As the 2022 calendar year ended, the Consolidated Appropriations Act, 2023 was signed into law by President Biden. The massive piece of legislation included the Modernization of Cosmetics Regulation Act of 2022 (MOCRA), comprising a long-awaited update to the nation’s cosmetic laws. MOCRA amends Chapter VI of the Federal Food, Drug, and Cosmetic Act (FD&C Act). As noted by one of the bill’s co-sponsors, Senator Dianne Feinstein, after its passage, it finally brings the federal government’s “oversight tools” for cosmetics and personal care products “into the 21^st century.”

Analogous to existing FD&C Act authorities and Food and Drug Administration (FDA) implementing regulations governing the manufacturing and marketing of medical products, MOCRA imposes new requirements on “responsible persons” as well as certain “facilities” that are engaged in cosmetic operations. A responsible person is defined as the “manufacturer, packer, or distributor of a cosmetic whose name appears on the label of that product,” while a facility is any establishment (including that of an importer) that manufactures or processes cosmetic products that are distributed in the United States.

It is important to remember that the FD&C Act defines a “cosmetic” broadly and captures all “articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body...for cleansing, beautifying, promoting attractiveness, or altering the appearance.” Accordingly, entities that manufacture and distribute products that may not colloquially be considered “cosmetics” (i.e., traditional make-up items) – such as perfumes, shampoos, conditioners, and other hair care products, deodorants, and body creams and other moisturizers – are included within this overhaul of the federal regulatory system, making it all the more important for consumer product businesses to assess their potential obligations under the new law. Many of the requirements that FDA will be implementing and enforcing under the MOCRA amendments are familiar to medical product manufacturers, so there are numerous and diverse resources available to help guide cosmetic firms as they analyze and come into compliance with the now-modernized federal framework.

This post summarizes some of the most expansive changes to the federal regulation of cosmetics; however, it is not comprehensive and should not be relied upon as legal advice. Affected businesses should review the entirety of MOCRA and work with regulatory counsel to ensure a thorough understanding of all sections of the new law.

Cosmetic Establishment Registration and Product Listing

All existing facilities (domestic and foreign) that engage in the manufacturing or processing of a cosmetic product for distribution in the United States must register with the FDA no later than one year after MOCRA is enacted, which was December 29, 2022. As noted above, MOCRA defines a facility as any establishment that manufactures or processes cosmetics that are distributed in the United States, but specifically excludes establishments that “solely perform” labeling, relabeling, packaging, repackaging, holding, and/or distributing cosmetic products. Several other types of entities are also expressly excluded from the definition of a facility, such as cosmetic retailers and beauty shops/salons (unless they’re engaged in manufacturing). After the initial one-year deadline for registration, new businesses subject to these requirements will have 60 days to register with FDA after beginning their manufacturing operations. Cosmetic facility registrations must be renewed every two years, as is currently required for food facilities (by contrast, drug and device establishments must renew their respective registrations with FDA every year).

MOCRA also requires responsible persons to submit cosmetic product listings to the agency no later than one year after the law’s enactment. Product listing – which again already exists for drugs, devices, biologics, and tissue products – represents the submission of product-specific information to the agency about each regulated product that is in commerce, to allow FDA to more effectively monitor the industry and track products should a quality or safety issue be identified. If a cosmetic is marketed after MOCRA is enacted, a product listing must be submitted within 120 days of placing that product into interstate commerce.

Mandatory Reporting of Serious Adverse Events

MOCRA creates new reporting requirements for “serious adverse events” that occur following the use of a cosmetic product in the United States. MOCRA defines a “serious adverse event” as an adverse health-related event associated with the use of a cosmetic product that results in:

• death;

• a life-threatening experience;

• inpatient hospitalization;

• a persistent or significant disability or incapacity;

• a congenital anomaly or birth defect;

• an infection; or

• significant disfigurement.  

The drafters of MOCRA provide examples of adverse outcomes that would fall within the last category of “significant disfigurement,” most likely because that term is not used within the existing adverse event reporting regulations for drugs, devices, and biological products (whereas most of the preceding terms are). Examples in the law of significant disfigurement that would need to be reported to FDA – many of which originate from the facts of recent nationwide cosmetic recalls and product safety investigations – include serious and persistent rashes, second-degree burns, third-degree burns, hair loss, or alteration of appearance. MOCRA also considers an adverse event to be serious if it requires surgical or medical intervention to prevent one of the above-listed outcomes, such that a responsible person must report to FDA if the adverse event requires any medical or surgical intervention to prevent any of those outcomes from occurring.

