As the world enjoyed the holiday season last year, the US Congress quietly passed the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), its first major update to the US cosmetics regulations in nearly a century. While some people feel it was overdue, it is quite clear to many US industry insiders that the authors of the Act know very little about the US beauty industry, and this is clearly reflected in the short comings of MoCRA. Others may argue that it has put the interests of some industry groups over others—possibly those that had the financial means to lobby and influence the US Congress. Either way, those of us who have been in the industry for a few decades believe that this regulation will end up having several unintended, negative consequences that will leave the US with some of the same issues that existed in the European Union (EU) pre-2009 causing the EU to pass EC No. 1223/2009. It also disproportionately impacts small and medium-sized brands while favoring large brands, multinationals, and the Environmental Working Group (EWG). More on this to follow. Ultimately, it will negatively impact the consumer, particularly those who are lower income.
To make matters worse, there are many myths swirling around this regulation creating fear in the global cosmetic industry. One of the primary reasons for so many misconceptions is that the US Food and Drug Administration (FDA) has not yet published the final regulations, and the actual details are unknown. To provide perspective, in the US, Congress passes laws and acts that are then given to the federal agencies to write the regulations. To date, we only have MoCRA which is the Act and the FDA, the agency, is developing the regulations. There are many consulting companies claiming to know the FDA’s thinking behind the regulations and therefore are propagating these myths with the goal of profiting from MoCRA.
One myth that will be debunked throughout this article is that MoCRA is inspired by the EU regulations and is very similar to EC No. 1223/2009. I will provide examples of how MoCRA is very different from the European regulations. I will also expose additional myths as I address the deficiencies of MoCRA.
Where has this Act fallen short and what are the unintended, negative consequences? While there are three primary areas—preemption, raw material and product safety, and regulatory definitions—they are all intricately intertwined.
Preemption and State’s Rights
In previous versions of this bill, some industry experts were able to get a federal preemption clause that incorporated the regulation of raw materials included to ensure one single federal cosmetics regulation that would sunset any existing state regulations. However, with input from the EWG, this was rewritten in MoCRA’s final draft, allowing states to establish any new law or regulation related to cosmetics as long as it is not in conflict with the requirements of MoCRA related to registration and product listing, good manufacturing practice, record retention, recalls, adverse event reporting, or safety substantiation. What that means is that if every US state put a reporting requirement in place like the FDA’s, a brand would have to register all their products 51 times. This begs an important question: How is it possible to have a patchwork of cosmetic laws in a single country when there is federal regulation?
Under the First Amendment, Federalism gives the states the right to address policy areas that are not addressed by the national government. This miss in the drafting of MoCRA will make compliance in the US potentially much more difficult. As an industry, our only hope is to try to influence the regulations both at the state and federal levels or push for changes to MoCRA. To further illustrate the first potential, unintended, negative consequence—state regulation proliferation—let’s look at California more closely.
As anyone who has sold products in the US knows, not only do brands need to comply with the FDA, but also with California’s many onerous regulations. Despite having several federal regulations, the state of California has passed mirror image regulations but with different requirements from the US (federal) regulations.
Currently cosmetics are regulated under FDA’s Food, Drug, and Cosmetics Act (FD&C Act) because MoCRA regulations are incomplete. Over the last few decades, California has passed three Acts: The Food, Drug, and Cosmetic Law (Sherman Act), which regulates the packaging, labeling, and advertising of cosmetics, drugs and devices; The California Safe Cosmetics Act, which established the requirement to report cosmetic products containing “hazardous” ingredients through an on-line portal; and The Cosmetic Fragrance and Flavor Ingredient Right to Know Act, which requires the disclosure to the state of fragrance or flavor ingredients in cosmetics and professional salon products. So, even though MoCRA requires fragrance allergens to be declared on the label moving forward, brands will still be required to report fragrance allergens to the state of California. Now that the EU has added 56 more fragrance allergens that must be declared on labels, how will California and MoCRA respond?
In addition, despite the existence of the US Environmental Protection Agency’s (EPA) Clean Air Act, which California has never been able to fully meet, the California Air Resources Board (CARB) has passed the Consumer Products Regulation to limit the amount of volatile organic compounds in consumer goods, including beauty products. The EPA also administers the Toxic Substances Control Act (TSCA), which requires reporting, record-keeping, and testing requirements—as well as restrictions relating to chemical substances and/or mixtures—and bans substances accordingly. Again, California has its own system—Proposition 65 (Prop 65)—officially known as the Safe Drinking Water and Toxic Enforcement Act of 1986, which identifies chemicals known to the state of California to cause cancer, birth defects, or other reproductive harm, and requires warnings on products containing these chemicals.
