In November 2025, Greenpeace published laboratory results on fifty-six garments it had bought earlier that year from one of the world's largest online clothing sellers, across eight countries, and sent to an accredited laboratory in Germany.1 Eighteen of them — thirty-two per cent of the batch — came back over the chemical limits set by REACH, the EU and UK chemicals regulation that governs what may legally be present in goods sold to the public. Three of the eighteen were children's clothing. Seven were water-repellent jackets carrying PFAS, the "forever chemicals," at up to 3,300 times the limit (Greenpeace's own lab data records the highest reading as 3,269 times).1
A separate item carried a separate problem. A children's costume, catalogued as sample FT-27, came back with formaldehyde at three and a half times the limit — and Greenpeace noted that "a very similar costume" had failed the same test in its 2022 round.1
Those numbers are easy to read as a verdict on cheap clothing. They are not. They are the start of a different question, one the test forces and most coverage never finishes: who, in law, was responsible for that garment being safe before it reached a doorstep in Britain?
On the high street, the answer is settled and reassuring. Under the UK's REACH rules, set out by the Health and Safety Executive, somebody always carries the duty. If a UK shop imports goods, the importer holds it. If an overseas supplier has appointed a UK-based representative, that representative holds it. A distributor who sells under its own name takes on a manufacturer's duties.2 The framework is built on a single assumption: that for any item on sale, there is an identifiable operator in the UK whose legal job is to confirm it meets the limits. That assumption is why the everyday shopper's instinct — if it's for sale here, someone checked it — is, on the high street, simply true.
The instinct is correct. It is just being applied to the wrong channel.
The role the channel leaves empty
The clearest description of what goes wrong does not come from a campaign group. It comes from the regulator itself.
In August 2023, the Office for Product Safety and Standards — the body inside the Department for Business and Trade responsible for this exact problem — published a consultation reviewing the UK's product safety regime. Two of its sentences carry the whole matter. The first: "in the case of products sold by third-party sellers, there is often no responsible economic operator in the UK, which makes investigation and corrective action difficult."3 The second, a page later: unsafe listings "appear and re-appear, creating a recurrent risk to public safety."3
Read those together and the gap stops being an accusation and becomes a description. When you buy direct from an overseas third-party seller through a marketplace, the seller is frequently not established in the UK and occupies none of the accountable roles the HSE framework names. There is no importer of record, no appointed UK representative, no own-name distributor. The duty to verify the item meets the chemical limits before it is sold has no one in the country to sit on. And because no one is bound to verify it, a listing that fails can come down and go straight back up — under the same seller or a new one — with nothing to stop it.
This is the place to be precise, because the looser version of this claim is wrong and worth correcting. It is not true that nobody is accountable for a direct-import parcel in any sense. If the item is faulty, the platform's own buyer-guarantee schemes may refund you. If you paid by card, chargeback rules may help you get your money back; and for qualifying credit-card purchases — broadly those between £100 and £30,000 — Section 75 of the Consumer Credit Act 1974 may give you a further route. The Consumer Protection Act 1987 sets up a product-liability chain. Trading Standards and Border Force can seize non-compliant imports. None of that is nothing.
But every one of those routes shares two features. They are financial, and they are after the fact. Chargeback returns your four pounds; it does not stop the next over-limit teething glove reaching the next baby. The Consumer Protection Act's liability chain is notoriously hard to run where no UK-based producer, importer, own-brander, or supplier can be identified to stand at the end of it — and against a dissolved overseas seller with no UK presence, there may be no such party to find. The recourse stack gets you compensation, on conditions; it does not put anyone under a duty to check the item is within the limits before it is listed and sold. That specific duty — the ex-ante one, the one that operates before the parcel ships rather than after it harms — is the one the direct-import channel routinely leaves empty.
What we don't know, and why that is the point
A natural reaction to all this is to ask how common it really is. How many of those parcels are over the limit?
The honest answer is that nobody knows — and the not-knowing is itself part of the gap.
Every dramatic figure in the record comes from a sample chosen because it was suspected. Greenpeace bought garments it had reason to test. The most-quoted UK number — that OPSS found 81 per cent of 2,260 products non-compliant — comes from a programme that ran from October 2021 to September 2022 and deliberately targeted products "more likely to be non-compliant." OPSS says so itself, in the same report: the data "is not representative of all products sold by [online marketplaces] and cannot be used for national estimates."4 A consumer group's finding that none of 27 children's products tested on one platform met the standards, and 26 of 27 on another, comes from a children's-product screen — the highest-risk category, chosen on purpose.5
These are existence proofs, not prevalence rates. They show that over-limit goods are present, reachable, and repeatable on the channel. They do not show that most parcels are dangerous, and this report does not claim it. The true rate across the roughly 1.6 million low-value parcels that enter the UK each day is genuinely unknown.
