Who writes this. MapToSite sells the page and the printed kit described at the end, so read the price section knowing that. Nothing here is a substitute for the label the shop is legally responsible for: the allergen facts come from the FDA, the UK's Food Standards Agency and GOV.UK, and every rule is cited with a date at the bottom. Where the law depends on where you sell — the US, the UK, the EU — the three are kept separate instead of blended into one confident paragraph. The label wording on our templates is a starting point; the shop knows what went into the batch.
Three lists, three clocks
Most bakery websites fail in the same way: they put everything on one page as if it all changed at the same speed. It does not.
| List | How often it changes | Where it belongs | Why |
|---|---|---|---|
| The label — name of the food, ingredients, allergens | When the recipe changes | On the package | The law requires it to be on the package or on a label attached to it, visible without opening anything. |
| Today — bake times, what is out, what has sold out | Hourly | Behind the code | A printed board cannot keep up; a page can be edited from the counter in under a minute. |
| The order — whole cakes, sizes, inscription, collection | Per customer | Behind the code | It is made after the customer asks, so it is not a prepacked item and cannot be labelled in advance. |
The mistake is treating the third row like the first: printing a "whole cakes from $38" card with no way to say what is available this week, or putting the allergen list only on the website because it is easier to edit there. The label is the one place where "easier to edit" is the wrong criterion. It has to be on the package, and it has to be right at the moment the customer picks it up.
What the law actually puts on the package
Two systems matter for most bakeries selling in English: the US federal rule, and the UK's rules flowing from the EU Food Information Regulation. They are not the same, and a shop that copies wording from one into the other can be wrong in both.
United States — nine major allergens
The Food Allergen Labeling and Consumer Protection Act of 2004 (FALCPA) made it misbranding to sell a packaged food without declaring each major food allergen by the name of its food source. The FASTER Act of 2021 added sesame as the ninth, effective 1 January 2023. The nine are milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame.
Three details decide whether a bakery's label is right:
- The source name has to appear in the ingredient list — "flour (wheat)", "lecithin (soy)" — or in a "Contains" statement printed immediately after or adjacent to the ingredient list. If a "Contains" statement is used, it must list the source of all major allergens present, even the ones already named in the ingredients.
- The specific nut, fish or shellfish must be named. "Tree nuts" is not enough; "almonds" is. The same for the species of fish and crustacean shellfish.
- The rule reaches retail and food-service establishments that package, label and offer food for sale — with one important exception: food placed in a wrapper or container in response to a customer's order is outside the labelling requirement. A slice of cake boxed when the customer asks is not the same as a sandwich made up in the morning and put in the chiller with a label.
United Kingdom — prepacked for direct sale, and the loose counter
Since 1 October 2021 ("Natasha's Law"), food prepacked for direct sale — packed before the customer orders it, on the same premises or site — must carry the name of the food and a full ingredients list with the 14 allergens emphasised within it (bold, capitals, colour or underline). GOV.UK's guidance for bakers names cakes, bread, sausage rolls and sandwiches packed on the premises as the typical cases, and says plainly that packaging a loaf in a bag that is folded or twisted closed counts, while a cake on an open tray or a baguette in an open sleeve does not.
Food that is not prepacked — a loose loaf, a pastry from a tray, a slice packed at the customer's request — does not need a label, but the 14 allergens still have to be available. The FSA allows that orally if there is clear signposting telling the customer to ask, and recommends written information supported by a conversation. Selling at a distance has its own rule: the information must be available before the order and again at delivery.
| US | UK | |
|---|---|---|
| Which allergens | 9: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, sesame | 14: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, peanuts, sesame, soybeans, sulphites over 10 ppm, tree nuts |
| Packaged and labelled by the shop | Must declare in the ingredient list or a Contains statement | Must have name plus full ingredients with allergens emphasised on the package |
| Wrapped when the customer orders | Outside the labelling requirement | No label required; 14 allergens must still be available (written, or oral with clear signposting) |
| Loose from a tray | No label; information must still be correct when asked | No label; information must be available |
One consequence is worth stating plainly: the same shop can need two different labels for two different counters. The boxed cake in the chiller needs the full UK-style list if the shop is in the UK; the slice cut and boxed at the counter does not need a label at all, but still needs an answer. That is not bureaucracy for its own sake — it tracks which items a customer can pick up and inspect without asking anyone.
