California's Toxic-Free Cosmetics Act Is Being Enforced — What Your Lab Documentation Must Show

As of January 1, 2025, California’s AB 2762 — the Toxic-Free Cosmetics Act — made it illegal to intentionally add more than two dozen specific chemicals to cosmetics sold anywhere in the state. Fourteen months into that effective date, enforcement isn’t hypothetical anymore. State regulators are reviewing market complaints, major retailers are tightening documentation requirements, and brands that treated this law as a labeling exercise are now scrambling when a buyer or distributor asks for a testing file to back up their compliance claims.

Let me explain what the law actually requires, what the testing needs to demonstrate, and why “we reformulated” isn’t sufficient documentation on its own.

What AB 2762 Prohibits — And Why “Intentionally Added” Is a Narrower Defense Than You Think

The California Toxic-Free Cosmetics Act added Sections 111671 through 111671.4 to the Health and Safety Code, prohibiting the intentional addition of 24 chemicals to cosmetics manufactured or sold in California. The prohibited list includes dibutyl phthalate, diethylhexyl phthalate (DEHP), formaldehyde and formaldehyde-releasing agents (including methylene glycol and quaternium-15), mercury and mercury compounds, carbon black, styrene, lead acetate, certain long-chain parabens (including isobutylparaben and isopropylparaben), perfluoroalkyl and polyfluoroalkyl substances (PFAS), triclosan, and triclocarban, among others.

“Intentionally added” sounds like it gives brands an easy out. It doesn’t, not in practice. The phrase means the brand or manufacturer deliberately incorporated the substance as an ingredient — but if a prohibited substance shows up in finished-product testing at detectable concentrations, even as a contaminant in a raw material, and you have no documentation to explain it, regulators can reasonably question whether it was intentionally used. More practically, retailers don’t parse the intentionality clause. They see a detectable result and flag the product.

We’ve seen this exact pattern. A brand reformulates to remove a phthalate, their fragrance supplier quietly changes their manufacturing process, and six months later a GC-MS/MS run on the finished product shows trace DEHP from a contaminated carrier oil. The brand didn’t intentionally add it. But they also have no test data demonstrating it’s absent, and now they’re explaining themselves to a national retailer’s compliance team at the worst possible time.

The practical implication is straightforward: you need finished-product testing, not just a reformulation attestation from your contract manufacturer.

The Testing Methods Behind a Defensible Compliance File

Not every test method delivers the analytical resolution you need to defend an AB 2762 compliance claim. Method selection matters, and so do detection limits.

For metals — mercury, lead compounds, and their derivatives — the appropriate method is ICP-MS (inductively coupled plasma mass spectrometry). It’s capable of quantifying mercury at concentrations below 1 part per million (ppm) and detecting lead acetate with the compound-specific sensitivity needed to distinguish an intentional addition from incidental background. ICP-OES works for some metals panels, but it lacks the sensitivity for mercury at the concentrations California regulators and retailers care about.

For phthalates, parabens, PFAS, triclosan, and triclocarban, you want GC-MS/MS or LC-MS/MS depending on the compound class. GC-MS/MS is the standard for phthalates and triclosan; method detection limits routinely reach below 0.1 ppm in a cosmetic matrix. PFAS analysis typically requires LC-MS/MS, and it’s worth noting that AB 2762’s prohibition on PFAS applies to intentional addition — but the only way to demonstrate that trace-level detects are genuinely incidental contamination is quantified data with documented method detection limits.

For formaldehyde and formaldehyde-releasing agents, the chemistry is trickier than most brands expect. Free formaldehyde can be measured colorimetrically or by HPLC-UV. The more nuanced challenge is identifying formaldehyde releasers — quaternium-15, DMDM hydantoin, imidazolidinyl urea — because these compounds release formaldehyde slowly over time. A snapshot formaldehyde concentration at the time of manufacture reflects only what’s free in that moment, not what accumulates over shelf life. A more defensible approach is stability testing with formaldehyde monitoring at multiple time points: ideally at release, at 6 months, and at 12 months under accelerated conditions.

One thing I’d emphasize to any brand building a compliance file: test reports generated by an ISO 17025-accredited laboratory carry materially more weight in a regulatory review or retailer dispute than those from non-accredited labs. ISO 17025 accreditation means the lab’s measurement uncertainty, calibration traceability, and method validation have been independently assessed by a third-party accreditation body. If you’re building documentation to defend against an enforcement inquiry, you want that accreditation scope on the letterhead — and you want to verify that the scope specifically covers the methods used, not just that the lab holds a general accreditation certificate.

At Qalitex, our cosmetic testing panels cover ICP-MS for metals, GC-MS/MS for phthalates and parabens, and LC-MS/MS for PFAS compounds, all run under ISO 17025 accreditation — specifically because our clients need reports that hold up under scrutiny, not documents that just fill a folder.

