Congress Adds Some Teeth to FDA’s Authority to Regulate Cosmetics (2024)

Key Takeaways:

• For decades, cosmetics have largely been subject to fewer regulations and less stringent oversight than other products regulated byFDA. At the end of last year, Congress provided FDA with stronger tools to regulate, monitor, and enforce against unsafe or otherwise non-compliant cosmetic products.
• As a result of these amendments, cosmetic companies will soon be subject to new requirements for registration, product listing, disclosure of ingredients, adverse event reporting, safety substantiation, and compliance with good manufacturing practice.
• Transitioning from a regime that depended by and large on voluntary compliance to more active regulation and oversight will require FDA to promulgate new regulations and issue additional guidance for industry.

_______________________________________________________________________________________

Introduction

The Food and Drug Administration (FDA) now has additional regulatory authorities over cosmetics, thanks to the Food and Drug Omnibus Reform Act (FDORA). FDORA was a part of the Consolidated Appropriations Act, 2023 (the omnibus spending package that Congress passed late last year) and it amended the Federal Food, Drug, and Cosmetics Act (FDCA) to, among other things, provide FDA with additional oversight tools over cosmetics. The FDORA subtitle amending the FDCA cosmetics requirements is entitled “Modernization of Cosmetics Regulation Act of 2022”(MCRA).[1]

Background on Cosmetic Regulation Prior to MCRA

The FDCA defines cosmetics as "articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body or any part thereof for cleansing, beautifying, promoting attractiveness, or altering the appearance." The definition excludes “soap” but encompasses a variety of personal care products, including skin moisturizers and lotions, perfumes, hair care products and color, deodorant, makeup, and components of such products.

Some personal care products, i.e. those with therapeutic intended uses, are also regulated as drugs or medical devices and are therefore subject to additional requirements such as premarket review or conformance with an over-the-counter (OTC) monograph, which specifies conditions to ensure the covered products are generally recognized as safe and effective and not misbranded. For example, a toothpaste is a paste, gel, liquid, or other preparation that is intended for cleaning teeth and is regulated as a “cosmetic.” If a toothpaste also is intended to prevent the formation of dental caries, it also is subject to the monograph for OTC anticaries drug products.[2]The monograph specifies the permissible active ingredients, including the concentration and dosage form for each ingredient, packaging conditions, labeling conditions, and procedures to test for caries reduction.

Personal care products that are regulated solely as cosmetics have not been subject to such requirements, because FDA’s statutory authority over cosmetics has been far less comprehensive than the agency’s authority over other products it regulates. FDA can conduct inspections of cosmetic manufacturers and take certain actions against adulterated or misbranded cosmetics under the FDCA, such as issuing import alerts and/or warning letters to responsible entities, and it can enlist the Department of Justice to initiate legal action seeking an injunction, seizure, or even criminal penalties for egregious violations. A cosmetic is adulterated, for example, if it has been produced in an unsanitary manner or if it contains an injurious or unsanitary substance or an unsafe color additive (other than certain coal-tar hair dyes with requisite disclaimers).[3] A cosmetic can be deemed misbranded, for example, if its labeling is false or misleading or if its packaging or labeling fails to contain requisite information or conform to certain requirements.[4]

But FDA has had little authority to regulate these products before they are introduced into commerce or effectively monitor the products once they have reached the market. First, cosmetic formulations are not reviewed byFDA prior to being sold to consumers, and although cosmetic firms are responsible for substantiating the safety of their products and ingredients prior to marketing them in the U.S., many of FDA’s cosmetics guidelines provide the industry with “considerable flexibility regarding product development and claims.”[5]With respect to cosmetic ingredients, only color additives must be approved by FDA for their intended use. In addition, FDA has had limited authority to require companies to perform safety testing, follow good manufacturing practices, submit adverse event reports, recall their products, or even register their facilities with FDA and has instead depended upon voluntary compliance with recommended guidelinesand procedures.

New Requirements Added by MCRA

Even under the new law, cosmetic products and ingredients (other than color additives) will not require premarket notification or FDA review or approval before they are commercially marketed. The amendment, however, will require companies to register their cosmetic manufacturing or processing facilities with FDA and list the cosmetic products associated with these facilities.[6]This would include any facility that makes any cosmetic product “by chemical, physical, biological, or other procedures, including manipulation, sampling, testing, or control procedures applied to the product” but would exclude establishments such as beauty shops and salons (that do not make cosmetics), retailers, distributors, and establishments that only perform certain manufacturing functions, such as labeling and packaging.[7]

FDA’s regulations currently request that cosmetic companies disclose a list of ingredients to FDA within 60 days after the beginning of commercial distribution of the product and identify the product’s intended use category. Not only has this procedure been voluntary, manufacturers who chose to submit a statement were permitted to list certain ingredients as “fragrances” or “flavors” without disclosing the product name or trade name of the ingredient or supplier.[8]Under the new law, a manufacturer will be required to provide a list of ingredients when it registers its facility and lists its products with FDA. The label of each cosmetic product will also be required to identify each “fragrance allergen” included in the product, once FDA promulgates regulations determining which substances are fragrance allergens.[9]Moreover, if FDA has “reasonable grounds to believe” that a fragrance or flavor ingredient may have contributed to a serious adverse event (explained below), it now has the authority to obtain a list of the ingredients in the specific fragrances or flavors in the cosmetic product from the manufacturer.[10]