The QR code is not a label — and where it is genuinely useful
This is the part most "QR menu" advice gets wrong, so it is worth being blunt. In the UK, the requirement for prepacked-for-direct-sale food is that the information be on the package or on a label attached to the package. Local authority guidance answering whether ingredients can be listed by QR code answers "No. A QR code will not suffice" — the label needs the name and the full ingredients list. In the US, the declaration has to be on the label too; a code is not one of the permitted methods.
So a bakery must not replace a label with a code. But three jobs genuinely belong behind a code, and none of them is the label:
- The full matrix. Forty items, fourteen allergens, one table. A label covers one product; the matrix answers "which of your pastries have no sesame" across the whole counter, and staff can answer in ten seconds instead of walking to a folder. For non-prepacked food, written information is the FSA's best practice, and a page is the version that stays current.
- Today. Bake times, what is out of the oven, what has sold out. A printed board is wrong by eleven o'clock.
- The order that does not exist yet. Whole cakes, tiered cakes, inscriptions, collection slots, deposits — a conversation the label cannot have.
The rule to keep in your head. If a customer could pick the item up, pay for it and walk out without speaking to anyone, it needs its label. If it exists only after they ask, the code and the page are the right place. When in doubt, treat it as prepacked and label it — the cost of a label is a sticker; the cost of a wrong allergy answer is not.
One more condition on digital information, from the FSA's best-practice guidance: if a shop provides allergen information digitally, it should have an alternative way to access it for people who cannot use the digital version. In practice that means the matrix is also printed behind the counter and a staff member can read it aloud. A code on a bag with nothing behind the counter is a single point of failure.
"May contain", "gluten-free", and the claims that create liability
Three phrases cause most of the trouble in small bakeries, and all three are settled in the guidance rather than left to taste.
| What the shop wants to say | What the rule says | What to do instead |
|---|---|---|
| "May contain traces of nuts" | In the US, allergen advisory statements (including "may contain") are not addressed by the labelling section of the law; FDA's 2025 Q&A says such a statement is not a substitute for good manufacturing practices or allergen preventive controls and must be truthful and not misleading. UK guidance says precautionary labelling should only follow a risk assessment that identifies a real risk. | Decide which items can be made away from nuts, sesame or gluten, and say that. Use "may contain" only where cross-contact is genuinely possible, and never alongside a "Contains" statement for the same allergen. |
| "Nut-free kitchen" | There is no defined condition for an allergen-free claim; FDA expects that a "milk-free" or similar claim means no allergen, including unintended presence from cross-contact, and a product should not carry both "may contain milk" and "milk-free". | Say what is true and checkable: "made without nuts; the kitchen also handles sesame and almonds." A specific sentence beats a broad claim. |
| "Gluten-free" | US: 21 CFR 101.91 defines it as no gluten-containing grain, no unprocessed gluten-derived ingredient, and unavoidable gluten below 20 ppm; a food labelled gluten-free cannot intentionally contain wheat, rye or barley. | Only claim it with separated ingredients, a clean bench and a record. Otherwise say "made without wheat flour" and describe the flour used. |
The trap is the double statement. A product that says "Contains milk" and also "may contain milk" is not being careful; it is telling the customer that the label cannot be trusted. FDA's guidance names this case explicitly: if a major allergen is an ingredient and is declared, an advisory statement for the same allergen is misleading.
