Recap of Part 1—The Gray Regulatory Airspace of E-Commerce Food Business

As the rapidly evolving direct-to-consumer food business model continues to expand, the inherent risk to consumer health and safety conversely rises. In October 2021, the U.S. Food and Drug Administration (FDA) hosted the New Era of Smarter Food Safety Summit on E-commerce,1 wherein FDA called on regulators and stakeholders to comment on what, if any, regulations should be imposed on e-commerce food businesses. An impressive turnout of esteemed, tenured food industry experts, consumers, and professional organizations shared their collective and growing concerns around the lack of federal oversight of these operations, especially considering their high-risk nature and complex, undisclosed operations. 

In part 1 of this article series, "The Gray Regulatory Airspace of E-Commerce Food Business2," the critical differences were addressed among the food business models that FDA is lumping into one, in particular calling out the highest-risk model—food businesses that deliver food from a fulfillment center to a customer, such as "meal kits" and certain grocery delivery, typically requiring over 24 hours of transit. This e-commerce model poses the highest risk to consumer health and safety as it has the greatest time window of error for proliferation of microorganisms, introduction of physical and chemical hazards, and food safety failures. The concerns around this e-commerce model are the focus of this article. 

What is the Loophole? 

Since e-commerce food businesses are not regulated as traditional food manufacturers based on the current Code of Federal Regulations (CFR), these models are regulated under the "honor system." Companies self-report to their local authorities and, in most cases, are regulated under their local food code jurisdictions. They are inspected by local regulators trained to evaluate the implications of small-scale restaurants or retail operations, as opposed to full-scale food manufacturing facilities with complex operations, sophisticated equipment, large quantities of temperature-controlled-for-safety (TCS) ingredients, multiple allergens, seafood, and other considerations. 

Food manufacturers, processors, distributors, and importers are required to register with FDA's Reportable Food Registry (RFR) and observe the Food Safety Modernization Act (FSMA). So, one might ask: Why are these e-commerce food businesses not registered with the RFR? Under 21 CFR 1.226(c),3 retail food establishments are defined as establishments that sell food products directly to consumers as their primary function. A retail food establishment's primary function is to sell directly to the consumer if the annual monetary value of sales of food products directly to consumers exceeds the annual monetary value of sales of food production to all other buyers.3 The loophole in the seemingly outdated Federal Register is the "why" and "how" that many concerned professional experts, academics, and consumers are asking the federal government to resolve. The way in which consumers are buying food has changed dramatically, and so must the regulations to ensure public health and safety associated with these foods. 

No Updates from FDA

Since FDA's 2021 meeting highlighting the concerns for consumer safety, the public has not heard what, if any, actions FDA plans to take to properly regulate these food businesses to ensure food safety. FDA's New Era of Smarter Food Safety proclaims assurance of consumer safety from "farm to fork." Under the current enigmatic regulatory model observing the U.S. Food Code designed for restaurants, these companies have the potential to maintain food safety—until the moment the food products are placed on a shipping carrier designed for non-perishable goods, such as mail. 

A second catalyst to fuel this food safety failure train is that these "meal kits" are typically shipped on fleets exempt from the Sanitary Transport Act (STA) such as FedEx, UPS, USPS, DHL, and similar. These non-food carriers are often not temperature controlled, the drivers receive no food safety training, and there are no policies established on co-mingling hazardous cargo that could pose a risk to food safety. Once the food products are placed on the carriers exempt from the STA, the supply chain is no longer maintained, controlled, or appropriately traceable. In the event of a foodborne illness outbreak, it would be difficult, if not impossible, to execute a successful product recovery. 

Federal Enforcement for Registered E-Commerce Food Businesses

While FDA has not made any public announcements or formal press releases on the topic of e-commerce food business regulations, there is documented movement in the food industry. Food safety and regulatory consulting firms are receiving requests from e-commerce food businesses facing enforcement actions with FDA for various violations aligned with FSMA rules and regulations. It is important to note that the firms receiving inquires for enforcement remediation services are from e-commerce food businesses that are registered with the RFR. In some cases, it has been reported that federal regulators are influencing e-commerce food facilities to register to subsequently issue enforcement actions against them. While these companies have been influenced and encouraged to register, there are still technically no legal factors which would require them to do so. 

