The Cosmetics Law You Probably Missed Is Already Sitting in Your Bathroom Cabinet

If you click on links we provide, we may receive compensation.

You can flip over a box of crackers and learn almost everything about it. Calories, sugar, a bold allergy warning, the name of the company that made it. Then you flip over a face cream, and the story gets thinner. There is a long ingredient list, a word like “fragrance” that could mean almost anything, and maybe a small address in tiny print. Most of us assume someone in government looked at that jar before it reached the shelf. For most of the last century, nobody had to!

That changed when Congress passed the Modernization of Cosmetics Regulation Act, usually shortened to MoCRA, in December 2022. Before it, a cosmetics company in the U.S. did not have to register with the FDA, tell the agency what it sold, or report when a customer ended up in an emergency room. The FDA could not even order a recall. It could only ask. The agency now calls MoCRA the largest expansion of its cosmetics authority since the Food, Drug, and Cosmetic Act passed in 1938. Source: https://www.fda.gov/cosmetics/cosmetics-laws-regulations/modernization-cosmetics-regulation-act-2022-mocra. Most shoppers have never heard of it, and that makes sense. Nothing about the law changed how a jar looks on the shelf. But it changed a lot about what happens behind that jar, and a few of the biggest changes are still on the way.

Here is one number that shows the scale. Under the old voluntary system, the FDA had 5,176 registered cosmetic establishments and 35,102 product filings. Today, with registration mandatory, the agency reports more than 15,000 active facility registrations and over 1 million active product listings. Source: https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/fda-signals-increased-cosmetics-oversight-through-mocra-implementation-and-other-regulatory-efforts. That gap tells you how much of the market was simply invisible to regulators before. I find that a little unsettling. It also tells you why this law matters to anyone who buys skincare, even if you never read a word of federal regulation.

What was the old system really like?

Before MoCRA, cosmetics regulation in the U.S. ran mostly on trust. Brands were legally responsible for making sure their products were safe, but nobody checked that work in advance. There was no required registration, no required ingredient filing, and no required reporting of injuries. The FDA ran a Voluntary Cosmetic Registration Program starting in 1972, and as the name says, companies could ignore it. Many large companies did.

The agency’s main tools were after-the-fact. It could inspect a facility, send a warning letter, or go to court to seize products. But it often found problems only when consumers complained or journalists dug something up. And because no one had to report adverse reactions, the FDA rarely had a clear picture of which products were causing harm. That’s a strange way to oversee something people rub into their skin twice a day. The average adult uses about 12 personal care products daily, according to a 2025 letter from members of Congress to the FDA Commissioner. Source: https://schakowsky.house.gov/sites/evo-subsites/schakowsky.house.gov/files/evo-media-document/modernization-of-cosmetic-regulation-act-rule-delays_final.pdf.

Meanwhile, other markets moved ahead. The European Union has required safety assessments, product notification, and manufacturing standards for years. It has banned or restricted well over a thousand substances in cosmetics. The U.S. had prohibited only a small handful. So the American system was not just looser. It was a different philosophy altogether, one that assumed brands would do the right thing and stepped in only when they clearly didn’t.

What does MoCRA require brands to do right now?

Several requirements are already in force. The first is facility registration. Any facility that manufactures or processes cosmetics sold in the U.S. must register with the FDA and renew every two years. The second is product listing. The company responsible for each product, called the “responsible person” in the law, must list it with the FDA, including its ingredients and where it’s made, and update that listing every year. The FDA began enforcing both requirements on July 1, 2024. Source: https://diaztradelaw.com/fda-update-increased-cosmetics-oversight-under-mocra/.

The third requirement gets less attention but matters more to you. Companies must now keep records showing that each product is safe to use as directed. The law calls this safety substantiation. It means a brand should be able to show the FDA why it believes a formula is safe, based on testing, published research, or ingredient safety data. Before MoCRA, that duty existed in a vague way. Now it’s spelled out, and the FDA has new authority to look at those records.

There is a catch, and I think shoppers deserve to hear it. MoCRA does not create premarket approval for cosmetics. The FDA still does not review or approve your serum before it goes on sale. Color additives are the main exception, and that was true long before this law. So when you see a brand bragging that its product is “FDA registered,” be careful. Registration is a paperwork requirement that every legitimate facility must meet. It’s not an endorsement. It says nothing about whether a product works.

What happens now if a product hurts someone?

This is where MoCRA makes its biggest practical difference. Companies must now report serious adverse events to the FDA within 15 business days of learning about them. A serious adverse event includes things like hospitalization, significant disfigurement, persistent rashes or infections, and hair loss beyond what was expected. Companies must also keep records of adverse event reports for six years, or three years for qualifying small businesses. Before this law, none of that was required.

To make reporting possible, every cosmetic label must now include a domestic address, phone number, or website where consumers can report problems. Take a look at a product you bought this year. You will probably find that contact line on the back. It’s easy to overlook, but it exists because of MoCRA, and it gives you a direct path to the company that has a legal duty to pass serious reports along.