Where a bakery item hides its allergens
Most wrong labels are not lies; they are omissions. These are the places allergens sit in a bakery without appearing in the product name.
| Item | Allergens usually present | Where they hide |
|---|---|---|
| Croissant, brioche, milk bread | Wheat, milk, egg | Butter layers; egg wash on top; milk powder in some improvers |
| Sourdough, baguette | Wheat | The starter is flour and water; "flour" on a label must name wheat |
| Bagel, burger bun, seeded loaf | Wheat, sesame, egg | Sesame on top and in the dough; egg wash for shine |
| Marzipan, praline, frangipane | Tree nuts (almond, hazelnut), egg, milk | Named as a flavour, not as a nut; praline paste is hazelnut |
| Chocolate ganache, glaze | Milk, soy | Soy lecithin in chocolate; cream and butter in ganache |
| Custard, cream filling, meringue | Egg, milk | Often described only as "cream" |
| Fruit cake, mince pie | Wheat, egg, milk, sulphites (UK) | Dried fruit and alcohol carry sulphites above 10 ppm |
| Sausage roll, savoury pie | Wheat, milk, egg, mustard, celery (UK) | Mustard in the seasoning, celery in stock |
Two habits fix most of this. First, write the label from the recipe sheet, not from the product name — every ingredient, including the wash, the glaze and the "spice mix". Second, treat the spice or seasoning blend as a possible allergen carrier: FDA's guidance specifically notes that if sesame is part of a spice mix and is not declared elsewhere, it must appear in a Contains statement or in parentheses after "spices".
Today's bake times are a schedule, not a promise
A bakery's most-asked question after "do you have any left" is "when will the next batch be out". Publishing that is cheap and useful, and it is also a good example of content that should never be printed on a label.
What to publish, in order of usefulness:
- The bake rhythm — "out of the oven around 7:00, 9:30 and 13:00". A range survives a late oven; "7:00 sharp" does not.
- What is out now — item, price, and a sold-out mark that stays visible. The customer who drove over for the cardamom buns needs to see they are gone, not wonder whether they misread.
- What is left — "six left" is more useful than "limited", because it tells someone whether it is worth the trip.
- The next morning's notice — "closed Monday, baking Tuesday from 7:00". One line, edited the night before.
The bread itself argues for keeping this on a page rather than a card. Staling is starch retrogradation, and it runs fastest in the cold: studies of storage temperature put the highest retrogradation rate at around 4 °C — ordinary fridge temperature — while freezing at −18 °C holds the crumb almost unchanged for weeks. Which is why the useful line for a customer is not "baked today" but "keep it on the counter tonight, freeze what you will not eat tomorrow, and refresh it in the oven". That is a sentence about the shop's bread, and it changes as often as the bread does.
Where this overlaps with our other bakery note. The sold-out list and the line edited at 6am are covered in the daily menu page article. This piece is about the other half — the part the law fixes to the package, and the whole-cake order that is not a menu item at all.
Whole-cake orders: five fields and one cutoff
A cake ordered for Saturday is the clearest case of "not prepacked": it does not exist when the customer asks, so no label can be printed in advance. What replaces the label is a clear order confirmation, and what makes the order work is five fields.
- Size and servings — 6-inch for 6–8, 8-inch for 12–16, and what a tiered cake actually serves after cutting.
- Flavour and filling — chosen from a fixed list, not "whatever you like", because the ingredient list and the allergens follow from it.
- Inscription, exactly as written — spelled out and read back. "Happy Birthday, Sam" and "Happy Birthday Sam" are different cakes to the person collecting one.
- Collection or delivery time — a window, not "Saturday". The cake has a cold chain and the shop has a queue.
- A phone number and a deposit — the deposit is what makes the slot real; the number is what the shop uses when the inscription is ambiguous.
