Beauty and supplement brands do not share a single compliance checklist for their 3PL. What a fulfillment partner needs to support depends on the product, the data that moves with each order and the customers the brand sells to, not on whether the brand calls itself beauty, wellness or nutrition. Lot and expiration tracking with first-expired, first-out (FEFO) picking is the closest thing to a universal requirement, because nearly every supplement, OTC product and active skincare line needs it to manage shelf life and respond to recalls. Item-level serialization matters mainly for premium and luxury brands fighting diversion and counterfeits, or when a retail partner requires it.
HIPAA applies only when protected health information flows through the fulfillment workflow, which ordinary DTC beauty and supplement orders generally do not create. SOC 2 is not a law at all; it is an audit report that enterprise buyers use to judge a vendor’s security controls. Fragrance and aerosols add a separate layer of hazardous materials shipping rules. Brands that map their requirements this way avoid paying for compliance they do not need and avoid choosing a 3PL that cannot support the ones they do.
It is tempting to treat “health and beauty” as one regulated category with one set of rules. In practice, the rules attach to specific products, specific activities and specific data. Two brands selling into the same aisle can have very different requirements for their warehouse partner.
Federal cosmetics and supplement rules show how much the activity matters. Under the Modernization of Cosmetics Regulation Act (MoCRA), FDA now requires cosmetic manufacturers and processors to register facilities and requires the responsible person to list each product. As of June 30, 2026, FDA reported 16,398 active facility registrations and 1,298,361 active product listings. FDA’s guidance also states that an establishment that solely labels, packages, holds or distributes cosmetic products falls outside the facility definition, so a 3PL that only stores and ships finished cosmetics is generally not the registrant. Dietary supplements work differently. FDA’s current good manufacturing practice rule at 21 CFR Part 111 applies to anyone who manufactures, packages, labels or holds a dietary supplement, and it includes specific subparts on holding, distributing and handling returned product. The same warehouse can therefore carry different obligations for a moisturizer and a multivitamin stored in neighboring aisles.
Customers and data add further layers. A retailer’s routing guide, an enterprise buyer’s security questionnaire or a telehealth program’s patient data can each introduce a requirement the product category alone would never trigger. That is why the useful question is not “is this 3PL compliant for health and beauty?” but “which requirements does my product, data flow and customer mix create, and can this partner support them?”
The table below summarizes how often each requirement typically applies across ten health, wellness and beauty subsectors. “Usually” means most brands in the subsector need it, “Sometimes” means it depends on the brand’s model, channel or customers, and “Rarely” means it generally does not apply. Individual brands can and do fall outside these patterns.
| Subsector | Lot / expiry | Serialization | HIPAA | SOC 2 | Typical trigger or exception |
|---|---|---|---|---|---|
| Skincare | Usually | Sometimes | Rarely | Sometimes | Premium anti-diversion; prescription workflows are exceptions |
| Color cosmetics | Sometimes | Sometimes | Rarely | Sometimes | Luxury authenticity programs; retailer GS1 requirements |
| Haircare | Usually | Rarely | Rarely | Sometimes | Lot and expiry far more common than unit serial numbers |
| Fragrance | Sometimes | Sometimes | Rarely | Sometimes | Counterfeit and diversion risk; hazmat shipping is a separate issue |
| Oral care | Usually | Sometimes | Sometimes | Sometimes | Smart devices or provider-linked care create exceptions |
| Vitamins and minerals | Usually | Rarely | Sometimes | Sometimes | Lot and expiry standard; PHI only in personalized care models |
| Sports nutrition | Usually | Rarely | Sometimes | Sometimes | Provider or personalized programs are the exceptions |
| Botanicals and specialty supplements | Usually | Rarely | Sometimes | Sometimes | Ordinary DTC needs lot, expiry and FEFO |
| Functional foods and beverages | Usually | Rarely | Sometimes | Sometimes | Clinical nutrition models can create PHI |
| OTC medicines | Usually | Rarely | Sometimes | Sometimes | Ordinary OTC retail is not DSCSA drug serialization |
Read across the columns and a clear pattern appears. Lot and expiration control is the baseline for almost every subsector. Serialization, HIPAA and SOC 2 are conditional: each one is switched on by a specific product, channel or customer, not by the category label.
How often lot tracking, serialization, HIPAA and SOC 2 apply across 10 health, wellness and beauty subsectors
Lot tracking means recording the manufacturer’s lot or batch number for every unit a warehouse receives, keeping that lot identity attached to inventory while it is stored, and recording which lot shipped in each outbound order. Expiration tracking adds the expiry or best-by date to the same record. Together they let a brand answer the two questions that matter most during a quality event: which units are affected, and where did they go.
