California vs. Federal Supplement Testing: Why FDA Compliance Isn't Enough

Here's a scenario I see constantly:

A supplement brand spends months (and thousands of dollars) getting their product tested for FDA GMP compliance. Identity testing? Check. Purity? Check. Heavy metals within USP limits? Check. They launch, they sell, things are great.

Then one Wednesday morning they get a 60-Day Notice of Violation from a Prop 65 attorney. The product is over California's lead threshold. The brand owner is confused — "But we tested everything! We're FDA compliant!"

That's the gap. FDA compliance and California compliance are two different animals, and they don't automatically overlap. Let me break down exactly how they differ and how to build one testing program that covers both.

What the FDA Actually Requires

The FDA regulates supplements under 21 CFR Part 111 — the Current Good Manufacturing Practices (cGMPs). Notice what I said: manufacturing practices, not product pre-approval.

The FDA doesn't approve supplements before they go to market. They require manufacturers to follow cGMPs, which include:

• Identity testing: You must verify that every incoming ingredient is what the supplier says it is. You can't just trust the label — you need to confirm it's actually ashwagandha root and not something else.

• Purity, strength, and composition testing: Your finished product must match the label claims for potency and not contain harmful contaminants "that may adulterate the product." This includes heavy metals, but here's the thing — the FDA doesn't give you specific numeric limits for heavy metals in supplements.

• Documentation: You need written procedures, batch records, and a quality control unit. Paperwork, basically. Lots of it.

Notice what's missing: specific heavy metal thresholds. The FDA tells you to test for contaminants and ensure products aren't adulterated, but they don't say "lead must be below 0.5 mcg per daily serving." That number doesn't exist in federal supplement regulation.

There's a proposed FDA action level for lead in baby food (10-20 ppb depending on food type), and the FDA has set action levels for inorganic arsenic in infant rice cereal (100 ppb) and apple juice (10 ppb). But for adult supplements? Nothing. No specific number.

The USP does provide heavy metal limits (lead < 10 ppm in most cases, arsenic < 3 ppm, etc.), and many manufacturers follow USP monographs. But USP is voluntary — it's not a federal requirement — and USP limits are often much higher than Prop 65 thresholds when you convert to per-serving exposure.

What California Requires

California comes at this from a completely different legal framework.

Prop 65 (Safe Drinking Water and Toxic Enforcement Act of 1986)

Prop 65 isn't administered by a regulatory agency. The California Office of Environmental Health Hazard Assessment (OEHHA) maintains the list of chemicals and establishes safe harbor levels, but enforcement is done by private citizens and attorneys — not the government.

The key mechanism: if your product exposes consumers to a listed chemical above the safe harbor level without a "clear and reasonable" warning, you can be sued. By anyone. For profit.

The practical effect is that these safe harbor levels function as de facto regulatory limits, even though they aren't technically "limits" in the FDA sense:

• Lead: 0.5 mcg/day (MADL)
• Cadmium: 4.1 mcg/day (MADL)
• Inorganic Arsenic: 10 mcg/day (NSRL)
• Mercury: 0.3 mcg/day (MADL)

CDPH (California Department of Public Health)

Separate from Prop 65, the CDPH enforces its own supplement manufacturing requirements under the Sherman Food, Drug, and Cosmetic Law — California's version of the FD&C Act. California requires supplement manufacturers to obtain a state license and comply with state-level cGMPs that are generally similar to federal cGMPs but with some additional documentation requirements.

The Gap: Why FDA-Compliant Can Still Fail in California

Let me put numbers to this so you can see exactly where things break:

That lead gap is brutal: USP-level compliance would let you ship a product with 100 times the lead California allows. And nothing in your FDA cGMP documentation would flag it.

This is why "we're FDA compliant" means almost nothing for Prop 65. You can have perfect batch records, a spotless FDA inspection history, and still get sued into next week because your heavy metal levels blow past California thresholds.

