The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) creates federal standards for cosmetic products registration, product listing, good manufacturing practice, recordkeeping, recalls, adverse event reporting and safety substantiation. States and local governments are precluded under MoCRA from enacting, implementing, or enforcing requirements for cosmetics that are different from MoCRA’s requirements, with two exceptions: states may prohibit the use of or limit the amount of an ingredient in cosmetic products under state law, and may continue to enforce reporting requirements such as California’s Proposition 65 that were in existence prior to MoCRA’s passage. See Section 614(a)-(b). MoCRA also does not provide federal preemption protection for state law failure to warn or personal injury claims.

For years, industry and congressional analysts have predicted the imminent passage of federal legislation mandating adverse event reporting and other regulatory oversight for cosmetic products without actual legislative action coming to pass. Now that the regulatory scheme has changed, and there is a window for industry to come into compliance, it is important to consider not only the obligations imposed by MoCRA, but also the potential new risks of both noncompliance and future litigation. While MoCRA is not intended to provide new or additional litigation defenses to cosmetics industry members, it may provide new opportunities to be exploited by plaintiffs in personal injury, products liability and consumer litigation against the industry. As often occurs with other FDA-regulated products, FDA reporting and manufacturing requirements provide fertile ground in discovery to explore potential non-compliance and may also serve as the basis for negligence per se and other similar claims. And given the importance that adverse event reports play in drug and device litigation presently, best practices should include considering future discovery and litigation risks when creating the architecture, processes and documentation to be utilized in complying with these requirements, as well as discovering, documenting and remedying instances of non-compliance. This Alert will focus on ways that the new FDA requirements may impact future litigation risk. For information on what the new law requires from industry members, please see GT’s Health Care & FDA Practice’s Alert.

I. Registration and Product Listings (MoCRA Section 607)

Section 607 requires cosmetic companies to register their facilities and submit product listings to FDA. It also requires the Responsible Person (i.e., a “manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with section 609(a) of the [FDCA] or section 4(a) of the Fair Packaging and Labeling Act;” (see Section 604(4)) to submit to FDA the cosmetic product’s listing, including the ingredients of any fragrances or flavors. Additionally, Section 607 provides that FDA may suspend a facility’s registration if FDA (1) determines that a cosmetic product manufactured or processed by that facility has “a reasonable probability of causing serious adverse health consequences or death to humans,” and (2) has a “reasonable belief that other products manufactured or processed by the facility may be similarly affected” because the failure cannot be isolated to a product or products or the failure is sufficiently pervasive to raise concerns about other products manufactured in the facility. See Section 607(f).

Failure to accurately or compliantly list all ingredients in a cosmetic product already is fertile ground for litigation even now without these new requirements in effect, but once such registration becomes mandatory under the law, any manufacturer that is cited or suspended by FDA for failure to comply with these requirements may invite both consumer fraud litigation and products liability litigation to the extent the ingredient that was not disclosed is alleged to have caused an injury. Given the requirement that cosmetic manufacturers, packers, and distributors submit their product listings to FDA, any such ingredient listings are also subject to public disclosure through a Freedom of Information Act (FOIA) request. The only way to avoid disclosure is to request “trade secret” status of the ingredient listing from FDA, see 21 CFR § 720.8, but defendants should not exclusively rely on this course of action, given that in the past 20 years, FDA has received only a handful of trade secret requests and to our knowledge has only granted such a request once. The public disclosure of a company’s ingredient listing may also impact the viability of an argument in discovery in underlying litigation involving that the product’s ingredient information constitutes trade secrets that may be kept confidential under the terms of a stipulated Protective Order. It is therefore important to monitor FOIA requests for information about your company’s products and to take action if FOIA requests or other public disclosure threatens the continued confidentiality of such information.

II. Safety Substantiation (MoCRA Section 608)

Section 608 requires manufacturers to maintain records demonstrating adequate substantiation of the safety of a cosmetic product, such as reputable “tests or studies, research, analyses, or other evidence or information… sufficient to support a reasonable certainty that a cosmetic product is safe.” See Section 608(c)(1). Under MoCRA, “safe” is defined as “not injurious to users under the conditions of use prescribed in the labeling thereof, or under such conditions of use as are customary or usual,” and FDA may consider the “cumulative or other relevant exposure” to the product. See Section 608(c)(2). However, “a cosmetic product or ingredient is not injurious to users solely because it can cause minor and transient reactions or minor and transient skin irritations in some users.” Id. (emphasis supplied). This is an important clarification given the most common adverse events associated with cosmetics generally are hypersensitivity reactions and skin irritations, which are highly individualized to each user’s idiosyncratic sensitivities.