Cosmetic product manufacturers will also now be required to comply with adverse event reporting and record retention requirements.[11]More specifically, cosmetic companies will only be required to report serious adverse events to FDA, but they will need to maintain records of all reports of adverse health-related events associated with the use of their products that they receive. For an adverse event to be considered serious, and thus reportable, it must have resulted in—or required a medical or surgical intervention to prevent—death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, a congenital anomaly or birth defect, an infection, or significant disfigurement. The new law will require all adverse event records to be maintained for 6 years and be subject to inspection by FDA.

The new law also explicitly requires a cosmetic product manufacturer to ensure and maintain records supporting that there is “adequate substantiation of safety” of the product, which is defined as “tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe.”[12]A cosmetic product is “safe” under the new law if the formulated product or none of the ingredients are injurious to users if the product is used as directed by the label or in a manner that is customary or usual for such a product.

The statute explains that a cosmetic product or ingredient would not be considered injurious to users solely on the basis of the potential to “cause minor and transient” reactions or skin irritations in some users. However, the statute also clarifies that FDA may consider “the cumulative or other relevant exposure to the cosmetic product, including any ingredient thereof” when determining whether a product is injurious. This is a critical win for consumer advocates, who have long been calling for FDA to consider the effect of cumulative exposure to cosmetic ingredients and take appropriate action.[13]Similarly, the new law requires FDA to promulgate regulations establishing testing methods for detecting and identifying talc-containing cosmetic products[14] and to assess the use and safety of perfluroroalkyl and perfluroroalkyl substances (PFAS) in cosmetic products.[15]

Another important measure in MCRA is a requirement that FDA issue regulations to outline good manufacturing practices (GMPs) for cosmetic products. Although FDA has previously released GMP guidelines for cosmetics, manufacturers were not required to follow them. MCRA tasks FDA with establishing GMP guidelines by regulation that are consistent with national and international standards but also “take into account the size and scope of the businesses engaged in the manufacture of cosmetics, and the risks to public health posed by such cosmetics, and provide sufficient flexibility to be practicable for all sizes and types of facilities to which such regulations will apply.”[16] MCRA gives FDA express authority to inspect records necessary to demonstrate compliance with the GMPs. Before issuing the GMP regulations, FDA is required to consult with cosmetics manufacturers, publish a notice of proposed rulemaking, and publish a final rule within three years of the statute’s enactment. Manufacturing a cosmetic product that fails to meet these GMPs would render the product adulterated under MCRA.

MCRA authorizes FDA to enforce these new provisions by expressly making failure to comply with these requirements prohibited acts under the FDCA.[17] Moreover, MCRA provides FDA with mandatory recall authority over a cosmetic product if it determines that a reasonable probability exists that the product is adulterated or misbranded and “the use of or exposure to the product will cause serious adverse health consequences or death.”[18] FDA can also suspend the registration of a cosmetic facility if it determines that a cosmetic product manufactured or processed by that facility has a reasonable probability of causing serious adverse health consequences or death to humans and that other products manufactured or processedby the facility may be similarly affected.[19]

A few additional provisions are worth mentioning. First, MCRA includes an express preemption clause, which precludes a state from establishing or continuing in effect any different requirements for cosmetics related to registration and listing, GMP, records, recalls, adverse event reporting, or safety substantiation, however, the provision allows states to prohib­it the use or limit the amount of an ingredient in a cosmetic product and to continue any requirements for reporting cosmetic ingredients that existed prior to the enactment of MCRA.[20] Secondly, MCRA exempts small businesses from the GMP, registration, and product listing requirements, provided that the companies do not manufacture certain products, such as those that are injected or intended for internal use.[21] Products and facilities that are also subject to drug or device GMP regulations are also exempt from these requirements as well as MCRA’s adverse event reporting, safety substantiation, recordkeeping, and labeling provisions.[22]

Conclusion

Now that Congress has changed the law to give FDA more teeth, the public will have to wait and see how hard the agency will bite. How FDA implements and uses its new authorities under MCRA will be a matter of great interest to cosmetic manufacturers and consumers alike. These new requirements will be introduced on a rolling basis. For example, the registration and listing requirements will be effective as of the end of this year and the statute requires FDA to promulgate labeling and CGMP regulations within the next two to three years. In any case, before the start of any FDA regulatory activity, it will be incumbent on companies in the cosmetics industry (new and established alike) to gain an understanding of what these new requirements mean for their businesses. If you would like to discuss these implications, please feel free to reach out to Foley Hoag attorneys Bryant Godfrey and Tina Papagiannopoulos.