On December 23, 2022, Congress enacted the first major statutory change to the Food and Drug Administration (FDA)’s ability to regulate cosmetics since the Federal Food, Drug, and Cosmetic Act (FDCA). Passed with bipartisan and industry support, the Modernization of Cosmetics Regulation Act (MoCRA) significantly expands FDA’s rulemaking and enforcement authority over cosmetics and creates substantial new compliance obligations for manufacturers, packers, and distributors of cosmetics intended for sale in the United States.

Although MoCRA establishes several new requirements concerning product safety, it provides comparatively little guidance on the kinds of marketing or promotional claims brands can now make about the safety of their products.

This article explores MoCRA’s impact on cosmetics companies, what questions remain unresolved following MoCRA’s passage, and what companies can do to protect themselves from regulatory scrutiny and litigation risk while continuing to educate consumers.

Background

Before MoCRA, the United States had not substantially changed or updated federal regulations governing cosmetics since the passage of the FDCA in 1938 and the passage of the Fair Packaging and Labeling Act (FLPA) in 1966. The FDCA required finished cosmetic products to be safe when used by customers in accordance with product labeling or customary usage and to not be misbranded or adulterated,^[2] while the FLPA required cosmetics marketed on a retail basis to consumers in interstate commerce to be honestly and informatively labeled.^[3] The FDCA and the FLPA constituted the basis of federal cosmetics regulation for over 50 years, even as the cosmetics industry grew exponentially during that time, and required more comprehensive guidance. Although consumer advocacy groups and industry groups, like the Personal Care Products Council, called for updated regulation, several recent attempts to update the existing regulatory scheme failed to progress in Congress.^[4]

What’s New Following MoCRA?

It is difficult to understate the impact that MoCRA will have on the cosmetics industry with respect to federal regulatory oversight.

MoCRA contains a number of significant federal obligations regarding product safety. For example, MoCRA now:

• requires any facility that manufactures or processes cosmetic products intended for sale in the United States—irrespective of whether the facility is located in the United States—to register with FDA;
• requires manufacturers, packers, and distributors of cosmetics intended for sale in the United States to submit to FDA lists of products and ingredient information, including location of manufacture and the ingredients of any fragrances or flavors;
• imposes greater recordkeeping obligations regarding product safety and reporting, documenting, and following up on serious adverse events—with an expanded definition of what constitutes a serious adverse event; and
• imposes new labeling requirements, including providing contact information for adverse event reporting and notifications for products intended for professional use.

MoCRA preempts state and local government requirements for cosmetics that differ from MoCRA, with limited exceptions for prohibitions or limitations on the amount of an ingredient that can be used in a cosmetic under state law and existing reporting requirements that pre-dated MoCRA, such as California’s Proposition 65.

MoCRA further requires FDA to enact regulations addressing good manufacturing practices (GMP), the identification of fragrance allergens that must be disclosed on cosmetics labels (in line with European Union (EU) and other international requirements), and standardized testing methods for detecting and identifying asbestos in talc-containing products with timelines for the issuance of proposed rules and final rules within three years.

MoCRA’s rulemaking requirements represent a significant change from FDA’s current regulatory scheme. Prior to MoCRA’s enactment, FDA did not require cosmetics companies to abide by a set of legally defined GMP, such as those practices set forth in the International Organization for Standardization’s standard for cosmetic GMPs, ISO 22716:2007 (which the EU requires), or by certain voluntary certifying organizations like the National Sanitation Foundation. Instead, FDA promulgated voluntary guidelines for effective self-inspection of manufacturing facilities and practices and maintained the right to inspect facilities and finished products to ensure non-adulteration. In this respect, the United States was similar to Canada, whose Food and Drugs Act required that cosmetics be produced and stored in clean, hygienic environments, but encouraged, rather than required, adherence to GMP standards. Once FDA enacts the new regulations required by MoCRA, they will be the first federal regulations to mandate the implementation of GMP by cosmetics companies.

Likewise, while the FLPA required cosmetics marketed on a retail basis to identify their ingredients, it did not require companies to disclose “trade secrets,” of which fragrance formulas were likely to be. Consequently, fragrance ingredients were simply listed as “fragrance,” rather than disclosed on an individual basis. That will continue to remain the case until FDA issues new fragrance allergen regulations under MoCRA, after which companies will likely be required to disclose any fragrance ingredients that FDA considers to be allergens, considering EU and international standards.