The law also gave the FDA two new enforcement tools. One is mandatory recall authority. If there is a reasonable probability that a cosmetic is adulterated or misbranded and could cause serious health consequences or death, the FDA can now order a recall after giving the company a chance to do it voluntarily. The FDA published draft guidance in December 2025 explaining how it plans to use that power. Source: https://www.bipc.com/cosmetics-industry-update-whats-new-with-mocra. The other tool is records access, which lets inspectors review a company’s safety and manufacturing records in certain situations. And the FDA can suspend a facility’s registration if its products pose a serious risk, which effectively stops that facility from selling into the U.S. market.

Which promises in the law haven’t arrived yet?

Here is the part most coverage skips. Congress gave the FDA deadlines to write several new rules, and the agency has missed most of them. The two that would matter most to shoppers are still unfinished. The first is a rule requiring brands to list specific fragrance allergens on labels. The second is a set of good manufacturing practice rules, often called GMPs, that would set baseline standards for how cosmetics are made, tested, and stored.

The law required a proposed fragrance allergen rule by June 29, 2024. It required a proposed GMP rule by December 29, 2024, and a final GMP rule by December 29, 2025. Neither has happened. The FDA’s latest regulatory agenda lists GMPs as a “long-term action” with no proposed date at all. Source: https://www.crowell.com/en/insights/client-alerts/cosmetics-under-the-microscope-fdas-expanding-regulatory-reach-under-mocra. That means there is still no federal standard for cleanliness, batch testing, or quality control specific to cosmetic facilities. Many reputable manufacturers follow the international ISO 22716 standard voluntarily. But nobody makes them, and that matters.

Other pieces are moving slowly too. The FDA proposed a rule in December 2024 requiring standardized asbestos testing for talc-based cosmetics, then later withdrew it, citing technical concerns. The law still requires a talc rule, so a new version is expected, but there is no timeline. The agency’s 2026 agenda also targets November 2026 for a proposed ban on formaldehyde and formaldehyde-releasing chemicals in hair smoothing and straightening products. Source: https://www.certifiedcosmetics.com/blog/regulatory-news/fda-proposes-new-cosmetic-rules-on-formaldehyde-and-fragrance-allergens/. Agenda dates are targets, not promises, and this one has slipped several times already.

Why does the fragrance allergen rule matter so much?

Right now, a U.S. label can list an entire fragrance blend as a single word, “fragrance” or “parfum.” That one word can stand in for dozens of individual chemicals. Some of those chemicals are well-known allergens, such as linalool, limonene, geraniol, and certain compounds found in oakmoss. If you react to one of them, the current label gives you no way to know whether it’s in the bottle. You end up avoiding fragrance entirely or guessing.

Europe solved part of this problem more than 20 years ago. Since 2003, EU rules have required 26 specific fragrance allergens to be named on the label when they appear above set thresholds. Source: https://the-ethos.co/us-fragrance-ingredients-mocra/. In 2023, the EU expanded that list to roughly 80 substances, with deadlines that phase in through 2028. Canada began requiring individual fragrance allergen disclosure in 2026 as well. The U.S. is now the outlier among major markets.

MoCRA tells the FDA to create its own list of fragrance allergens that must be disclosed. As of this month, no proposed rule has been published, and the agency’s current target is November 2026. Even after a proposal comes out, there will be a public comment period, then a final rule, then a compliance window for brands to change their labels. Realistically, you are unlikely to see new allergen lines on U.S. labels before 2028. And even then, the rest of the fragrance formula can still sit behind the word “fragrance.” The rule will help. It will not make fragrance fully transparent.

Are small brands treated differently?

Yes, and this is worth knowing if you like indie or handmade skincare. MoCRA exempts many small businesses from registration, product listing, and the future GMP rules. A company generally qualifies if its average U.S. cosmetics sales over the prior three years are under $1 million, adjusted for inflation. Congress did this so that a soap maker selling at a farmers market would not need a regulatory team.

The exemption has limits. It does not apply to certain higher-risk products, including those that regularly touch the eye area, products that are injected or meant for internal use, and products designed to change appearance for more than 24 hours when the consumer is not expected to remove them. Small businesses also still have to keep safety substantiation records, report serious adverse events, and put contact information on the label. So the core safety duties apply to almost everyone. What the small business gets is relief from paperwork, not from responsibility.

For shoppers, this cuts both ways. Many small makers are careful and talented, and some formulate more cleanly than big brands do. But they may not appear in the FDA’s listing data, and until GMP rules exist, there is no federal manufacturing benchmark for anyone. If a small brand matters to you, it’s fair to ask how they test for stability and contamination. A good maker will be glad you asked.

What does any of this mean for mature and sensitive skin?