When a reportable event occurs, the responsible person must submit the report to FDA no more than fifteen business days after learning of the event. For one year following the submission of such a report to FDA, the responsible person must submit all new and material medical information it receives regarding the serious adverse event. In addition, if the agency has reasonable grounds to believe that an ingredient or a combination of ingredients in a product’s fragrance or flavor caused or contributed to the serious adverse event, it may request that the responsible person provide a list of ingredients included in the cosmetic product. The responsible person must then provide that list within 30 days of the request.

Separate from these new reporting obligations, responsible persons are generally required to maintain records related to adverse event reports for six years; certain small businesses would only be required to keep such records for three years. These recordkeeping, adverse event analysis, and mandatory reporting requirements are expected to be some of the most time-consuming and resource-intensive of the regulatory changes that members of the cosmetic industry will need to establish under the incoming MOCRA regime. Moreover, in conjunction with adverse event-related legal obligations, responsible persons are required to ensure their cosmetic product labels provide appropriate contact information for consumers to report side effects (or to update their product labels to make such contact information readily available).

Fragrance Allergen Labeling, PFAS, and Talc-Containing Cosmetics

Within the final cosmetic reform legislation, Congress also directed FDA to issue regulations designating substances that are considered “fragrance allergens.” In promulgating those regulations, the agency must consider international, state, and local requirements regarding allergen disclosure, including the European Union’s substance and format of such requirements; it is also authorized by Congress to establish threshold levels of amounts of these substances. Responsible persons would then be required to identify any fragrance allergens contained in a cosmetic product on the label pursuant to those future implementing regulations.

FDA must also promulgate regulations that establish and require standardized testing methods to be used to detect asbestos in talc-containing cosmetics. A proposed rule on this subject must be issued no later than one year after MOCRA’s enactment. In addition to the promulgation of regulations, the new law requires the agency to issue, within three years of the enactment of MOCRA, a report that assesses the use of per- and polyfluoralkyl substances (PFAS) in cosmetics, including the safety of such ingredients in cosmetics and personal care products.

The agency also has new authority from Congress to mandate, via regulation, that cosmetic facilities comply with established good manufacturing practices (GMP). FDA is expected to issue proposed rule within two years of the law’s enactment with the final GMP rule issued no later than year after that.

Mandatory Recall Authority

One of the most important public health measures that made it into the final MOCRA package is much stronger recall authority for the agency when quality or safety risks are linked to a cosmetic product. If FDA determines with reasonable probability that a cosmetic is adulterated or misbranded, and that the use or exposure to the cosmetic will cause serious adverse health consequences or death, it now has the authority to order a recall of the product (or more technically, it will have that authority upon the effective date of the majority of the MOCRA amendments, which is one year after the date of its enactment, or December 29, 2023). Before doing so, the agency must provide the responsible person the opportunity to voluntarily recall and halt distribution of the product. Moreover, when a cosmetic recall occurs – whether voluntarily initiated following the agency’s notice or done subject to an FDA mandatory recall order – the agency must ensure that a press release regarding the recall is published, and that all proper alerts and notices are issued to the public and on FDA’s website.

Under MOCRA’s amendments to the FD&C Act, the agency would also have the authority to suspend a cosmetic facility’s registration when it determines that a product made by the facility has a reasonable probability of causing serious adverse health consequences and other products may be similarly affected. A facility with a suspended registration is prohibited from placing its cosmetic products into the stream of U.S. commerce.

Preemption Clause

Importantly, MOCRA does contain a preemption clause, which prohibits states and their agencies from establishing or continuing any laws that differ from MOCRA’s laws with respect to registration and product listing, GMP, records, recalls, adverse event reporting, or safety substantiation. State or local laws limiting the use of certain ingredients in cosmetic products or banning them altogether in that jurisdiction would not be preempted by MOCRA, and certain state laws in effect as of its enactment on December 29, 2022 also would not be preempted. From a products liability litigation standpoint, the preemption language and its associated savings clause are quite significant in that they will provide private litigants on both side of disputes with potential opportunities to cite the law in their favor.

Conclusion

MOCRA has been a long time coming. Congress, as well as industry stakeholders, such as the Personal Care Products Council and the Independent Beauty Association, highlight that MOCRA is the culmination of more than a decade of negotiations and effort. Senator Feinstein notes that “the laws that govern [cosmetics and personal product] safety standards haven’t been updated in more than 80 years.” The passage of MOCRA will help to ensure the safety of cosmetic products and increase consumer trust in products that are a part of daily life.