In addition to these new obligations, FDA has now been granted mandatory recall authority if it determines that: 1) there is a reasonable probability that cosmetics are adulterated or misbranded under the FDCA; and 2) exposure will cause serious adverse health consequences. FDA also may suspend a facility’s registration if FDA: 1) determines that a product manufactured or processed at that facility has a “reasonable probability of causing serious adverse health consequences to humans”; and 2) reasonably believes that other products manufactured or processed by the facility may be similarly affected. Finally, FDA may access certain records pertaining to product safety and request a list of ingredients in the fragrances or flavors in a product if it has reason to believe that a fragrance or flavor contributed to a serious adverse event.

While Congress appropriated additional funds for FDA to implement MoCRA, it did not direct FDA to create a new center for cosmetic oversight and enforcement. Currently, cosmetic oversight and enforcement responsibilities will likely lay with the Office of Cosmetics and Colors, which is part of the Center for Food Safety and Nutrition. It is unclear whether FDA will create a new center dedicated solely to cosmetics issues.

What Does MoCRA Not Change?

Although MoCRA represents a significant shift in the way the federal government regulates the cosmetics industry, MoCRA falls short of previous legislative proposals, which would have authorized FDA to conduct annual investigations into the safety of ingredients or, in certain cases, restrict or prohibit the use of ingredients like per- and polyfluoroalkyl substances (PFAS), or so-called endocrine disruptors. It does, however, require FDA to issue a report within three years assessing the use of PFAS in cosmetics and their safety, signaling the possibility of further legislation or regulation, if warranted.

MoCRA also does not address or alter the existing regulatory framework for cosmetic labeling and marketing issues, such as defining or restricting the use of certain terms like “natural,” “clean,” “nontoxic,” or “safe.” Nor does it provide guidance on how much support brands need to make certain claims, such as scientific studies, customer surveys, or third-party certifications. These are growing areas of scrutiny for the class action plaintiffs’ bar, yet MoCRA does not provide any additional guidance on what kinds of claims companies can make about the safety or purity of their products. Instead, companies will have to look to guidance from FTC, in the form of reported enforcement actions and prospective revisions to FTC’s “Green Guides,”^[5] as well as federal court decisions, to provide guidance on cosmetic claims.

Nor does MoCRA address so-called “greenwashing” or environmental impact claims, which have been the focus of recent legislative action in the United Kingdom and the EU. MoCRA fails to address whether and under what conditions a product can claim to be environmentally friendly, green, or zero-pollution in its marketing.

Potential Litigation Risks in MoCRA’s Wake

MoCRA does not provide federal preemption protection for state consumer protection or liability claims. Nor does MoCRA alter the existing regulatory framework, with FDA and FTC sharing oversight of cosmetic marketing claims, or the relationship between the two agencies. FDA will continue to regulate labeling (i.e., ingredient/drug) claims, while FTC prohibits unfair, deceptive, or misleading advertising and marketing practices. In the absence of additional legislative clarity, cosmetics companies will continue to be vulnerable to class action consumer protection lawsuits over their marketing claims.

Moreover, although it is well established the FDCA does not provide for a private right of action, plaintiffs already bringing class action lawsuits over companies’ usage of terms like “clean,” “natural,” or “nontoxic” under fraud theories may find that MoCRA’s new product ingredient listing requirements provide opportunities for plaintiffs to scrutinize the composition of cosmetics and allege that products contain chemicals rendering them not “clean,” “natural,” or “nontoxic,” given the terms’ lack of regulatory definitions and inconsistent usage among retailers. MoCRA requires companies to disclose product ingredients to FDA, and such information is accessible to the public through Freedom of Information Act requests, unless it is considered to fall within that law’s exemption from disclosure for trade secret or confidential commercial information.

Additionally, MoCRA’s new recordkeeping requirements with respect to safety substantiation and adverse event reporting may provide plaintiffs with additional fodder to scrutinize the sufficiency of companies’ safety substantiation data and risk assessment processes to allege that products are no longer safe or nontoxic. Given the continued regulatory ambiguity surrounding the term “safe,” and what data constitutes sufficient safety substantiation, companies should expect that their testing and compliance practices will be scrutinized, particularly in litigation discovery and by plaintiffs’ experts.

