.
When to Seek Regulatory Advice
Most online food businesses reach a point where their allergen compliance questions exceed what they can confidently answer through FDA guidance documents and self-study alone. This is particularly true at moments of business change — launching a new product line, scaling from home production to a commercial kitchen, entering a new US state market, or beginning to export to the US from the UK or another country. At these points, consulting a food safety professional or regulatory attorney who specialises in FDA food labelling is a worthwhile investment.
The cost of a professional review of your labelling and product pages is modest relative to the potential cost of a compliance failure. FALCPA violations can result in FDA warning letters, mandatory recalls, and significant reputational damage — outcomes that are acutely serious for small online food businesses that depend on customer trust and word-of-mouth. A one-time review by a qualified professional, combined with systematic tools for managing your allergen data, gives you a solid compliance foundation that scales as your business grows.
You do not need to navigate every aspect of FALCPA compliance alone, and you do not need to be a large manufacturer to take it seriously. The tools and professional resources available to online food businesses today make it entirely possible to maintain accurate, compliant allergen labelling across a Shopify store of any size, from a two-product home bakery to a growing meal kit brand with dozens of SKUs.
Try Allergen Matrix free at saltai.app — no credit card required.
SaltAI Team
SaltAI builds focused Shopify apps for food merchants and general merchants. Every app is tested in production at a real food store — including Vanda's Kitchen — before it ships.