If you are over 50, these rules may matter more to you than to anyone else in the store. Skin changes with age in ways that make reactions more likely and recovery slower. The outer layer gets thinner. Oil production drops, especially after menopause. The barrier loses some of its lipids and holds water less well. That means irritants and allergens can get through more easily, and a rash that might have cleared in a few days at 30 can drag on for weeks at 65.

Fragrance is one of the most common causes of allergic contact dermatitis from cosmetics, and sensitization tends to build with repeated exposure over the years. Someone who wore a scented moisturizer for decades without trouble can suddenly start reacting to it. That is exactly the situation where an itemized allergen label would help, and exactly where U.S. labels still fall short. Until the fragrance rule arrives, people with reactive or mature skin are better served by fragrance-free formulas than by “unscented” ones, which can contain masking fragrance to cover the smell of raw ingredients.

The adverse event rules also matter here. Older adults are more likely to use several active products at once, often a retinoid, a vitamin C serum, an exfoliating acid, and a prescription cream. When a reaction happens, it can be hard to tell which product caused it. Now, when you report a serious reaction to the brand, that company has a legal duty to evaluate it and, if it qualifies, send it to the FDA. Those reports are how regulators spot patterns. A single complaint can feel like it disappears. A hundred similar complaints get attention.

There is a practical side for caregivers too. If you help an aging parent manage their skincare, keep the packaging of anything new until you know it agrees with them. The contact line on the label and the lot number on the bottle are what make a report useful. Without them, a reaction becomes a story instead of a data point.

How can you use these rules when you shop?

Start with the label. Look for the U.S. contact information MoCRA now requires. A product sold in the U.S. without any domestic address, phone number, or website on its label is a red flag, especially from online marketplaces where counterfeit and gray-market goods are common. Check that the ingredient list is complete and readable. And treat “FDA registered” or “FDA approved” claims on a cosmetic with skepticism. The first is a legal minimum, and the second is usually false.

Next, keep records when you try something new. Snap a photo of the label and the batch or lot code. Write down the date you started using it. If your skin reacts, stop using the product and photograph the reaction. These small steps take a minute and make any report far more useful to the brand and to the FDA.

If you have a reaction, report it. You can contact the company using the information on the label. You can also report directly to the FDA through MedWatch at https://www.fda.gov/safety/medwatch-fda-safety-information-and-adverse-event-reporting-program. You do not need a doctor to file, though it helps to see one if the reaction is severe. And if a reaction involves trouble breathing, swelling of the face or throat, or a spreading rash with fever, skip the paperwork and get medical care first.

Finally, set your expectations honestly. MoCRA did not make every product on the shelf safer overnight. What it did was give regulators eyes on the market, a duty for brands to prove safety, and a working system for reporting harm. The labeling and manufacturing pieces that shoppers would notice are still in progress. I would rather you know that than assume the government has already checked your face cream. It hasn’t. But the rules are moving in the right direction, and your reports help push them along.

Frequently Asked Questions

Does the FDA approve cosmetics before they are sold?

No. MoCRA did not create premarket approval for cosmetics. The FDA does not review or approve most skincare products before they reach store shelves. Color additives are the main exception and have their own approval process. Brands are legally responsible for making sure products are safe and must now keep records proving it.

Is “FDA registered” a sign of quality?

Not really. Registration is a legal requirement for cosmetic facilities that do not qualify for the small business exemption. It shows a company is following the law, which is good, but it says nothing about how well a product works or how gentle it is. A product claiming to be “FDA approved” is usually misusing the term.

When will fragrance allergens appear on U.S. labels?

There is no firm date. The FDA’s current target for a proposed rule is November 2026, after missing the original 2024 deadline. A final rule and a compliance period would follow, so most shoppers should not expect new allergen labeling until 2028 or later. Fragrance-free products remain the safest choice for reactive skin in the meantime.

How do I report a bad reaction to a skincare product?

Contact the company using the phone number, address, or website on the label, which MoCRA now requires. You can also report directly to the FDA through its MedWatch program. Keep the packaging and note the lot number. Seek medical care first if the reaction is severe.

Do these rules apply to products I buy online from other countries?

Products sold in the U.S. must meet MoCRA requirements regardless of where they are made, and foreign facilities must register too. But enforcement is harder with direct overseas shipping and third-party sellers. Buying from the brand’s own site or an authorized retailer lowers your risk of getting counterfeit or improperly stored products.

Are natural or organic products covered by MoCRA?

Yes. MoCRA applies to cosmetics regardless of whether they are marketed as natural, organic, or clean. Those marketing terms are not defined by the FDA for cosmetics. A plant-based product has the same safety substantiation and adverse event duties as any other.

Laws like this rarely make headlines, and this one didn’t. But it quietly changed who is watching the products you use every day, and it gave you a voice in that process. Read the back of the bottle. Keep the box until you know a product works for you. And if something goes wrong, say so. The system finally has a place to put that information.