Then the cutoff. Forty-eight hours is the common answer for a standard cake and longer for tiered or sculpted work, and it should be on the form itself, not discovered at the till. If the cake is made in a kitchen that handles nuts, sesame or gluten, say so in the confirmation: the customer with an allergy is ordering a cake, not reading a website, and the confirmation is the document they keep.
Two smaller things belong in the same form: what to do with the cake before serving (fridge until 30 minutes before, then room temperature), and the cancellation rule in one line. Both are the kind of detail that prevents a phone call on Saturday morning.
The page: eight blocks, in this order
- Today — bake times, what is out, what has sold out. First, because it is the reason someone opens the page on their phone outside the shop.
- The allergen matrix — every item against the allergens, with a line saying what to do if the answer is not on it ("ask at the counter; we will check the recipe sheet").
- Whole cakes — the five fields, the cutoff, the deposit.
- The label explained — one short paragraph: "Items packed on the premises carry a full ingredient label; items packed at the counter do not, and we will tell you what is in them." This sentence does more for trust than a page of policy.
- Bread and keeping — counter tonight, freezer for tomorrow, refresh in the oven. Two lines.
- Where and when — address, hours, the collection door if it is not the front door, and parking in one line.
- One button — call, message or order. One, not four.
- The shop's own note — who bakes, since when, what they are known for. The only block that never changes and the only one a competitor cannot copy.
The page's job is to be edited in under a minute from the counter. If marking two items sold out takes longer than answering the phone, it will not happen, and a stale page is worse than none — the code then actively misleads.
The printed pieces that carry the legal part
The printed set has to do two different jobs: carry the label where a label is required, and put the code where a customer will actually scan it.
| Piece | What it is for | What must be on it |
|---|---|---|
| Box or bag label (prepacked items) | The legal label | Name of the food; full ingredients with allergens emphasised (UK), or ingredient list / Contains statement (US); the shop's name and address |
| Counter card | Tells the customer the matrix exists | One sentence and the code: "Allergen information for everything on this counter — scan or ask." |
| Bag sticker | Starts the relationship after the sale | Code, the page address in plain text, and the keeping line |
| Cake box label | The order confirmation and the keeping rule | Customer name, collection time, flavour, allergen line, "keep refrigerated, serve at room temperature" |
Our templates print a placeholder label: name, ingredients, allergen line, shop details, with the allergens set in bold. They are designed so the shop can fill them from the recipe sheet in a few minutes and print on a sheet of labels — not so the shop can skip checking them. The one thing the kit cannot know is what went into the batch.
For the code itself, the practical rules are the ones that apply to any printed code: keep it off folds, leave at least four modules of clear space around it, size it by the reading distance (about one unit of code per ten units of distance — an industry rule of thumb, not part of the QR standard), and print the address underneath in plain text for the day the code is scratched. Our counter card is 93.0 × 127.5 mm with a 48 mm code and reads at about half a metre; the A4 poster carries a 126 mm code and reads at about 1.3 m. Both are measured from the PDFs the kit generates, error correction M, four-module margin.
What it costs, and what to check before printing
The page can be built free: shop name, items, hours, phone, the matrix, the cake form. It keeps the same address when it is edited, which is the only technical property that matters here — a printed code points at an address, not at a file, so one code stays correct through a hundred price changes. The printed pieces are optional and one-off:
| What | Price | What is in it |
|---|---|---|
| Starter | $49 | The whole print kit, ten tables, one revision |
| Standard | $89 | Thirty tables, two revisions |
| Full Launch | $149 | A hundred tables plus ten social cards |
None of it renews. Payment runs through Polar's checkout, which is the merchant of record, so card details never touch this site.
Before the first print run, eight checks:
- Every prepacked item has a label with the name and full ingredients, allergens emphasised.
- The label was written from the recipe sheet, including washes, glazes and seasoning blends.
- "Contains" lists every major allergen present, not only the ones in the product name.
- "May contain" appears only where a risk assessment found a real risk, and never for an allergen already declared as an ingredient.
- No "free from" claim without a separated bench and a record.
