Prop 65, GTINs, Amazon, and Cookie Consent — The Compliance Checklist for Supplement Brands

Compliance isn't glamorous, but the consequences of ignoring it are concrete and expensive. These are the four areas that consistently catch supplement and food brands off guard — not because they're obscure, but because nobody mentions them until after something goes wrong.

Proposition 65

California's Proposition 65 requires businesses to warn consumers before exposing them to chemicals on the state's list of known carcinogens or reproductive toxins. The law applies to any company selling products in California, regardless of where the company is located.

For supplement brands, the most commonly triggered ingredients are:

• Plant-based protein powders (pea, rice, hemp) — naturally contain lead and cadmium from soil
• Cocoa and chocolate-flavored products — natural heavy metal content
• Green powders and botanical blends — heavy metals from plant material
• Fish oil and marine-sourced products — lead content

Prop 65 makes no distinction between naturally occurring heavy metals and contamination. Your pea protein contains lead because peas grew in soil that contains lead. The law treats that identically to intentional contamination.

The exemption most brands don't know about: Companies with fewer than 10 employees are generally exempt from Prop 65. However — if you sell through Amazon or TikTok Shop, you are not the seller of record. Amazon is the seller. TikTok is the seller. They each have more than 10 employees. The exemption does not apply to you, even if you're a one-person brand.

The fix is straightforward and cheap: test your product at a lab that handles Prop 65 screening, and add a Prop 65 warning to your label if the results warrant it. The warning is not an admission of wrongdoing — it's a disclosure. And it is essentially a complete defense against the shakedown demand letters that law firms send to brands without the warning.

GTINs and UPCs

A GTIN (Global Trade Item Number) is a globally unique identifier for your product. A UPC is the 12-digit North American format that appears as a barcode. You need one per SKU per size — three flavors in two sizes means six GTINs.

Buy your GTINs from GS1 directly at gs1us.org. Do not buy from resellers on eBay, Craigslist, or third-party websites. Reseller UPCs are sometimes recycled GS1 numbers that trace back to another brand or product. Major retailers verify UPC ownership against the GS1 database, and if your UPC traces to someone else, they will reject your product at receiving.

Buy 100 GTINs, not 2. The cost difference from GS1 between a 10-pack and a 100-pack of GTINs is modest. The cost of running out of GTINs when you need to add a SKU for a new retailer is not. Brands consistently underestimate how quickly they need new GTINs as their product line grows.

Amazon supplement requirements

Amazon has specific requirements for supplement listings that go beyond what's required for standard product listings:

FDA facility registration. Your co-packing facility must be FDA registered for your supplement listing to be approved. Ask your co-packer for their FDA registration number before you list. A registered co-packer can provide this immediately.

Label claim compliance. Amazon's supplement content guidelines are stricter than FDA requirements in some areas. Claims that use the words "cures," "treats," or "prevents" will get your listing suppressed, as will some structure/function claims that are technically permissible under FDA rules but violate Amazon's policy. Review your label against Amazon's supplement content guidelines before you list — not after you get a suppression notice.

Testing documentation. Amazon increasingly requires third-party testing documentation for supplement products, either at the time of listing or in response to a compliance inquiry. Have your Certificates of Analysis organized and accessible. Some categories require them upfront; others request them reactively.

Cookie consent and California subscription law

If your website uses any tracking technology — Google Analytics, Meta Pixel, email marketing integrations, any advertising pixel — you are subject to privacy laws in multiple states that require visitor consent before tracking begins. This is not theoretical. Law firms actively scan websites for missing consent banners, establish standing by making a small purchase, and send demand letters.

The fix is free: add a cookie consent banner using any of several free tools (Cookiebot, CookieYes, and similar services all have free tiers). It takes an hour to implement. Don't skip this.

If you sell subscriptions — recurring orders, subscribe-and-save, any automatic renewal — California's Automatic Renewal Law (ARL) has specific requirements: auto-renewal terms must be disclosed clearly in the purchase flow (not buried in terms of service), you must provide an immediate cancellation mechanism (a button or link, not "email us"), and enrollment confirmation must include the cancellation mechanism.

One specific platform issue: full checkout customization on Shopify, including the ability to control subscription checkout behavior, requires Shopify Plus at approximately $2,000 per month. Standard Shopify plans don't give you that level of control. If you're selling subscriptions on a standard Shopify plan, your checkout flow may be technically non-compliant even if you want it to be compliant. Review your checkout with counsel if you have California subscribers.

Product liability insurance

This one isn't typically listed under "compliance," but it belongs here: get product liability insurance before your first sale. Most retailers and distributors require a certificate of insurance before they'll carry your product. Your co-packer's insurance covers their facility — not your product once it's in the market. A policy for a small supplement brand typically runs $1,500–$3,000 per year for $1,000,000 per occurrence coverage. Work with a broker who has experience in food and supplement brands — they understand your exposure in ways a general business insurance broker doesn't.