Multi-State Product Compliance: A Practical Framework for US Importers

You've got one product. It needs to comply with federal law, California's rules, Maine's rules, Washington's rules, and a dozen other state-specific requirements that nobody seems to agree on. Welcome to multi-state compliance.

Here's a fun scenario. You import nonstick cookware. At the federal level, your product needs to meet FDA food-contact requirements. Fine. But then California wants Prop 65 disclosures. Maine has banned intentionally added PFAS in cookware starting in 2030. Minnesota has its own PFAS disclosure requirements with different timelines. Washington requires PFAS reporting for certain product categories. New York is working on its own version. And Vermont just passed something you haven't read yet.

Same product. Same factory. Same SKU. But the compliance requirements change depending on which state your customer lives in. If you're selling e-commerce nationally — which most importers are — you're selling into all of them simultaneously.

This isn't a new problem, but it's getting exponentially worse. Every legislative session brings new state-level product regulations, and they're rarely aligned with each other. If you don't have a framework for managing this, you're going to miss something. Let's build one.

The problem: a patchwork with no coordination

The US regulatory system for product compliance is, by design, decentralized. Federal agencies like the CPSC, FDA, and EPA set baseline requirements. But states have broad authority to go further — and they do, aggressively.

Some examples of the patchwork in action:

PFAS restrictions. As of mid-2026, at least 15 states have enacted PFAS-related legislation. But the definitions vary. Maine's law covers "all products" with intentionally added PFAS (phasing in by category through 2030). California's AB 1817 targets textiles. Minnesota requires reporting. Washington focuses on specific product categories. Each has different effective dates, different exemptions, and different enforcement mechanisms.

Prop 65 (California). This is probably the most well-known state-level product regulation, and it effectively applies to anyone selling into California — which is everyone selling online in the US. The safe harbor levels, warning formats, and listed chemicals are unique to California. No other state has an equivalent (though some are trying).

Packaging regulations. States like Maine, Oregon, Colorado, and California have Extended Producer Responsibility (EPR) laws for packaging. Requirements for producer registration, fee payments, recycled content minimums, and labeling vary by state. If you import a product with packaging (which is all of them), you may have obligations you don't even know about.

Children's product safety. While CPSIA is federal, some states have additional requirements. Washington's Children's Safe Product Act requires reporting on certain chemicals in children's products. Vermont has its own toy safety provisions. These layer on top of CPSIA's CPC requirements.

The result: an importer selling a single product nationally might need to track compliance against 5-20 different regulatory frameworks simultaneously. And that number only goes up with each product in your catalog.

The framework: five steps to multi-state compliance

After working with importers managing products across multiple regulatory jurisdictions, here's the framework that actually works. It's not glamorous, but it's systematic — and systematic beats scrambling every time.

Step 1: Identify all applicable regulations

Start by mapping every regulation that applies to each product you sell. This means:

• Federal requirements: CPSIA, FDA food-contact regulations, EPA chemical requirements, FSVP (for food imports), FCC (for electronics), etc.
• State-level requirements: Prop 65 (CA), PFAS laws (ME, MN, WA, CA, NY, etc.), packaging EPR (ME, OR, CO, CA), children's product reporting (WA), and any category-specific state laws
• Retailer requirements: Amazon, Walmart, Target, and others often have their own compliance requirements that layer on top of legal obligations

This is the step most importers skip or do incompletely. You can't comply with regulations you don't know about. And "I didn't know about Maine's PFAS law" won't help when the AG comes calling.

Step 2: Test against the strictest standard

Here's the efficiency hack that saves importers thousands in testing costs: identify the strictest applicable standard and test against that first. If you meet the strictest requirement, you'll typically meet all the less strict ones automatically.

In practice, this usually means starting with California or Maine:

• California tends to have the lowest thresholds for chemical warnings (Prop 65 safe harbors) and the most aggressive enforcement
• Maine has the broadest PFAS prohibition (all products, not just specific categories)
• Washington has detailed children's product chemical reporting requirements

If your nonstick pan meets Maine's PFAS-free requirement, it automatically satisfies Minnesota's PFAS disclosure requirement (there's nothing to disclose). If your product's lead content is below California's Prop 65 safe harbor level, you'll clear CPSIA's lead limits easily. Test smart, not exhaustively.