It is unknown for a reason that points straight back to the gap. On the high street, the accountable operator is the party whose job includes knowing — testing, documenting, standing behind the figure. On the direct-import channel, there is no operator carrying that duty, so there is no one whose job is to measure the rate. The unknown is not a hole in the evidence. It is the shape of the missing role.
Why the cheapest listing is the least-checked one
There is a structural reason the items that fail tend to be the cheap ones, and it is not that cheapness causes danger.
A UK retailer selling the same category of goods carries costs the direct-import seller can avoid. It bears the expense of being — or paying — a responsible operator who tests and documents. It pays customs duty. It funds compliance work the overseas listing externalises.
Of these, only one is cleanly quantified. The UK's £135 "low value import" relief lets individual consignments under that value enter without customs duty — a relief the high street does not get on the goods it imports in bulk. HMRC announced in November 2025 that it would remove the relief by March 2029 "at the latest." It framed the aim in its own words: to "ensure retailers pay customs duty on the goods they sell to UK consumers regardless of how they import them." The point, HMRC said, is to put direct imports on the same footing "just as goods imported in bulk by high street retailers are."6
The other two costs — the operator's testing spend and the responsible-person function — are real but not quantified here, and it would overstate the case to call them a major driver of a four-pound price. A garment's testing cost, spread across a production run of thousands, is small per unit. The dominant reasons direct-import goods are cheap are scale, labour cost, and logistics, not skipped safety checks. The honest claim is narrower and still holds: non-compliance is a price input, not the price input. Each avoided cost is a real cost the high street bears and this channel does not — which is why, at the margin, the least-verified listing and the cheapest listing tend to be the same listing.
The 78 per cent who are right about the wrong thing
Now bring this to the moment of purchase, because that is where it lands on a real person.
In research published February 2026 — with fieldwork conducted in November 2025 — the consumer group Which? reported that 90 per cent of UK adults had bought from an online marketplace in the previous two years, that 24 million were regular users, and that 78 per cent were confident these sites ensure the products they sell are safe — up from 70 per cent in 2023.7 The instinct is not eroding as the evidence mounts. It is strengthening.
It is tempting to read that 78 per cent as carelessness. It is closer to the opposite. The shopper is reasoning correctly — it looks like a shop, shops are accountable — from a premise the interface supplied and then quietly withdrew. Which?'s own guidance spells out what the storefront does not. An online marketplace, it explains, "is a website that connects shoppers with third-party sellers," and "unlike traditional retailers, online marketplaces are not directly responsible for the products sold through their platforms — that responsibility lies with the third-party seller." To know which kind of sale you are making, it says, "you have to click on a product listing and check to see if it's 'sold and shipped by' [the retailer] or a third party."8
That single line — sold by, shipped by, fulfilled by — is the whole difference, and it is the easiest thing on the page to miss. Two listings can sit side by side in the same app, inside the same cart, under the same returns policy, behind the same one-click checkout, wrapped in the same trust furniture of stars and badges. One is sold by a UK retailer who is an accountable operator. The other is sold direct by an overseas third-party seller with no UK party carrying the duty to verify it. Visually, they are the same purchase. Legally, they are opposites. The only signal that tells them apart is a line of grey text most shoppers have never had a reason to decode — because on the high street they never needed to.
The interface, in other words, makes a sale that owes the shopper a safety duty look identical to one that owes her none. The confidence is not misplaced trust in a dangerous thing. It is correct trust attached to the wrong object.
This matters most exactly where a parent's guard is lowest in a particular way — not lowered through inattention, but delegated through reasonable assumption. The documented over-limit findings cluster in children's categories: clothing, costumes, mouth and teething toys. A teething glove sold on one platform, designed to go in a baby's mouth, was found by Which? to carry five times the legal limit of formaldehyde.7 These are the skin-contact and mouth-contact items, the highest-exposure pathways, in the category where the instinct "surely children's goods are the most regulated thing there is" is strongest. The exceedances are limit breaches in targeted samples, not measured injuries in a child — that distinction must hold.
But the limits exist because the harm chains are real. Take the three chemicals one at a time. Formaldehyde is a recognised skin sensitiser, capable of provoking lasting allergic contact dermatitis.9 The phthalates found at 240 times the limit in toys on another platform are classified in the EU as toxic to reproduction and as endocrine disruptors.10 PFAS are persistent and bioaccumulative, linked to immune and developmental effects.11
The law drew those lines for a reason. On this channel the items cross them and reach the doorstep with no operator bound to stop them, and the shopper gets no way to see it happen.
This investigation continues below.
Want the next one in your inbox?
The lever that exists and the lever that has been pulled
None of this means the system is failing to respond. It means the response is unfinished, and the unfinished part can be named exactly.
