Landmark Cosmetic Law Adopted that Significantly Changes how Cosmetics Are Regulated by FDA

On Friday, December 23, 2022, Congress passed an approximately $1.7 trillion omnibus spending bill for fiscal year 2023, which was signed into law by President Biden on December 29, 2022. While the unusual circumstances surrounding the 4,000+ page bill’s passage (including the race to beat dual threats of government shutdown and an impending winter storm) have dominated most news stories about the legislation, the bill also ushers in numerous landmark reforms, including to the federal regulation of cosmetics. 

In fact, the "Modernization of Cosmetics Regulation Act of 2022 (MOCRA)" (incorporated as Sections 3501-3508 of the spending bill) marks the first major change to the US Food and Drug Administration (FDA)'s authority over cosmetics since 1938—when the Federal Food, Drug, and Cosmetic Act (FDCA) was signed into law. MOCRA's provisions (detailed below), including its addition of new Sections 604-614 to subchapter VI of the FDCA, significantly expand the scope of FDA’s oversight and add additional compliance requirements for businesses. Stakeholders in the cosmetics industry should pay close attention to these new developments and prepare for these changes to take effect starting in December 2023, one year after MOCRA’s passage. 

New Reporting Requirements for Businesses

Under MOCRA, the cosmetics industry must now report additional information about a cosmetic product's manufacturing, formulation, and use to FDA. Pursuant to these new reporting requirements, the business deemed to be the "responsible person" for any given cosmetic product—i.e., "the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label"—must:

• Register each facility that manufactures a cosmetic product for US distribution (FDCA Section 607), and renew each registration every two years. Businesses have one year to register existing facilities, while new facilities must be registered either 60 days after they start manufacturing cosmetics or 60 days after the existing facility deadline—whichever falls later. Notably, MOCRA exempts facilities that merely label, package, hold, or distribute cosmetics products, facilities that manufacture ingredients but not final products, and facilities used solely for product research and evaluation purposes.
• Submit to FDA annual cosmetic product listings that disclose key product information (including ingredients and manufacturer information) (FDCA Section 607). The listing must also include any fragrances, flavors, or colors within the product. Businesses must submit product listings for all existing products by December 2023, and submit listings for new products within 120 days of commencing marketing.
• Track and report adverse events associated with its cosmetic products (FDCA Section 605). Similar to existing requirements for certain drugs and supplements, businesses must now maintain records for any adverse health event for six years (shortened to three for small businesses) and report serious adverse events to FDA within 15 days of learning about the issue. For the year following an initial report of a serious adverse event, businesses must also update FDA with any new and material information they learn. MOCRA takes an expansive view of "serious adverse effect" and covers infections, "significant disfigurement" (e.g. serious and/or persistent rashes and burns), significant hair loss, and other "persistent" or "significant" changes to the user’s appearance.

New Product Labeling Requirements for Businesses

With the addition of Section 609 to the FDCA, MOCRA adds three additional product labeling requirements for responsible entities, who now must: 

• Specify a point of contact for consumers (FDCA Section 609(a)). To facilitate the adverse event tracking and reporting discussed above, businesses must update cosmetic product labels within two years to include the contact information for consumers to report any adverse events. Businesses may choose to list a US address, US phone number, and/or electronic contact information or an interactive website as this point of contact.
• Disclose fragrance allergens (FDCA Section 609(b)). Cosmetic product labels must now identify each and every fragrance allergen within the product. As discussed further below, FDA is to issue a regulation with a list identifying these allergens within 18 months of MOCRA's passage.
• Distinguish products intended for professional use (FDCA Section 609(c)). Now, cosmetic products intended for use by licensed professionals (i.e., estheticians, cosmetologists, nail and hair salons, etc.) must be clearly labeled as such. Product labels for these professional products must also include the additional contact information, and fragrance allergen information discussed above.

New Substantiation Requirements for Businesses

While the cosmetics industry is already subject to a variety of consumer protection and false advertising laws that, broadly speaking, require substantiation for any product labeling or advertising claim (including, in many cases the implied or explicit claim that a cosmetic product is safe for use), MOCRA updates the FDCA to specifically require responsible persons to:

• Maintain robust safety substantiation evidence (FDCA Section 608). Businesses must maintain robust records, including tests, analyses, research, and other evidence sufficient to demonstrate to a "reasonable certainty" that a cosmetic product is safe. 

Forthcoming FDA Rulemaking Imposing Additional New Requirements

In addition to the new requirements discussed above, MOCRA also directs FDA to issue several regulations that will further increase compliance requirements for the cosmetics industry. Specifically, FDA must promulgate additional regulations establishing new:

• Good Manufacturing Practices (GMPs) (FDCA Section 606). FDA is required under the new law to issue regulations establishing GMP requirements for facilities that manufacture cosmetics. The new GMP regulations also may authorize FDA to inspect records related to GMPs during inspections. Notably, MOCRA requires FDA to "consult" with key stakeholders in the cosmetics industry, including manufacturers, as part of the rulemaking process—providing businesses an opportunity to help shape the, likely significant, GMP rules before FDA's December 2024, deadline to publish a proposed rule (i.e., two years from MOCRA’s passage) and the December 2025, deadline to issue the final version (i.e., three years from MOCRA’s passage).
• Requirements related to the fragrance allergen disclosure (FDCA Section 609(b)). MOCRA directs FDA to issue a regulation that will enable businesses to comply with the fragrance allergen labeling requirement discussed above. Specifically, by the end of June 2024 (i.e. 18 months from the MOCRA's passage), FDA must issue a proposed rule that includes a list of fragrance allergens, and then issue its final regulation no later than 180 days after the close of a public comment period. Notably, MOCRA specifically directs FDA to consider European Union (EU) and other international, state, and local allergen requirements in crafting this rule—perhaps providing some foreshadowing of FDA's eventual course in advance of the formal rulemaking process.
• Requirements related to talc-containing cosmetics (MOCRA Section 3505). By December 2023, FDA must issue a proposed rule to establish and require standardized testing methods for detecting and identifying asbestos in talc-containing cosmetic products, and must finalize the rule 180 days thereafter.

MOCRA also identifies perfluoroalkyl and polyfluoroalkyl substances (PFAS) and animal testing as two additional areas of focus for FDA in the cosmetic arena. But importantly, MOCRA confirms federal interest in but stops short of directing the Agency to impose additional regulatory requirements for these issues:

• PFAS in cosmetics (MOCRA Section 3506). MOCRA requires FDA to publish a report within three years that assesses the use of PFAS in cosmetic products and the safety of PFAS used in cosmetic products.
• Animal testing (MOCRA Section 3507). Although the new law does not ban the use of animals in testing the safety of cosmetic products, it articulates Congress' view discouraging the use of such activities and recommends they be phased out.

Newly Expanded FDA Authority

In addition to the increased compliance requirements it imposes on the cosmetics industry, MOCRA also expands FDA’s oversight into cosmetic products and provides the Agency with several powerful new tools for effectuating its new authority. Specifically, FDA gained the power to: 

• Issue mandatory recalls (FDCA Section 611). FDA may now issue mandatory recalls if it determines that a cosmetic is either adulterated under Section 602 or misbranded under Section 601 of the FDCA, and that a reasonable probability exists that the use and/or exposure to the product will cause serious adverse consequences or death.
• Access records (FDCA Section 610). FDA may now access a company's records related to a cosmetic product if the Agency reasonably believes the product and/or its ingredients are adulterated such that they present a risk of serious adverse health consequences or death. The Agency also may now request a list of ingredients in a product’s fragrance or flavor if it believes these components contributed to a consumer’s serious adverse event, and access records as needed to enforce the GMP rules, adverse event reporting rules, and other new business compliance requirements detailed above. Notably, this new records access authority does not provide limitless discovery—records related to formulas/recipes, financial data (including pricing, sales, and employees), and research data unrelated to safety substantiation remain out of reach.
• Suspend facilities (FDCA Section 607). Under MOCRA's new updates to the FDCA, FDA can suspend the registration of any facility that manufactures cosmetic products if the Agency determines that there is a reasonable probability that a product manufactured at that facility caused a serious adverse effect and that other products manufactured at that site may do the same. This suspension carries serious consequences for a business, as products from the impacted facility may not be introduced into the market until the facility's registration is reinstated.

Other Important Provisions

MOCRA also includes a number of other important provisions that will significantly impact businesses and the way the new provisions are enforced:

• Preemption (FDCA Section 614). Importantly, the new law provides for express preemption of any state or local laws that are not identical to any requirement discussed above regarding registration and product listing, GMPs, records, recalls, adverse event reporting, or safety substantiation.
• Key exemptions for products regulated as both drugs and cosmetics (FDCA Section 613). Specifically, a cosmetic product or facility that is subject to FDCA provisions for products regulated as drugs is exempt from the new MOCRA requirements relating to adverse event reporting, GMPs, facility registration and product ingredient listing, safety substantiation, and contact information labeling, as well as FDA’s new records access and mandatory recall authority. However, these products must still comply with the new fragrance allergen and professional use labeling requirements discussed above.
• Flexibility for small businesses (FDCA Sections 612). Businesses with average gross annual sales in the United States of cosmetic products for the previous 3-year period of less than $1,000,000 are considered small businesses and are exempt from the GMP regulations to be issued under Section 606 and the registration and product listing requirements under Section 607. Elsewhere within the Act, MOCRA also provides for enhanced regulatory compliance flexibility for smaller businesses when enforcing many of the new requirements.

Key Takeaways

Stakeholders in the cosmetics industry will need to devote significant resources to ensure compliance with the new requirements imposed in MOCRA. While many of these requirements will be particularly impactful for entities who meet the "responsible person" definition discussed above, the law will, in general, significantly change the way cosmetics are regulated, and its impact will be felt by everyone, from cosmetic ingredient suppliers to retailers. Moving forward, stakeholders should keep a close watch on FDA’s efforts to establish regulations to enforce the various provisions of the new law, and also should be sure to participate in those rulemakings when necessary. 

Steptoe & Johnson LLP is well-versed in the new requirements imposed under MOCRA, and will be closely monitoring FDA's activities in this arena moving forward. Please contact us with any questions.