It has been reported to food safety firms that registered e-commerce food facilities are receiving information gathering visits from a team of regulators that includes FDA, the U.S. Department of Agriculture (USDA), and the local and/or state health department. In the cases that have been reported to consultants remediating enforcement situations for e-commerce food businesses, FDA indicates interest in having jurisdiction over these facilities and, subsequently, enforcement actions are being issued, such as FDA Form 483. These include observations and citations for not developing a food safety plan, not maintaining appropriate temperature control, the observance of improper sanitation, failure to develop environmental monitoring programs, and others. These enforcement actions unofficially suggest that FDA may have plans for these companies to observe FSMA in the near future, despite the lack of communication or relevant updates from FDA since the October 2021 public meeting. 

Inadequate Regulations for Rapidly Growing E-Commerce Food Business

No matter the regulatory landscape, these food business models continue to grow, expand, and innovate in the absence of competent, qualified food scientists with relevant experience and risk management skills appropriate for the nature of the operation and finished products. There have been several mergers and acquisitions of smaller e-commerce food companies with Fortune 500 and other prominent, established food companies—some even expanding into international markets. 

As this complex, unique business sector continues to grow, so do the risks. These companies are not observing appropriate regulations for the nature of their operations, and this is further evidenced by the frequent food safety failures, illness outbreaks, recalls, and customer complaints in recent years. Younger generations typically do not make customer complaints by traditional avenues. These generations resort to the cyber world to express their complaints, leveraging social media platforms such as Reddit, Instagram, Twitter, Facebook, and other niche user forums such as the web forum I Was Poisoned.4 A multitude of viral forum discussions have taken place concerning prominent meal kit companies for injury and illness to consumers. 

E-Commerce Food Business Targets At-Risk Consumer Groups

As this unique business sector grows in an economy with a demand for specialized convenience, it has also begun expanding the target consumer group to at-risk consumers, marketing these meal kits to babies and children, neurodivergent youth, and the elderly. At least nine notable meal kit companies that are not registered with FDA and do not observe the regulations required by FSMA are actively marketing to babies, toddlers, and children.

For baby food facilities registered with the RFR, FDA conducts yearly inspections of the facilities to ensure food safety.5 E-commerce food businesses targeting at-risk consumer groups, ignoring FSMA, or not registering with the RFR pose a grave risk to their health and safety, as these operations may never be visited by an inspector qualified to conduct an appropriate food safety assessment for the nature of the operation. As the old saying goes, "when the cat is away, the mice will play." There are no reasonable controls to ensure food safety to an entire consumer group at risk for foodborne illness, due to the nature of their immune systems and/or development.

These regulations, when applied appropriately, ensure that the likely and severe hazards of not only the ingredients being purchased are controlled, but also that the processing, handling, and distribution of the final finished products are of legal, quality, and safe food. These preventive controls ensure appropriate supplier approval and assured safety to "the fork," not merely to "the unrefrigerated mail truck." 

Recent News 

Since the public meeting in October 2021, there have been four prominent e-commerce food companies with major recalls for Salmonella, undeclared allergens, and illness associated with severe gastrointestinal and abnormal liver function, as well as active consumer illness outbreaks. These companies are self-reporting either because they are, in fact, registered with the RFR or because their illness complaints have reached such a high level that the local and state health departments, as well as personal injury attorneys, have begun reporting these cases to the FDA's relevant consumer complaint coordinator, despite not having a FDA registration number. 

In addition, several illness outbreaks on FDA's Investigations of Foodborne Illness Outbreaks webpage have been unidentified for Listeria, Salmonella, E. coli, and Cyclospora.6 In lieu of a comprehensive database of potential food companies at fault for these illness outbreaks, the possibility for e-commerce food business at the root cause cannot be ruled out. 

