legal risks in CPG