The UK has built the legal lever for this. The Product Regulation and Metrology Act 2025 received Royal Assent on 21 July 2025, with powers to impose product-safety duties on online marketplaces.12 But it is an enabling Act: those duties do not exist until secondary legislation creates them. As of 15 June 2026 — eleven months after the Act passed — no such regulations have been laid or made. The rules that would switch the duties on are still a consultation document, published on 31 March 2026 and open for comment until 23 June 2026, about a week after this report.12
It would be unfair to call that process a failure. An enabling Act followed by consultation followed by detailed regulations is the ordinary, proper way UK product law is made; rushing duties of this weight without consultation would be the worse fault. The consultation's existence is the system working, not stalling. What is fair to name is narrower: the power has sat available for eleven months with no commencement date attached, and the duties remain proposals rather than rules. The honest tension is duration and the absence of a date, not the presence of process.
That the model can work is not speculation, because next door it already does. The EU operationalised marketplace duties under its General Product Safety Regulation — registration with a safety portal, a single point of contact, removal of dangerous listings on notice.13 And it has enforced them. On 28 May 2026, the European Commission fined one major platform €200 million under the Digital Services Act for failing to "diligently identify, analyse and assess the systemic risks of illegal products" on its platform; the Commission's mystery-shopping found "a very high percentage" of tested chargers failed basic safety tests and baby toys posing medium-to-high risk.14 A working lever, pulled.
Whether it was pulled hard is a separate, fair question. On this report's own arithmetic — not a finding of any regulator — €200 million is roughly 0.4 per cent of that platform's parent company's annual revenue of about US$54 billion (roughly €50 billion), and roughly a sixteenth of the 6 per cent ceiling the Digital Services Act allows.14 The mechanism can bite. Whether it has bitten hard enough to deter is the next argument, not this one.
The contrast shows up clearly the moment an accountable operator does exist. In March 2026, after possible asbestos was identified in play sand, the Irish regulator — the Competition and Consumer Protection Commission — published a safety notice on a high-street toy retailer's dig kits, listing seven named products by code and telling parents how to bag and return the contents.15 That is what a system that can learn looks like: a hazard found, a reachable company to act on, a notice that names the products and the route back. It worked precisely because there was an accountable operator with a refund desk and a name. That is the exact condition the direct-import channel so often lacks — which is why it is the contrast, not a comparison.
The fair case against this report is real and worth stating plainly: the UK is mid-construction on a working model, not sitting on an open wound. The Act has passed, the rules are in active consultation, the customs subsidy is being withdrawn, and the comparator jurisdiction has already built and enforced the same duties. The alarming figures all come from samples their own authors say cannot estimate prevalence. And the shopper is not defenceless — chargeback, platform guarantees, the Consumer Protection Act all give her recourse. On that reading, this is a narrow, closing, temporary gap, not a standing emergency.
That case is sound as far as it goes, and parts of it are precisely why the read here is mixed rather than damning. Three specific findings would narrow or overturn the conclusion. If the marketplace duties under the 2025 Act are laid and brought into force, the "law but not law" tension collapses and "later" becomes "now" — and the right response would be to say so. If a genuinely representative survey were ever run and showed the true over-limit rate on direct-import parcels to be low, the structural gap would remain but its weight would change. And if platforms were shown to have taken on UK accountable-operator duties — appointing representatives or standing as importer of record for their direct-import third-party sellers as a class — the accountability vacuum would be filled and the inversion would weaken. None of those three has happened as of this writing. Each is checkable. Each would change the picture.
What none of the build-out yet touches is the part the shopper actually meets: even after the duties commence, she still will not be able to see, at the moment of purchase, who — if anyone — verified the item in her cart. The lever closes the operator gap. It does not, on its own, close the checkout gap.
What to do on Saturday
Until it does, the durable move is to read the channel, not the price.
The next time you are buying something a child will wear, mouth, or handle — clothing, a costume, a teething or bath toy — find the line on the listing that says who it is sold and shipped by before you add it to the basket. It is usually small and easy to skip. For these skin-contact and mouth-contact items, prefer a listing where the seller of record is a named UK retailer — a company with a UK address, a returns desk, and a legal duty behind the goods — rather than an overseas third-party seller you have never heard of. That one line tells you which kind of purchase you are making, and it is the single most reliable signal the interface gives you.
If you want the safety duty to be unambiguous, a few routes are worth knowing. Buying the same category from a mainstream UK high-street retailer's own stock — a supermarket, a chemist, an established toy shop — puts an accountable operator squarely behind the item. On a marketplace, choosing a listing "sold and shipped by" that platform's own UK retail arm, rather than a third party, does the same. And specialist UK and EU sellers who publish their testing and conformity documentation let you check the verification rather than assume it. The point is not the brand. The point is that someone in the UK is on the hook before the parcel ships, and you can see who.
The price tells you what you will pay. It does not tell you who checked. Those have always been two different questions. On the high street they happened to share one answer. On the channel that now delivers 1.6 million parcels a day, they don't — and for now, finding the second answer is on you.