- The matrix has every item, and staff can find it in ten seconds.
- The cake form has five fields, a cutoff and a deposit line.
- Somebody has stood at the counter with a mid-range phone and scanned the actual printed code.
One page for today, one label for the package
Build the page free and edit the sold-out list from the counter. If you want the printed set — labels, counter card, bag stickers, poster — it is a one-off payment, delivered within 24 hours, with the label text left for you to check against your own recipes.
Related notes
- A bakery's daily menu page — sold-out bakes and the one line you edit at 6am; the other half of this problem.
- A gelato flavour board on one page — the same daily-change problem, with allergens on the tubs.
- How big the QR code has to be, in millimetres — the quiet zone, the 1:10 rule and printing at 100%.
- Wi-Fi and menu on one counter card — measured card sizes for a counter with no room.
- The three-year cost calculator — put a monthly builder or app figure in and see the total.
Sources
Read on 15 November 2026. Nine US major allergens, sesame effective 1 January 2023, and the FASTER Act — FDA, The FASTER Act: Sesame Is the Ninth Major Food Allergen; FDA, Food Allergies; FDA, Where do the allergen labeling requirements come from? How the declaration must appear, the Contains statement, named tree nuts and fish species, and the retail/food-service exception for food wrapped to order — FDA, Guidance for Industry: Questions and Answers Regarding Food Allergens, Edition 5, January 2025, sections B.1, D.1, D.10–D.16. Advisory statements such as "may contain" are not addressed by section 403(w), are not a substitute for preventive controls, must be truthful and not misleading, and should not duplicate a declared allergen — same guidance, D.11–D.15. Allergen-free claims and the milk-free / may-contain-milk conflict — same guidance, D.13–D.14. "Gluten-free" defined, including 20 ppm and the ban on intentional gluten grains — 21 CFR 101.91; FDA, Questions and Answers on the Gluten-Free Food Labeling Final Rule; 78 FR 47154 (5 August 2013). UK prepacked for direct sale from 1 October 2021, what bakers must label, what counts as packaging, and what is not PPDS — GOV.UK, Prepacked for direct sale (PPDS) allergen labelling changes for bakers, 9 July 2021; GOV.UK, Labelling guidance for prepacked for direct sale (PPDS) food products; GOV.UK, Food allergen labelling and information requirements technical guidance (updated 25 June 2026), Part 3. Loose and non-prepacked food: no label required, 14 allergens must be available, oral allowed with clear signposting, written is best practice, digital needs an alternative route — GOV.UK, Allergen information for non-prepacked foods best practice, 24 February 2025, paragraphs 28–45; GOV.UK, Introduction to allergen labelling for PPDS food. The 14 allergens — UK FIC Annex II as reproduced in the GOV.UK PPDS labelling guidance. A QR code is not sufficient for a PPDS label — Watford Borough Council, PPDS frequently asked questions ("Can the ingredients be listed by means of a QR code? No. A QR code will not suffice"), consistent with the requirement in the GOV.UK technical guidance that mandatory particulars appear on the package or on a label attached to it. Bread staling fastest around fridge temperature and arrested by freezing — Aguirre, Osella, Carrara and Buera, "Effect of storage temperature on starch retrogradation of bread staling", Starch – Stärke, 2011 (highest retrogradation rate at 4 °C; unchanged at −18 °C); IREKS Compendium of Baking Technology, Measures to delay staling. The 1:10 code-size rule is an industry rule of thumb, not part of ISO/IEC 18004. Printed sizes — the 93.0 × 127.5 mm counter card with a 48 mm code and the A4 poster with a 126 mm code — are measured from the PDFs this site's print kit generates. Prices — the free page and the $49 / $89 / $149 one-off kits — are the published figures on /showcase/order. This is not legal advice for a particular shop; food labelling depends on where the shop sells and on its own recipes, and the shop is responsible for the label it prints.