Step 3: Document everything by jurisdiction

Once you've tested, organize your documentation by both product and jurisdiction. For each product, you should be able to answer: "What are the requirements in State X, and do we have documentation proving compliance?"

This is where spreadsheets start to break. When you've got 50 products across 15 regulatory jurisdictions, that's 750 compliance data points to track. Each with different effective dates, different documentation requirements, and different renewal cycles. A spreadsheet can hold this data, but it can't alert you when something changes or expires.

Step 4: Monitor for regulatory changes

State-level product regulation is the fastest-moving area of US compliance law right now. New PFAS laws are being proposed in multiple states every legislative session. Packaging EPR is expanding rapidly. Prop 65 adds new chemicals to its list regularly. If you mapped your regulatory landscape in January, it may look different by June.

You need a monitoring process. That could be:

• Subscribing to regulatory update services (or using a platform like Aleph that monitors this for you)
• Setting quarterly reviews to check for new state-level regulations affecting your product categories
• Working with a compliance consultant who tracks multi-state developments

The key is making this proactive, not reactive. Finding out about a new regulation from a retailer compliance audit or a customer complaint is too late.

Step 5: Re-test and recertify on schedule

Testing isn't a one-time event. CPSIA requires periodic testing for children's products. Prop 65 safe harbor levels can change. PFAS testing methods evolve. And if you change suppliers, materials, or manufacturing processes, previous test results may no longer be valid.

Build a re-testing schedule that accounts for:

• Regulatory requirements for periodic testing (CPSIA)
• Material or supplier changes that invalidate existing test data
• New regulations that require testing you haven't done before
• Test report expiry (some retailers and marketplaces require test reports less than 1-2 years old)

How to prioritize when everything feels urgent

If you're reading this and thinking "we're behind on all of this," don't panic. Here's how to prioritize:

Start with California. If you sell to any California consumer (and if you sell online, you do), Prop 65 is your highest-risk exposure. Private enforcement lawsuits are expensive, common, and require no government involvement — any individual can file one. Get your Prop 65 assessment done first.

Then federal requirements. CPSC and FDA enforcement is increasing. If you import children's products without a valid CPC, or food without FSVP documentation, you're at risk of import holds and recalls. Federal enforcement tends to be more consequential than state enforcement.

Then the expanding state requirements. PFAS is the big one. If your products use coatings, treatments, stain-resistance, water-resistance, or non-stick properties, you need to map your PFAS exposure across states. Maine's 2030 deadline sounds far away until you realize you need to reformulate products, re-test, and update documentation — that takes years, not months.

Then retailer requirements. Amazon, Walmart, Target, and other major retailers increasingly require compliance documentation beyond what the law mandates. If you sell through these channels, their requirements are effectively mandatory.

How Aleph handles multi-state compliance

This framework works on paper, but executing it manually across a product catalog of any meaningful size is a full-time job. That's specifically what we designed Aleph's regulation mapping engine to solve:

• Product-to-regulation mapping: Tell Aleph what you sell and where you sell it. The platform maps each product to applicable federal and state regulations automatically, so you see the full compliance picture in one view.
• Strictest-standard-first testing guidance: Aleph identifies the most restrictive applicable standard for each requirement, so you can test efficiently without redundant lab work.
• Jurisdiction-level compliance tracking: See at a glance which products are compliant in which states, where you have documentation gaps, and what's coming due.
• Regulatory change monitoring: When new state regulations are enacted or existing ones are amended, Aleph maps them to your product catalog and flags affected products.

Multi-state compliance isn't going to get simpler. The trend is clearly toward more state-level regulation, more chemical restrictions, more disclosure requirements, and more enforcement. The importers who build systematic compliance programs now will spend less time and money on compliance over the long run than the ones who keep treating each new regulation as a fire to put out.