Although MoCRA does not require companies to implement GMP, MoCRA does require FDA to enact new regulations establishing GMP regulations consistent with national and international standards, with a proposed rule within two years (end of 2024) and a final rule no later than end of 2025. Although it remains to be seen whether these regulations will be passed within the three-year deadline, companies should anticipate, that while the FDCA does not provide for a private cause of action, FDA’s forthcoming GMP regulations as provided may be considered indicative of adulteration in any plaintiff-initiated litigation. Moreover, plaintiffs may seek to shoehorn companies’ failures to comply with GMP as evidence that products are not clean, natural, safe, or nontoxic in connection with consumer protection litigation. To protect themselves in the interim, companies can begin to adopt various GMP, using as a starting point FDA’s draft guidance for cosmetic GMP, which was developed in November 2018 and incorporated elements from the International Organization for Standardization GMP.

Finally, MoCRA requires FDA to develop regulations standardizing testing methods for detecting and identifying asbestos in talc-containing products and prepare a report on the use of PFAS in cosmetics and their safety. Despite few instances involving known contamination by asbestiform fiber and FDA’s recent release of the results of its 222 sampling assignment that did not detect asbestos in any of the 50 cosmetic samples tested, allegations of asbestos contamination in talc-containing products continue to be a focus of litigation. Following MoCRA and FDA’s forthcoming regulations standardizing testing methods, plaintiffs may seek to use any deviation from FDA’s standardized test, or failure to document compliance with FDA-approved methods, as evidence that products are contaminated or not safe. Likewise, given the growing interest by the private plaintiff’s bar over the presence of PFAS in cosmetics and allegations that “clean” advertising is misleading if PFAS are present, brands should expect continued scrutiny in the wake of FDA’s forthcoming report.

Takeaways

MoCRA represents a sea change in how FDA regulates the cosmetics industry, significantly expanding the agency’s rulemaking and enforcement authority over cosmetics and closing a number of gaps in the existing regulatory framework. However, MoCRA does not provide any guidance for companies seeking to avoid class action claims for alleged false or misleading claims and labeling, and in fact creates new opportunities for an aggressive plaintiffs’ bar, which will seek to use MoCRA’s obligations and any alleged noncompliance as the basis for state law claims.

Given these risks, companies should take active steps to protect themselves. These include:

• Involving counsel before putting “safety” claims out into the marketplace;
• Reviewing all product composition, safety, and toxicity claims to ensure that they are scientifically supported and defensible, including any third-party certifications or test methods used to support those claims;
• Carefully reviewing and documenting processes and procedures for compliance with MoCRA as well as forthcoming regulations regarding GMP;
• Documenting consumer surveys and other data detailing product safety and test methods or any other criteria on which companies rely to substantiate product safety;
• Including appropriate warning language on product labeling and packaging where applicable;
• Testing products and ingredients provided by third-party suppliers routinely for impurities and a larger variety of contaminants; and
• Providing clear and consistent guidance to influencers about what can and cannot be said about products on social media.

Finally, companies should think critically about all advertising and labeling claims and consider what is being communicated to consumers and the value of that message. As always, claims are open to misinterpretation or misperception, even by reasonable consumers. Companies should exercise caution when making claims that may overpromise safety.

References

[1] Modernization of Cosmetics Regulation Act (MoCRA).

[2] 21 U.S.C. §§ 361–362.

[3] See 21 C.F.R. § 701.3.

[4] In 2017, Sens. Dianne Feinstein, D-Calif., and Susan Collins, R-Maine, introduced the bipartisan Personal Care Products Safety Act, which received support from major companies such as L’Oréal, Revlon, Estee Lauder, and Johnson & Johnson as well as health and consumer advocates such as the American Academy of Pediatrics and the American Cancer Society. Also that year, Sen. Orrin Hatch, R-Utah, introduced the FDA Cosmetic Safety and Modernization Act. Both bills would have required mandatory reporting of adverse events by manufacturers and distributors, as well as registration of manufacturing facilities, and certain levels ingredient review from FDA.

[5] In 2021, FTC indicated that it would initiate a review of its Guides for the Use of Environmental Marketing Claims—the so-called Green Guides—and potentially revisit guidance with respect to claims regarding “non-toxic” and “organic” products.