What Retailers and Amazon Are Actually Asking For

This is where a lot of brands hit an unexpected wall. The retail documentation requirements tied to AB 2762 compliance aren’t uniform — every retailer has its own template and review process. But the patterns are consistent enough to summarize:

• Third-party lab reports dated within the last 12–24 months. Some major retailers now require annual re-testing, particularly for products with reformulations or new raw material suppliers.
• COAs that reference specific AB 2762-prohibited substances by name, with quantitative results or verified non-detects (ND) accompanied by explicitly stated method detection limits.
• Finished-product testing, not raw material COAs. Retailer compliance teams have gotten savvy to the substitution. A supplier certificate of analysis for an ingredient does not establish the absence of a contaminant in the finished formula.
• Lab accreditation documentation — often a current ISO 17025 scope certificate from the testing laboratory, not just a claim on the COA.

Amazon’s Product Safety compliance program, which covers FBA sellers in the beauty and personal care category, has increasingly mirrored California standards in the way it flags products. We’ve seen AB 2762-related information requests go out to sellers who have no California-specific retail presence but whose ASINs triggered Amazon’s automated compliance review. Amazon’s system doesn’t distinguish state boundaries. If you’re selling cosmetics at any meaningful scale on the platform, you’re effectively operating under California rules whether you’ve acknowledged it or not.

The most common documentation gap we see when brands submit COAs for review: the report covers raw materials but not finished product, or it lists heavy metals without specifying which compounds were tested or at what detection threshold. “Lead: ND” with no detection limit stated is not a compliant result. “Lead: <0.1 ppm (MDL 0.01 ppm)” is. That distinction — the quantitative context around a non-detect — is the difference between a report that satisfies a compliance request and one that generates a follow-up question.

The Federal Layer: Why California Is a Preview, Not an Outlier

AB 2762 didn’t emerge without a broader regulatory context. The federal Modernization of Cosmetics Regulation Act (MoCRA), signed into law in December 2022, represents the most significant expansion of FDA authority over cosmetics since 1938. MoCRA gave the FDA power to mandate facility registration, require safety substantiation for cosmetic products, and issue mandatory recalls — authority the agency simply didn’t hold before.

MoCRA’s prohibited ingredient framework is still developing, but the FDA has signaled that its substance restrictions will incorporate many of the same chemical categories that California already regulates under AB 2762. New York, Washington state, and several other states have advanced or enacted their own toxic cosmetics legislation modeled closely on California’s approach. The patchwork is consolidating.

The trajectory is clear: California’s testing standard is becoming the de facto national benchmark. Brands that build robust compliance documentation now — calibrated to AB 2762’s specific prohibited substances, method detection limits, and finished-product testing requirements — will find themselves ahead of the curve when federal MoCRA enforcement matures. The alternative is retrofitting documentation under time pressure when a recall or market withdrawal is already on the table.

MoCRA’s safety substantiation requirement is also worth factoring into your testing strategy directly. Demonstrating that your cosmetic is “safe for its intended use” under MoCRA isn’t a paperwork formality — it means having a documented testing file that covers prohibited substances, impurities, and microbial safety for the specific product formulation. A comprehensive third-party testing program isn’t just AB 2762 compliance; it’s the foundation of your MoCRA safety substantiation file too.

For EU market entry and European regulatory compliance, Care Europe provides expert consulting from Paris.

For raw material and ingredient-level verification, Ayah Labs specializes in contract testing and supplier qualification.

Before Your Next Retailer Review or Amazon Audit

If you manufacture or sell cosmetics in California — or on any national retail platform — the documentation standard has shifted enough that a compliance gap review is worth doing right now. Here’s the specific checklist I’d put in front of any brand:

1. Pull your current test reports and verify they reflect finished product, not just raw materials or supplier COAs.
2. Confirm every AB 2762-prohibited substance is addressed with either a quantitative result or a non-detect that includes an explicit method detection limit.
3. Check your lab’s ISO 17025 accreditation scope to verify it covers the specific analytical methods used in your reports — metals, organics, or both as applicable.
4. Note the test date. Reports older than 18 months, or any testing predating a reformulation, don’t satisfy current retailer expectations. Fresh data following any raw material or formula change is non-negotiable.
5. Audit your formaldehyde releaser exposure. If quaternium-15, DMDM hydantoin, or imidazolidinyl urea appear anywhere in your ingredient list, your stability protocol should include formaldehyde release monitoring at multiple time points — not just a single snapshot.

The brands navigating this without friction share one characteristic: they treat third-party testing as an ongoing business process, not a one-time compliance event. Annual finished-product panels, documented detection limits, and accredited lab reports on file aren’t just regulatory hygiene in 2026 — they’re table stakes for serious retail relationships and the foundation of a defensible legal position if a complaint ever lands.