If a manufacturer fails to maintain the required documentation to show adequate substantiation of safety for a cosmetic product and later receives an adverse event report or a lawsuit involving said product, enterprising plaintiffs’ counsel may use the non-substantiation of product safety and non-compliance with this requirement to argue the manufacturer failed to perform the required and reasonable tests, studies, research, or analysis to ensure the product is safe as was required by MoCRA. These same plaintiffs may then argue that the product is unreasonably dangerous or not as safe as the expectation of an ordinary consumer – the two most-used tests for products liability design defect claims – and may also argue that failure to substantiate the product’s safety as required by law establishes negligence per se as well.

Even those manufacturers who do submit safety substantiation data may expect plaintiffs’ attorneys to hire experts to poke holes in the submissions and argue that they did not provide a “reasonable certainty” of product safety, or that the tests selected by the manufacturer were not sufficiently sensitive or appropriate to detect the product’s risks. Plaintiffs in litigation may also argue that a reasonable manufacturer is continually studying product safety and updating their test methods and data as new technology becomes available, as they frequently argue with respect to pharmaceutical and medical device testing and analysis. Much like the claim substantiation process and safety risk assessment processes used for these and other FDA-regulated products, manufacturers should be prepared not only to demonstrate the safety of their products but also to defend their data and test methods upon which they rely to substantiate product safety. Careful documentation of the reasons for selecting certain test methods or relying on particular criteria will assist with later defending the reasonableness of such decisions.

The bottom line as to Section 608 is that FDA’s standard for what is “safe” and what constitutes sufficient substantiation of safety both leave a fair amount of discretion to manufacturers conducting the safety testing, and their exercise of that discretion is certain to be second-guessed in the event of future litigation. In anticipation of the implementation of MoCRA, manufacturers may wish to revisit their policies and procedures for product safety testing and their documentation of compliance with those policies and procedures.

III. Good Manufacturing Practice (MoCRA Section 606)

Section 606 of MoCRA requires FDA to promulgate good manufacturing practice (GMP) regulations for cosmetics manufacturing and processing facilities with the intention of protecting the public health and ensuring that cosmetic products distributed in the United States are not adulterated. See Section 606(a). Previously, FDA did not provide a standard set of GMP regulations for manufacturers of cosmetic products, instead promulgating only a GMP Guidelines/Inspection Checklist, which provided a framework for cosmetic manufacturers to effectuate their own self-inspection of their manufacturing practices. Although it may be some time (a maximum of three years, to be exact; see Section 606(c)) before FDA publishes the GMP regulations for cosmetic products, the November 2018 FDA Draft Guidance for Industry for Cosmetic Good Manufacturing Practices likely provides a good estimation of what they may look like. In developing this guidance, FDA incorporated elements from the International Organization for Standardization’s standard for cosmetic GMPs (ISO 22716:2007). It may therefore be useful to track any developments in ISO 22716:2007 going forward because these will likely form the basis of any GMPs promulgated by FDA.

A potential legal risk with these new cosmetics GMPs is that plaintiffs’ attorneys may attempt to use a manufacturer’s alleged violation of a GMP as evidence of a purported manufacturing defect. Indeed, plaintiffs across the country already use this tactic in products liability litigation for medical devices to assert claims that survive initial motions to dismiss and reach the discovery stage, where they can more fully explore whether there were, in fact, meaningful “violations” of GMPs that actually impacted the user’s specific product. Any GMPs established by FDA under the anticipated MoCRA will need to be sufficiently generic to allow them to be used for the many different types of cosmetics products they will regulate, and likely cannot specify how a particular manufacturer must produce a particular product. Defense counsel should therefore be prepared to demonstrate that the inherently general nature of these GMPs precludes their use as de facto evidence of a manufacturing defect or negligence.¹

Also, manufacturers and counsel should keep in mind that just because a product is “deemed to be adulterated” due to a GMP violation under MoCRA, this does not mean that there was actually something wrong or improper with the product, let alone that the product was defective. Many GMP regulations relate to processes and procedures rather than the condition of the finished product itself.² While plaintiffs in litigation may try to equate a GMP violation and adulteration finding with slam dunk proof of a defect, manufacturers should familiarize themselves with the abundant case law holding otherwise.