California is just one state in the US. Now imagine, if the other 49 states had all these same regulations, and each had different approved use levels, definitions, or requirements. Then add in the MoCRA requirements. A brand would need to make a formula that is compliant with 50/51 potentially different regulations or have several formulas just to sell in the US. Having 51 separate regulations would not only make compliance difficult, but the quality, price, and creativity of products could be impacted, making it harder for small and medium-sized brands to compete and ultimately impact the consumer. This is the first major difference between the US and the EU and in my opinion, and as I stated previously, is the reason that EC No. 1223/2009 was passed in the EU.
Raw Materials and Product Safety
Going hand in hand with preemption is product and raw material safety. MoCRA is vague on the requirements to prove that a brand’s products are safe. There are two big myths in this area: an EU-style safety assessment can be used to support product safety in place of testing, and brands need to hire a US Responsible Person (RP) to substantiate safety and report adverse events to the FDA. Both myths highlight two more differences between the US and EU regulatory schemes.
In 1976, the then Cosmetics, Toiletries and Fragrances Association (CTFA) now the Personal Care Products Council (PCPC), established the Cosmetic Ingredient Review (CIR) with the support of the FDA and the Consumer Federation of America. Although funded by CTFA/PCPC, the CIR, the Expert Panel for Cosmetic Ingredient Safety, and the review process are independent from PCPC and the cosmetics industry. In some ways this is no different than the EU Scientific Committee on Consumer Products (SCCS) opinions except that, to date, the FDA has not used CIR data to create regulations. The CIR program has worked effectively for the last 47 years and is largely, in my opinion, the reason why the FDA does not have restricted and prohibited lists like the EU Annexes and another major difference between the two regulatory schemes.
There is an additional key reason for the FDA’s vagueness. The FDA requires that all products placed on the market in the US must not be adulterated or misbranded. The regulatory definition of unadulterated is that a product is safe for consumers under labeled or customary conditions of use. The FDA does not have a list of required tests that must be conducted on raw materials or products. In their guidance documents, the FDA suggests to first conduct a review of the safety data provided by the raw material manufacturers, CIR, PubMed, and TOXNET and the FDA acknowledge that they do take CIR reviews into consideration when evaluating cosmetic ingredient safety—another affirmation that the CIR program is working. They also suggest that toxicological testing may be needed on newer ingredients or where data gaps exist. The FDA does explicitly identify microbiological testing as a mandatory requirement to prove that a product will not be cross contaminated during normal use.
Many brands have interpreted FDA’s vague guidance in two ways. First is, if the product is “natural” or “botanical” it is safe, and therefore does not have to be tested, which the FDA explicitly states is an incorrect assumption. The second interpretation and a popular myth is that an EU-style safety assessment is all that is required. This, however, is wishful thinking. The regulations in 21 CFR 740.10 state the following:
(a) Each ingredient used in a cosmetic product and each finished cosmetic product shall be adequately substantiated for safety prior to marketing. Any such ingredient or product whose safety is not adequately substantiated prior to marketing is misbranded unless it contains the following conspicuous statement on the principal display panel: “Warning - The safety of this product has not been determined.”
(b) An ingredient or product having a history of use in or as a cosmetic may at any time have its safety brought into question by new information that in itself is not conclusive. The warning required by paragraph (a) of this section is not required for such an ingredient or product if:
Further, as written, MoCRA states that what is required to substantiate safety “means tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe.” Clearly, this means that raw materials and products must be tested for safety. Misbranded means that false and/or misleading information is presented to the consumer about the product. So, if the safety of a product has not been substantiated and is missing the warning above, it is both adulterated and misbranded and could be recalled. This debunks the myth that cosmetic products are not regulated in the US as stringently as in the EU.
While the US doesn’t have the EU Annexes, the requirement to prove product safety involves testing—typically Human Repeat Insult Patch Testing (HRIPT); Preservative Efficacy Testing (PET); Stability; Compatibility; and Eye Safety; and data review and provides, at a minimum, the same level of scrutiny as the EU. Conversely, in the EU, it is the calculation and review of daily exposure limits (paper toxicology) and minimal testing, typically Microbial, Stability, and Compatibility. Heavy metals, 1,4-dioxane, and ethylene oxide should be added into the list of US testing to comply with the states and US retailer clean lists. Currently, the EU only requires certification letters from raw material manufacturers showing that they comply with purity requirements.