FEFO, or first-expired, first-out, is the picking rule that puts this data to work. Instead of shipping the oldest receipts first, the warehouse system allocates the units with the nearest expiration date first, while blocking units that fall inside the brand’s minimum remaining shelf-life threshold. For supplements, OTC products and active skincare, FEFO is what keeps short-dated product from reaching customers and what keeps write-offs from piling up in the back of the building.
Recalls are where lot discipline pays for itself. MoCRA gave FDA mandatory recall authority over cosmetics when a responsible person declines to recall a product that poses a reasonable probability of serious harm. A brand with clean lot-to-order records can scope a recall or quality hold to specific lots and specific customers. A brand without them often ends up pulling every unit of a SKU and notifying every customer who ever bought it.
FEFO stands for first-expired, first-out. It is a picking rule in which the warehouse system automatically ships the units with the nearest expiration date first, rather than the units that arrived first. It depends on capturing lot and expiration data at receiving, and it usually includes a minimum shelf-life rule so units too close to expiry are held back instead of shipped.
Serialization assigns each individual unit its own serial number, paired with the product’s GTIN, so the brand can identify one specific bottle or compact rather than a batch of thousands. In the warehouse, serialized units are scanned at receiving, picking and packing, creating a record of exactly which unit shipped to which order. That record is what makes serialization valuable for anti-diversion programs, authenticity verification and warranty or registration workflows.
The main drivers in beauty are counterfeiting and diversion. The OECD and EUIPO estimate that trade in counterfeit goods reached USD 467 billion in 2021, about 2.3% of global imports, and their report identifies cosmetics among the categories most exposed. Premium skincare, color cosmetics and fragrance brands use serialized units to trace product that leaks into unauthorized channels and to give retailers and consumers a way to verify that a unit is genuine.
GS1 2D barcodes are the data carrier that makes this practical. The GS1 guideline for 2D barcodes at retail point of sale lists batch or lot number, expiration date and serial number among the common data elements a GS1 DataMatrix or QR code with GS1 Digital Link can carry alongside the GTIN. The U.S. industry’s Sunrise 2027 initiative is moving retail toward scanning these 2D codes at checkout, which will make lot, expiry and serial data easier to capture across the supply chain. A 2D barcode on the package does not by itself mean a brand is serializing, though; that depends on whether each unit carries a unique serial number and whether every handoff scans it.
No. The Drug Supply Chain Security Act covers certain prescription drugs, not ordinary over-the-counter medicines sold through retail and DTC channels. OTC brands still need lot and expiration control, and some choose item-level serial codes for brand protection, but that is a business decision rather than a DSCSA obligation.
FDA describes the Drug Supply Chain Security Act as a system to identify and trace certain prescription drugs at the package level. Pharmaceutical serialization under DSCSA brings its own trading-partner, verification and data-exchange requirements, which is a different operating model from the consumer brand-protection serialization most beauty and wellness brands consider.
HIPAA is often raised in supplement and wellness 3PL conversations, but it applies far less often than people assume. The law governs covered entities, which are health plans, health care clearinghouses and health care providers that conduct certain electronic transactions, and the business associates that create, receive, maintain or transmit protected health information on their behalf. A covered entity must have a business associate agreement in place before sharing that information with a vendor.
An ordinary DTC order for vitamins, protein powder or skincare generally does not make the brand a covered entity or turn the shipping data into protected health information under HIPAA. The picture changes when a provider, health plan or clinical program sits in the workflow. Practitioner-dispensed supplements, clinical nutrition programs, telehealth skincare tied to prescriptions and connected oral care devices linked to dental providers can all route patient-linked information through fulfillment. In those cases the brand, its provider partners and its 3PL need to map exactly where that information flows and whether a business associate agreement is required. State consumer health privacy laws can add obligations even where HIPAA does not apply, which is another reason to involve counsel early.
SOC 2 is an attestation report, not a regulation. Under the AICPA’s framework, an independent CPA firm examines a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy. A Type 1 report evaluates the design of controls at a point in time, while a Type 2 report tests whether those controls operated effectively over an observation period.
No product category requires SOC 2. Buyers request it because their own vendor risk programs do, and that pressure is rising. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30%. Public companies, enterprise brands and large retailers that connect their systems to a 3PL’s order and inventory platforms are the most likely to ask for a SOC 2 report or a detailed security questionnaire. For many $30M to $300M brands, the more practical question is whether a 3PL can document its access controls, system integrations and incident response clearly enough to pass the brand’s own review.