⚠️ The Prop 65 "Bounty Hunter" Business Model

Prop 65 private enforcement works because the law allows plaintiffs' attorneys to recover their fees. Not damages — fees. So the economic model is:

1. Law firm tests products purchased off retail shelves or online
2. They find products exceeding safe harbor levels (they target lead-heavy products specifically because the 0.5 mcg threshold is so easy to hit)
3. They send a 60-day notice
4. They negotiate a settlement where the brand pays civil penalties AND attorney fees
5. Average settlement: $30K-$150K. Bigger cases (multiple products, larger brands): $500K+

In 2023, Prop 65 settlements totaled over $30 million across all product categories. Supplements are one of the most targeted categories because the exposure per serving can be high and many brands don't test.

How to Build One Testing Program That Covers Both

You don't need two separate testing programs. You need one program that meets the stricter standard — which is almost always California's.

Start with Prop 65 as your floor, not FDA as your ceiling.

Set your heavy metal specifications to Prop 65 safe harbor levels adjusted for your maximum daily serving size. If a customer takes 2 servings a day, calculate against that — not just one. This automatically keeps you FDA-compliant because FDA compliance doesn't require specific numeric limits; it requires that you establish defensible specifications based on safety. Prop 65 thresholds give you that defensible basis.

Document everything for FDA cGMPs while testing to California levels.

Your batch records, test results, and supplier COAs serve double duty. They satisfy FDA documentation requirements (cGMPs) AND they give you the paper trail you need if you ever have to respond to a Prop 65 notice. If you can show a judge that you tested every lot, used ISO 17025 accredited labs, and had specifications in place, you're in a much stronger position than a brand that says "we didn't know."

Include arsenic speciation in your standard panel.

Total arsenic testing (the most common USP approach) doesn't distinguish between toxic inorganic arsenic and harmless organic arsenic (like arsenobetaine in fish). California's NSRL of 10 mcg/day is for inorganic arsenic specifically. If your lab is only running total arsenic, you may be overestimating your risk and reformulating unnecessarily — or worse, underestimating it if your sample is mostly inorganic.

California CDPH licensing is separate.

Don't forget: if you manufacture supplements in California (or distribute them into California as a manufacturer), you need CDPH licensing on top of FDA registration. This isn't about testing — it's about registration — but many out-of-state brands don't realize they need it. Check with CDPH's Food and Drug Branch to confirm your obligations.

FAQ

Q: If I'm FDA inspected and passed, am I safe from Prop 65?

No. The FDA inspection looks at your manufacturing practices and documentation, not whether your finished product lead levels exceed 0.5 mcg/day. You can ace an FDA inspection and still get a Prop 65 notice the same week.

Q: Can I just follow USP monographs and call it good?

USP heavy metal limits (when they exist) are generally much looser than Prop 65 thresholds when converted to per-serving exposure. USP <10 ppm lead translates to 50 mcg in a 5g serving — 100X the Prop 65 MADL. USP is a quality standard, not a California compliance standard.

Q: Do I need two separate lab panels?

No. A single heavy metals panel (ICP-MS for lead, cadmium, mercury, total arsenic) plus arsenic speciation when indicated covers both frameworks. The lab method is the same — it's your interpretation of the results and your internal specifications that differ. Set your spec limits to Prop 65 thresholds and you've covered both.

Q: What if I only sell on Amazon and don't target California specifically?

Amazon ships everywhere, including California. If a California resident can buy your product and have it shipped to a California address, Prop 65 applies. Nearly every supplement brand selling online in the US is within Prop 65's reach.

Q: Are there any federal heavy metal limits coming for supplements?

The FDA has been working on action levels for heavy metals in foods marketed to children, and there's ongoing discussion about extending those to supplements, but as of 2026, no specific federal heavy metal limits for adult supplements exist. Bill H.R. 6105 (the Baby Food Safety Act) sets limits for baby food but doesn't address adult supplements. Don't wait for the FDA — California is enforcing now.

---

Test once. Cover both. LabQuotes connects you with ISO 17025 accredited labs that understand both FDA cGMP requirements AND California Prop 65 thresholds. Same sample, same panel, one report that keeps you compliant on both fronts. No contract, no subscription — pay per test and know exactly where you stand.

Get a dual-compliance testing quote →