IV. Adverse Event Reporting (MoCRA Section 605)

Section 605 of MoCRA requires a “responsible person to maintain records of health-related adverse events associated with the use of its product for six years (or three years for small businesses), and to report to FDA any serious adverse events within 15 business days of learning about the event. See Section 605. Among other things, it broadens the definition of “serious adverse event” to include not only major injuries and illnesses but also infections and requires the submission of any new and material medical information related to a serious adverse event report within 15 business days of receipt. MoCRA also authorizes FDA to request in writing a list of the specific fragrances or flavors in a cosmetic product that FDA has reasonable grounds to believe contributed to a reported serious adverse event.

This section presents several new potential litigation risks and considerations for cosmetics manufacturers. First, federal law has long required pharmaceutical and medical device manufacturers to collect, assess and timely report adverse events under complex regulatory schemes for those product types, and FDA has also undertaken enforcement activity against drug and device companies for failure to meet their adverse event assessment and reporting obligations. In turn, plaintiffs in litigation involving products for which adverse event reporting is required have found manufacturer defendants’ procedures, compliance, and timeliness of adverse event reporting to not only be fertile ground for discovery purposes but also in a handful of states have persuaded courts to recognize failure to warn claims premised upon a failure to timely report adverse events.³ Once cosmetics manufacturers are required to similarly collect, assess and report serious adverse events on a narrow timetable, state common law tort claims that incorporate federal adverse event reporting requirements may also be available against cosmetics manufacturers in those states. Plaintiffs may attempt to argue the same failure to warn claims in the cosmetics space by alleging that the defendant-manufacturer’s alleged failure to timely report an adverse event, as required under MoCRA, violated the legal requirements, resulted in the product continuing to be sold to consumers including the plaintiff and without warnings of a particular risk, and thereby contributed to a particular user’s injury. This places considerable emphasis on the careful creation of a process, system and plan for adverse event reporting to the company, assessment within the company, and reporting to FDA so that companies avoid both creating discovery nightmares for themselves in future litigation but also additional arguments from plaintiffs about the impact of untimely reporting on consumer safety.

Second, with MoCRA now including standalone “infections” within the definition of a “serious adverse event,” this increases the likelihood that plaintiffs may seek to hold manufacturers liable for allegedly failing to timely report infection complaints, despite the recognition elsewhere in MoCRA of the potential for “minor and transient reactions or minor and transient skin irritations” as events that will occur and do not alter the safety profile of a cosmetic product or ingredient. See Section 608(c)(2). Given the ambiguity these two provisions create, manufacturers faced with an adverse event involving symptoms that could be consistent with an infection or with a skin reaction may need to decide to err on the side of caution in whether to report the claim within 15 business days. Within that time period, to the extent practicable, manufacturers’ product surveillance teams may consider information about how long the alleged infection persisted, whether the user had previously experienced similar reactions, the severity of the reaction, whether there were long-term sequelae, and whether surgery or hospitalization occurred. While these factors may allow a company to reasonably decide an event is merely a sensitivity reaction rather than an infection that must be reported within 15 business days, it may not be possible to obtain enough information to make this call within the reporting period, and a risk-averse company may prefer to simply report despite lingering ambiguity. In these scenarios, as well as more obvious serious adverse events, careful training of the product surveillance team and development of documentation policies and procedures will be key so that events are described in the reporting to FDA in a way that will not impede the later litigation defense in a particular lawsuit. Manufacturers also should keep in mind that while reported adverse event data is already publicly available via the CAERS database, this new imposition of a mandatory reporting requirement will increase both the publicly available injury data for cosmetics products but also reliance upon such data by plaintiffs’ attorneys.

Third, a defendant-manufacturer’s compliance with Section 605 requirements will likely be fertile ground for plaintiffs’ counsel during the course of discovery in litigation, particularly if other users previously reported similar injuries or reactions with the same cosmetic products. This increases the importance of manufacturers assessing now, as they prepare to comply with the new requirements, whether their current process for handling consumer complaints can be improved, because plaintiffs will surely inquire in discovery as to how complaints were handled, categorized, and when they were submitted to FDA as adverse event reports. That said, MoCRA precludes plaintiffs from using the submission of reports as evidence of an admission that a particular cosmetic product caused or contributed to a particular adverse event. See Section 605(h)(4). This otherwise helpful language unfortunately may not preclude their use for other purposes such as notice to the company of a risk, an increase of other substantially similar incidents suggesting a potential lot-focused or developing safety signal, or the reasonableness of product warnings.