That said, despite MoCRA’s vague language, the FDA has stated publicly that nothing has changed as it relates to the substantiation needed to prove the safety of a raw material or a product. And considering now that the FDA has recall authority and expanded adverse event oversight, it is in a brand’s best interest to conduct rigorous testing to ensure that its products are safe. My personal opinion is that FDA was intentionally vague on safety to force brands to conduct testing if they have not done so previously.
Proliferation of State Regulations and the Impact to Small and Medium Brands
Following California’s lead and with pressure from groups like the EWG, states have begun to pass laws to regulate or ban chemicals used in cosmetics sold in their state. Washington, New York, Nevada, Illinois, Oregon, Maryland, Maine, and a few others either have passed laws or have bills in the hopper. Some states have bills related to asbestos in talc or PFAFs, both of which will be covered under future regulations and hopefully, industry will only have to comply with one federal regulation.
For example, Washington State’s Toxic-Free Cosmetic Act effective January 1, 2025, bans Ortho-phthalates, PFAFs, Formaldehyde, Formaldehyde donors (list yet to be defined), Methylene Glycol, Mercury and Mercury compounds, Triclosan, m-Phenylenediamine and its salts and o-Phenylenediamine and its salts. Further, after January 1, 2025, any product containing intentionally added lead or lead compounds or having lead or lead compounds as a contaminant above 1ppm is banned. This regulation was written by Washington’s State Department of Ecology, so therefore, not by anyone with cosmetic chemistry experience. State regulations tend to be written by state environmental agencies with very little knowledge of the cosmetic industry, including federal regulations, and we tend to see that most are either not scientifically feasible or there is no viable replacement for the newly banned substance or in direct conflict with federal regulations. More on this to follow.
Another example of this is a recent law that went into effect in Maine. Maine defines PFAFs as "Perfluoroalkyl and polyfluoroalkyl substances" or “substances that include any member of the class of fluorinated organic chemicals containing at least one fully fluorinated carbon atom.” This means that HFC 152A, a cleaner alternative aerosol propellant, can no longer be sold in Maine. (38 MSRA 16 §1614). To date, there is no feasible replacement.
To further illustrate the challenges with the proliferation of state regulations and creating one formula for the US, see the definitions for PFAFs in Maryland. Maryland’s bill (George “Walter” Taylor Act) defines regulated PFAFs of concern as Perfluorooctane Sulfonate (PFOS)/Heptadecafluorooctane–1–Sulfonic Acid, Potassium Perfluorooctanesulfonate/Potassium Heptadecafluorooctane–1–Sulfonate, Diethanolamine Perfluorooctane Sulfonate, Ammonium Perfluorooctane Sulfonate/Ammonium Heptadecafluorooctanesulfonate, Lithium Perfluorooctane Sulfonate/Lithium Heptadecafluorooctanesulfonate, Perfluorooctanoic Acid (PFOA), Ammonium Pentadecafluorooctanoate, Nonadecafluorodecanoic Acid, Ammonium Nonadecafluorodecanoate, Sodium Nonadecafluorodecanoate, Perfluorononanoic Acid (PFNA), Sodium Heptadecafluorononanoate and Ammonium Perfluorononanoate, thus allowing the use of HFC 152A.
Some states, however, have crossed the line into FDA territory without realizing it because the authors do not know federal cosmetic regulation as discussed previously. Without preemption, states may inadvertently regulate ingredients used in over-the-counter (OTC) products (sunscreens, antiperspirants, acne, etc.). OTC products are extensively regulated at the federal level, and as discussed earlier, states cannot create regulations that contradict federal regulations. This will now provide a conundrum for the states. For example, if Titanium Dioxide, a sunscreen active ingredient, is restricted or prohibited because of its heavy metal content, the state will have infringed on FDA’s regulations. Another example is around hair colorants. While MoCRA is silent on most ingredients, it specifically calls out coal tar hair dyes as the one class of chemicals with federal preemption. Yet, Washington state explicitly bans the use of m-Phenylenediamine and its salts and o-Phenylenediamine and its salts. Again, this shows the lack of understanding of federal cosmetic regulations. It is our hope that once the FDA completes the MoCRA regulations, it will begin to address these conflicting state regulations.