Furthermore, FDA has received reports of over 386 adverse illness events with 130 hospitalizations against one prominent e-commerce company shipping frozen food products in the mail.7 Yet, FDA has not required this e-commerce food business or other similar food businesses with the suspect ingredient to recall their products. The dangerous implications are that consumers may have affected ingredients stored in their freezers that could potentially cause harm. This is also the reason the case counts continue to rise despite public mainstream media attention on the adverse consumer event. 

Consumer Education is Paramount to Public Safety

The food industry, concerned professionals, and distressed consumers continue to wait to see if FDA will require e-commerce companies to register with the RFR and observe FSMA. In the current landscape, the only hope for consumers is appropriate education by qualified food safety experts. Consumers must equip themselves with the information they need to make informed, safe food decisions to safeguard not only their health, but the health of their families, as well. 

Under the current regulatory landscape, a lack of federal oversight for e-commerce companies, such as meal kits, are not safe for human consumption. Even the most prominent companies do not have scientifically validated temperature controls to ensure that the cold chain is appropriately maintained, in addition to the food products being outside of a controlled chain of custody for 24 hours to four days or more, in some cases. Recently, a viral tweet of a UPS driver showing temperatures above 120 °F inside of their unrefrigerated or non-air-conditioned truck was shared on major news outlets.8 To properly validate temperature controls, these companies must simulate real-life shipping conditions, including the maximum days in transit and accurate, representative temperatures of the shipping carrier.

Consumer Awareness and Guidance

In general, with no appropriate regulatory oversight of e-commerce food companies, there is an inherent risk to consumers who choose to order these types of products. Since these companies do not observe FSMA, they are not required to monitor their processing and/or packing environments for food pathogens, which would be deadly for at-risk consumer groups. Under current conditions, it would be negligent and high risk for children, elderly, immunosuppressed, or other at-risk consumer groups to consume these products. 

Consumers who are not quite ready to ditch the convenience of their meals delivered right to their doorstep should conduct research, prior to purchasing, on whether the company is observing basic food safety principles.

Know Who You are Buying From

Know exactly who you are buying from. Most e-commerce facilities are not registered with the RFR, but some are. It is important to understand that many companies do not register with the brand name under which they are doing business. If the company is registered with the RFR, then the consumer can research their food safety performance history on FDA's public dashboard.9 If a company refuses to provide this information, consider buying from one that values and protects its customers. 

Ask the Hard Questions

Food companies committed to food safety willingly share their food safety information with customers. Most prominent, established food companies with excellent food safety performance history publicly share their food safety certifications, policies, and related information directly on their websites. 

E-commerce food businesses typically have not been sharing this same level of information publicly. For this reason, prior to subscribing to a "meal kit" service, or another company shipping perishable foods in the mail, it is recommended to call customer service and ask the hard questions. Inquire about the company's general policies for food safety and safe handling. Customer service likely does not have a scientific background, but if the company values its customers, it will respond with this information in a timely manner. Companies that do not know the answers or refuse to provide the answers should be approached with great caution. 

Important food safety questions for consumers to ask include, but are not limited to, the following: 