V. Recalls (MoCRA Section 611)

Section 611 of the MoCRA authorizes FDA to request a voluntary recall of a cosmetic product if the agency determines that there is a reasonable probability that the product is adulterated or misbranded within the meaning of Sections 601 (“Adulterated cosmetics”) and 602 (“Misbranded cosmetics”) of the FDCA “and the use of or exposure to such cosmetic will cause serious adverse health consequences or death.” If the responsible person does not comply with that request, FDA may order a mandatory recall (subject to requirements for an informal hearing). Whether truly voluntary or not, recalls do leave manufacturers vulnerable to products liability and negligence claims by plaintiffs who will point to the recall as evidence that the product was too unsafe to continue selling—even though a recall is not necessarily indicative of any defect. Expansion of FDA’s powers with respect to cosmetics recalls is likely to lead to more recalls, which in turn often prompt immediate litigation. This cycle is likely to continue.

VI. Post-MoCRA Considerations for Cosmetics Companies and Related Entities

The enactment of MoCRA should help to create national standards for cosmetic companies that allow them to comply with uniform requirements, rather than a patchwork of individual state mandates. However, because states retain the power to regulate the use of ingredients (and to enforce their existing reporting requirements), cosmetic companies will still need to comply with those state-specific laws, statutes, and regulations in addition to MoCRA. Cosmetic companies may also now be vulnerable to civil litigation from plaintiffs who will attempt to use alleged non-compliance with MoCRA as the basis for their claims.

As cosmetics companies work to implement MoCRA’s requirements, companies should consider working with outside counsel who understand not only the regulatory requirements, but also the practical implications for complex litigation to best protect the company in this new environment. Considerations which may help protect cosmetics manufacturers against future litigation may include:

• Careful creation of not only processes and procedures for implementing all MoCRA requirements but also training of employees on the importance of compliance and the dangers of non-compliance, as well as careful documentation practices;

• Timely and complete registration and product listing disclosures to FDA;

• Review of safety substantiation tests and data sources for each product to ensure they are scientifically supported and can be defended, including the test methods utilized themselves in addition to their results;

• Updating or establishing new Standard Operating Procedures to ensure compliance with forthcoming GMPs;

• Updating policies and procedures for customer-facing personnel to assess and document customer complaints and ensure a consistent process for complaint elevation; and

• Revising company policies and procedures for receiving, identifying, assessing, and timely reporting of adverse events, with a focus on consistent categorization of seriousness and presumed causality or possible association with the use of the product.

FOOTNOTES

¹ In re Medtronic Sprint Fidelis Leads Prods., 592 F. Supp. 2d 1147, 1157 (D. Minn. 2009) (Device GMPs “are simply too generic, standing alone, to serve as the basis for Plaintiffs’ manufacturing-defect claims.”).

² See U.S. v. Lit Drug Co., 333 F. Supp. 990, 998 (D.N.J. 1971) (“a drug may be pharmaceutically perfect in content but still be regarded as adulterated under the law” where “any manufacturing, packing or holding method does not conform to current good manufacturing practice”); U.S. v. Undetermined Quantities of Various Articles, 800 F. Supp. 499, 502 (S.D. Tex. 1992) (“[T]o prove a claim of adulteration of a device based upon noncompliance with cGMP regulations, the Government need not establish that the device is actually deficient as a result of the cGMP violation.”) (emphasis in original).

³ See, e.g., Glover v. Bausch & Lomb Inc., 43 F.4th 304, 307 (2d Cir. 2022) (following certification of question to Connecticut Supreme Court on whether state tort law recognized a claim for failure to report medical device adverse events, which was answered in the affirmative, vacating dismissal as preempted of failure to warn claims under the Connecticut Product Liability Act); Coleman v. Medtronic, Inc., 223 Cal. App. 4th 413, 429 (Cal. Ct. App. 2014) (recognizing California law duty to warn doctors and consumers of device risks by filing adverse event reports with FDA); but see, Conklin v. Medtronic, Inc., 245 Ariz. 501, 508 (Ariz. 2018) (declining to recognize a duty to submit adverse event reports to the FDA under Arizona law); Norabuena v. Medtronic, Inc., 2017 IL App (1st) 162928, ¶ 28(Ill. Ct. App. 2017) (declining to recognize a duty to submit adverse event reports under Illinois law).