Fragrance is the one beauty subsector where shipping rules, rather than tracking rules, usually create the biggest operational gap. The FAA’s flammable liquid fact sheet lists perfumes and fragrances among common flammable liquids, defined by a flash point of not more than 60°C (140°F), and notes that shippers of perfumery products must comply with the Hazardous Materials Regulations. Limited quantity and consumer commodity exceptions can simplify ground shipping for small consumer packages, but the FAA warns never to assume a ground exception applies to air transport.
For a 3PL, that means trained staff, correct classification of each SKU, compliant packaging and marking, carrier service selection that matches the classification, and storage that respects quantity limits for flammable products. Aerosols such as dry shampoo, setting spray and spray sunscreen raise the same questions. These capabilities are facility-specific at most providers, so brands should confirm them at the exact site that will hold their inventory.
Start with lot and expiration control, because it applies to almost everyone. Ask the 3PL to show, in its warehouse management system, how lot and expiration data is captured at receiving, how FEFO allocation works at pick, how minimum shelf-life rules are set by customer or channel, and how quickly it can produce a list of every order that received a given lot. Ask how kits, gift-with-purchase programs and subscription bundles keep lot identity for each component, since that is where traceability most often breaks down.
Then work through the conditional requirements that apply to your business. If you sell premium or luxury product, ask whether the provider can scan and record unit-level serial numbers today, at which sites and with what integration to your brand protection tools, and get the answer in writing. If a provider, health plan or clinical program touches your orders, ask how the 3PL handles patient-linked data and whether it will sign a business associate agreement. If enterprise or retail customers review your vendors, ask for the 3PL’s current SOC 2 report or its security documentation and system boundary. If you sell fragrance or aerosols, ask which specific facilities handle hazmat shipments and what certifications their staff hold. Finally, ask about returns: how returned units are inspected, quarantined and dispositioned, and how that is reported back to you.
These are general explanations, not legal advice, and brands should confirm their specific requirements with regulatory counsel.
Cart.com focuses on the requirements most health, wellness and beauty brands actually share. Its fulfillment operations support lot and expiration date capture at receiving, FEFO allocation and lot traceability from receipt to outbound order, along with kitting for bundles, samples, gift-with-purchase programs and subscriptions. Cart.com supports DTC and marketplace fulfillment alongside retail-ready programs, including EDI, GS1 and UCC-128 labeling and routing guide compliance, and its returns process includes inspection, quarantine and disposition. Hazmat handling for fragrance and aerosols is available at select facilities. For requirements such as unit-level serialization, HIPAA business associate workflows or a SOC 2 report, brands should ask Cart.com, like any 3PL, exactly what is supported today and at which sites.
Most supplement brands need a 3PL that captures lot and expiration data at receiving, ships by FEFO, traces every lot to outbound orders and quarantines returns. FDA’s dietary supplement cGMP rule at 21 CFR Part 111 applies to firms that hold supplements, so storage and handling practices matter. HIPAA and SOC 2 apply only in specific situations.
Generally not for storage and shipping alone. Under MoCRA, manufacturers and processors register cosmetic facilities, and FDA guidance excludes establishments that solely hold, distribute, label or package cosmetics. The brand, as the responsible person, lists its products. A 3PL that fills product containers or performs manufacturing steps may have different obligations.
Only when protected health information flows through fulfillment, such as practitioner-dispensed programs, clinical nutrition models or provider-linked telehealth. An ordinary DTC supplement order generally does not involve a HIPAA covered entity. Brands with provider or health plan partners should map their data flows and confirm requirements with counsel.
No law requires SOC 2. It is an independent audit report on a service organization’s controls, and enterprise brands, public companies and large retailers often request it as part of vendor risk reviews. Brands should ask whether their own customers or security teams require it before making it a selection criterion.
Lot tracking identifies a batch of units made together and records which lot went to which order. Serialization gives every individual unit a unique serial number and records each unit’s movement. Most beauty and supplement brands need lot tracking; serialization is mainly for anti-diversion, authenticity and specific retailer programs.
Many perfumes and fragrances are classified as flammable liquids because of their alcohol content, which means hazardous materials rules apply to shipping. Limited quantity exceptions can simplify ground shipments of small consumer packages, but air shipping rules are stricter. Brands should confirm hazmat capability at the specific facility that will hold their fragrance inventory.
Lot Tracking vs. Serialization: What Beauty Brands Need to Know
Supplement Fulfillment: What Health and Wellness Brands Need from a 3PL
Best 3PLs for Beauty and Cosmetics Fulfillment
The right 3PL for a health, wellness or beauty brand is the one that supports the requirements your products, data and customers actually create. Cart.com combines lot and expiration control, FEFO, kitting and retail-ready fulfillment across DTC, marketplace and wholesale channels. Explore how Cart.com supports health and wellness brands and beauty and cosmetics brands, or talk to our team about mapping your requirements to the right fulfillment program.