  • Temperature control 
    1. How does the company ensure temperature control of the food products? 
    2. What is the maximum temperature the box can reach to maintain food safety? 
    3. How has the company validated this method (i.e., if the company informs the consumer the box is insulated, and three ice packs are included, how did the company determine this would be adequate for all potential shipping situations and climates across the US)?
    4. How often does the company challenge its validation or verification studies concerning temperature controls? 
  • Fully cooked and ready-to-eat (RTE) proteins
    1. What are the policies for ensuring safety of proteins such as beef, pork, and chicken? 
    2. How are these proteins shipped? Are they individually packaged or grouped into one bag?
    3. What are the policies on co-mingling fully cooked and RTE products? 
    4. Does the company store large quantities of proteins onsite, and if so, is USDA's Food Safety and Inspection Service (FSIS) aware of their location and operations (i.e., have they ever been visited or inspected by USDA)?
    5. What are the policies on shelf life for proteins? Does the company follow the manufacturer's specification for shelf life and store under the same conditions? 
    6. Does the site packing the "meal kit" boxes have a food safety plan, and does it include safe handling of proteins?
  • Allergen management considerations
    1. Does the company handle multiple allergens onsite? If so, which ones?
    2. Does the company have a written allergen management program? 
    3. How does the company handle last-minute replacements to ensure allergen labeling is updated accurately? 
    4. How does the company communicate mislabeled allergens to consumers with food allergies?
    5. If you have a severe food allergy, inquire and understand the process for communicating allergen labeling issues. If the company does not have an effective process, consider avoiding injury in these inevitable events. 
  • Consumer tips
    1. Know when your food will be delivered to your home and avoid leaving the box outside for an extended period of time.
    2. Always use a food thermometer to measure the temperature of your food items at arrival to your home. Any items over 40 °F should be discarded immediately. Frozen items not frozen solid should be used promptly or discarded. 
    3. Inspect the packaging for evidence of tampering or repacking, and ensure no foreign material or off-odors or liquids inside the box (i.e., leaking meats, which would contaminate other food items).
    4. If the food items smell unusual, have unexplained texture issues, or seem like they have not been kept fresh, do not risk illness, throw out the kit in full, and immediately contact customer service for a replacement and refund. 
  • Report illness associated with consumption of e-commerce foods
    1. Consumers experiencing injury or illness should notify their local health department and FDA immediately. Even if the company is not registered with FDA, it is important to report the illness so that the data is available in the event of a larger outbreak. 
    2. To report suspected food poisoning to the local, county, or state health department, visit the CDC Directory of State and Territorial Health Department Websites.10
    3. To report suspected food poisoning to FDA, call the main emergency number at 1-866-300-4374,11 or phone the Consumer Compliant Coordinator for your state or area.12
    4. To report suspected food poisoning to the USDA, call the USDA Meat and Poultry Hotline at 1-888-674-6854 or report the complaint online.13 
    5. Do not discard the food, as it may be needed for proper investigation of the issue. Do not consume the product. 


In summary, e-commerce food businesses, with a handful of exceptions, currently have no federal oversight. Studies and data have shown that e-commerce food companies do not consistently deliver their food products at food safe temperatures. Until FDA appropriately regulates these companies, there is a significant risk to both consumer health and safety for consumers of food products from e-commerce companies.



  1. U.S. Food and Drug Administration (FDA). "New Era of Smarter Food Safety Summit on E-Commerce: Ensuring the Safety of Foods Ordered Online and Delivered Directly to Consumers." October 19–21, 2021.
  2. Muse, Cori. "The Gray Regulatory Airspace of E-Commerce Food Business." Food Safety Magazine. December 14, 2021.
  3. Code of Federal Regulations. 21 CFR 1.226(c).
  4. I Was Poisoned: The Leading Consumer Food Safety Platform. 2022.
  5. FDA. "Guidance for Industry: Frequently Asked Questions about FDA's Regulation of Infant Formula." March 2006.
  6. FDA, "Investigations of Foodborne Illness Outbreaks." September 30, 2022.
  7. FDA. "Investigation of Adverse Event Reports: French Lentil & Leek Crumbles (June 2022)." September 15, 2022.
  8. Arantani, Lauren. "UPS drivers record temperatures above 100F in trucks without air conditioning." August 3, 2022.
  9. FDA. Office of Regulatory Affairs. "FDA Data Dashboard: FSMA Data Search." 2022.
  10. U.S. Centers for Disease Control (CDC). "State & Territorial Health Department Websites." September 6, 2022.
  11. FDA. "Industry and Consumer Assistance from CFSAN." August 11, 2021.
  12. FDA. "Consumer Complaint Coordinators." May 19, 2020.
  13. USDA. "Report a Problem with Food." March 3, 2019.