The last area that may be troublesome for states is around colorants. A state may ban an impurity that is used in a colorant that FDA has approved. MoCRA has not addressed colorants and it is likely going to become a bigger issue with respect to heavy metals. As background, every batch of synthetic colorant (think Red 6/CI 15850) that will be sold in the US is required to be tested and certified by the FDA. So, if the FDA certifies a batch of Red 6, and that batch of Red 6 contains lead above 1ppm, it will not be permitted for sale in Washington state because of the state’s limits on lead as discussed earlier. The newly created FDA Office of Colors and Cosmetics will hopefully sort this out. This is yet another example of the US’s regulation of cosmetics and in many cases, colorants in the US have more restrictions than in the EU.
Nongovernmental organizations like the EWG are encouraging states to pass laws to force the FDA to pass more regulations, particularly on raw materials. Excessive legislation will either put small brands out of business or drive down their purchase price, which only further helps the bigger brands looking to buy these brands for expansion. Moreover, smaller brands cannot afford to have multiple versions of packaging and formulas in inventory, particularly in the current economic conditions. We are seeing small and medium-sized brands going out of business weekly in the US, and the trend is likely to accelerate with the addition of more state regulations. What the EWG and others pushing for more regulations do not take into consideration is the cost to small and medium-sized brands and would lead one to believe that there is an incentive to help the larger brands and multinationals. Unfortunately, the EWG’s primary motivation is dishonest as they have a financial incentive to push for more state regulation. As they say, fear sells.
Does this situation sound familiar? Think about the EU pre-1223/2009. Back then, countries would ratify the Directives—at different times and sometimes even change the status of ingredients for their country without following the Directive. In 2005, France added Vitamin K1 to its prohibited list based on five cases of undesirable effects (allergic reactions) between December 2003 and June 2004 from three products and a further six cases were identified between March 2004 and July 2004 from another product containing Vitamin K1—11 cases and four products over two years. The Cosmetics Directive that was in force at that time did not ban Vitamin K1 and the SCCS opinion was not even issued and adopted until late 2007. At the time, I worked for a cosmetics company that sold face cream with Vitamin K1 throughout the European Union. This ban created chaos in the supply chain ensuring that the product was not shipped to France. Vitamin K1 is not an isolated case, and what resulted was a patchwork of regulations that became increasingly difficult with which to comply and the motivation to pass the Cosmetics Regulations (1223/2009).
Responsible Person—US and EU Similarities End with the Name
The last myth to be debunked in this section is around the idea of the US Responsible Person (RP). The similarities between the US and the EU systems, to a degree, end with the name. In the EU, the RP must be located within the EU and can be a brand, manufacturer, or third party. For an imported product, the importer (think retailer or distributor) shall be the responsible person for the product he places on the market. The importer may, by written mandate, designate a person within the EU to act as the EU RP. You see this most often when a US brand is selling to an EU retailer and a third-party EU RP is listed on the label instead of the retailer. In the US, the brand, regardless of its location, can designate an employee of the brand to be the responsible person. Brands located outside of the US are required to have either a US address, phone number, or a website where adverse events are collected and reported to the FDA. To be clear, brands can be their own US RP.
In the EU, the RP has the following responsibilities: ensure compliance with all applicable EU regulations related to safety, labeling, good manufacturing practices, safety assessments; Product Information Files (PIF); Notification; ingredient restrictions per the Annexes; animal testing; claims and withdraw or recall a noncompliant product; withdraw or recall a product that presents a risk to human health and immediately inform the competent national authorities; and shall cooperate with the competent national authorities to resolve product issues.
In the US, the RP is responsible for collecting and maintaining safety data and adverse events, notification of products, and reporting adverse events to the FDA. While the collection of the other documents is necessary for the brand, it is not the responsibility of the US RP.
