Buy a bike helmet and you probably assume it meets all the required government safety standards for protecting your head. But that’s not necessarily the case, if you shop online.

A recent investigation by Consumer Reports found that potentially unsafe helmets — not legal to sell in the U.S. — are “widely available” online.

“Helmets need to comply with Consumer Product Safety Commission (CPSC) standards to show that they protect against skull fracture,” said Kevin Loria, a Consumer Reports health reporter. “Part of that certification includes posting a label saying that it passed this testing. But there are a lot of helmets for sale that don't have these labels and so they may not be certified and should not legally be for sale.”

Consumer Reports (CR) bought 13 helmets in a variety of styles without the required CPSC label from four online marketplaces: Amazon, Sears, AliExpress (a subsidiary of Chinese retail powerhouse Alibaba) and LightInTheBox (a global retailer with headquarters in Beijing).

Some of the helmets Consumer Reports bought meet the European “CE” standard which is different from the U.S. standards. The CPSC requires helmets to withstand a stronger impact.

The lack of a label — or the wrong safety label — makes the helmet non-compliant and therefore illegal to sell in the U.S.

“CR is not saying these helmets are definitely unsafe, something that can’t be determined without putting them through testing,” Loria noted in his report on these findings. “But the fact that they came without the required label indicates they may not have been tested according to CPSC standards.”

Troubling findings

Dr. Fred Rivara, vice chair of the department of pediatrics at the University of Washington, is an expert on injury prevention who has studied bike helmets for more than 30 years.

“I’m shocked that there are helmets sold here the United States that don't meet the Consumer Product Safety Commission standards. This is crazy,” Rivara told NBC News BETTER. “I'm also surprised that the CPSC allows those things to be sold here.”

The CPSC reacted to Rivara's comment with this statement:

“CPSC put the mandatory safety standard for bicycle helmets into place to protect consumers. Manufacturers and importers are required to meet the standard. Firms are legally required to do the testing to ensure their helmets meet CPSC’s mandatory helmet safety standards before they are sold in the United States. We do not test all products before they are in the marketplace. When CPSC finds a non-compliant product at the ports, in the marketplace, or online, we take appropriate action.”

CPSC regulations require the following information to be on the helmet label:

A statement saying:“Complies with U.S. CPSC Safety Standard for Bicycle Helmets for Persons Age 5 and Older” or “Complies with U.S. CPSC Safety Standard for Bicycle Helmets for Persons Age 1 and Older (Extended Head Coverage).”

The name, address and telephone number of the manufacturer or importer.

Information, such as the serial number, that identifies the month and year the helmet was made and the production lot.

“Consumers should beware of bicycle helmets that do not have a label indicating they meet CPSC’s mandatory safety standard. Helmets that do not meet the CPSC safety standard may not protect your head in a crash,” the CPSC explained.

Online retailers respond to Consumer Report's findings

NBC News BETTER contacted Amazon, Sears, AliExpress and LightInTheBox about Consumer Reports’ findings.

Amazon, Sears and AliExpress said the helmets in question were sold by third-party companies that were contractually obligated to comply with all relevant laws and regulations. The three websites said those helmets are no longer available. LightInTheBox did not respond.

Helmet manufacturers contacted by NBC News BETTER commended Amazon, Sears and AliExpress for taking action, but pointed out that there are so many unsafe helmets on the market that this won’t make even a small dent in what they describe as “a really serious” problem.