Another key difference is that the US RP does not have to produce a safety assessment. In the EU, the safety assessor must meet specific education requirements and receive certification. The EU safety assessor produces a safety assessment based on the review of daily exposure limits (paper toxicology) and available test data. Going back to the myth around EU safety assessments as support for the safety of a product and using the Vitamin K1 example, at the time that Vitamin K1 was reviewed by the SCCS, the recommended CIR level was 5% and the recommended SCCS level was 3%. Which is the correct data to be used in a safety assessment to further support testing in the US– CIR or SCCS? As stated earlier, CIR data is what the FDA relies on, and that data is not in the EU software that many safety assessors use, it relies on SCCS data. Despite many EU responsible persons and safety assessors stating they can write a US Safety Assessment as support for product safety, they truthfully cannot answer this question because the FDA guidance is too vague and as discussed earlier, the FDA prefers actual testing.
Regulatory Definitions and Consumer Confusion
The final area for discussion and another real miss for MoCRA is around regulatory definitions. As an industry, we are not helping ourselves, and this is definitely an area that needs government intervention. Brands are creating their own definitions of clean, nontoxic, safe, and natural. Either because they do not know better or they think it costs too much, brands are self-certifying and making up symbols that are designed to look like those from independent, third-party certifying bodies.These terms are often used interchangeably by brands, each giving the term a different meaning and the result is consumer confusion and a false sense of safety.
To out “clean” each other, retailers are adding to the confusion by creating unique clean definitions based on “blacklists” of banned substances that brands must comply with to be considered clean. I have had new clients come to me and state that they have not conducted any safety testing because none of their ingredients are on a retailer’s “blacklist” except, in one example, the brand had 5% glycolic acid in their formula. I have heard from other brands that testing their products wasn’t required because all their ingredients have been assigned a 1 or 2 by EWG and by gaining EWG certification, they are a non-toxic brand. This is clearly false and in the absence of real definitions, both brands and consumers will continue to rely on this deceptive terminology.
EWG’s Role in the Regulatory Conversation
The EWG, in my opinion, is the most problematic for two reasons other than their push for additional state regulations. The EWG profits from consumer ignorance, which it stokes, and it has an amateurish certification program. It is a pay-to-play scheme that lures brands into thinking they are compliant and, as mentioned earlier, nontoxic, and clean, when in fact it only checks for compliance with EU Annexes and FDA regulations. In 2018, it took in $14 million USD in donations and a few additional million as part of this certification program.
Add to the fear mongering and the state legislative incitement, the EWG rating system that many small brands have relied on for safety is not based on sound science. In the Journal of the American Medical Association there was an article about this and in it, Drs. Rubin and Brod wrote the following: “the EWG’s skin safe database scores thousands of products based on the putative toxicity of their ingredients, but these claims are not always uniformly agreed on by a broad consensus of experts and can cause confusion to consumers. For example, the EWG assigned a hazard score of 5 to PEG-2 Soyamine, despite acknowledging that there is no available data. Although the EWG remains a powerful force driving the clean beauty dialogue, its method for assessing risk does not seem to be data driven. The EWG also profits from participating in affiliate programs where it receives a percentage of the sales when a consumer makes a purchase through their website, which may be a notable conflict of interest.”
MoCRA Falls Woefully Short of the Intended Goals of Product Safety
In summary, while the US needed updated cosmetic regulations, the lack of Congressional knowledge about the cosmetic industry coupled with the selfish interests of fear mongering lobbyists like the EWG, MoCRA falls woefully short of the intended goals of product safety. It is filled with loopholes, intentional ambiguity, unintended, negative consequences, and disproportionate financial costs. I would be willing to bet that anyone who thinks that MoCRA is a good piece of legislation is from a multinational, large company, an NGO, or someone who will profit from its passage.
For brands selling in the US to be successful and comply with MoCRA, I strongly suggest that they educate themselves on the elements of the Act and regulation once promulgated. As I have said, there are many myths being used as advertising to turn a profit from MoCRA. I have had brands ask me to be their US RP and my answer is the same, “Save your money! You are your own US responsible person. I can help you write an SOP for adverse event reporting if you do not have one, but you should already and if you do, it will need to be more robust. And I will tell you when the portal opens so you can upload your ILs, product category and contract manufacturer’s registration numbers by December 29, 2023.” Obviously, this is overly simplified, however, the point is that a brand does not need to hire someone to straighten its files and add data into a portal.
I suggest brands attend the Independent Beauty Association’s FDA Workshop, which will be held virtually on September 20–21, 2023, as Dr. Linda Katz, Director of FDA’s Office of Colors and Cosmetics, and Dr. Namandjé Bumpus, FDA’s Chief Scientist, will be providing insight into the anticipated regulations. More information can be found on the website.
