Why Contaminant Tests Disagree: Prop 65 vs FDA vs USP

The short answer

In January 2025, the Clean Label Project reported that 47 percent of top-selling protein powders exceeded at least one federal or state heavy-metal benchmark in its safety assessment. Nine months later, Consumer Reports tested 23 protein powders and found that more than two-thirds exceeded their lead benchmark. A separate risk-modeling study applied EPA reference doses to two earlier rounds of protein-powder testing and calculated hazard indexes below 1.0 in nearly every scenario it modeled.[1]

These are different studies, with different products, different testing labs, and different benchmarks. But the headline pattern, 47 percent flagged against selected benchmarks versus hazard indexes below 1 in nearly every modeled scenario, illustrates why a single number without its yardstick is uninterpretable. This article explains what each system measures, what the actual numbers are, why they cannot be directly compared, and how to read a contaminant result you encounter online without being misled in either direction: neither into panic nor into false reassurance. The sibling question, what “clinically studied” on the front of the label certifies, is covered in our guide to trial-to-label claims.

The four systems, side by side

FDA: no numeric limits for supplements

The FDA does not set numeric heavy-metal limits for dietary supplements. The agency’s cGMP rule (21 CFR Part 111) requires manufacturers to “establish limits on those types of contamination that may adulterate” the product, but the company picks those limits, not the FDA.[2] The wider system this sits in is covered in how US supplement oversight works.

The FDA does publish interim reference levels for lead, 2.2 micrograms per day for children and 8.8 for females of childbearing age, but these are benchmarks, not enforceable limits.[3] And the baby-food action levels (10 parts per billion for most categories, finalized January 2025) explicitly exclude dietary supplements.[4]

What this means: a supplement can carry more lead than a California Prop 65 warning would trigger, more than an EU product could carry to market, and more than the FDA’s own benchmark considers concerning for children. That leaves a gap in the rulebook. The manufacturer still owns a contamination specification under cGMP, and the FDA can still act against a product it considers adulterated, but there is no numeric category-wide lead limit to enforce.

California Proposition 65: warning-label triggers, not safety limits

Prop 65 sets two different lead thresholds for two different endpoints, and the difference between them is 30-fold:

• 0.5 micrograms per day (reproductive toxicity): the level below which no warning label is required. It is calculated by taking the no-observable-effect level and dividing by 1,000, a deliberately conservative safety factor.[5]
• 15 micrograms per day (cancer risk): the lifetime daily intake associated with one excess cancer case in 100,000 people.[5]

Neither value is a ban on selling the product or a universal safety threshold. Exposures below the applicable safe-harbor level generally do not require a warning. Above that level, a warning may be required unless an exemption or another valid legal basis applies. Enforcement happens through lawsuits, usually filed by private plaintiffs, though the California Attorney General and district attorneys can also bring cases. And the 0.5 microgram figure is roughly one-quarter of the FDA’s own children’s benchmark and one-seventeenth of the adult benchmark.

Despite these caveats, Prop 65 is a common benchmark in consumer-facing contaminant reports, because it is the easiest to exceed, which makes the most dramatic headlines.

USP <2232>: voluntary, and only if the label claims it

USP General Chapter 2232 sets permitted daily exposures for elemental contaminants in dietary supplements: lead 5, cadmium 5, inorganic arsenic 15, and mercury 15 micrograms per day.[6]

But these limits apply only to products whose labels claim USP or NF conformance. A product that says nothing about USP is not held to USP standards, and most brands simply do not make the claim.[6]

The rest of the world

The EU sets legally binding concentration limits: lead 3.0 mg/kg, cadmium 1.0 mg/kg, and mercury 0.10 mg/kg in food supplements, with one carve-out: supplements consisting of at least 80 percent dried seaweed or bivalve molluscs are held to a looser cadmium allowance of 3.0 mg/kg.[7] Health Canada uses exposure-based limits per 70-kilogram adult (lead 10 micrograms per day).[8] Codex Alimentarius has no supplement-specific limits at all.[9]

These cannot be directly compared to any US figure without doing serving-size math, because the EU regulates concentration (mg/kg) while Prop 65 and Health Canada regulate exposure (micrograms per day). At the EU maximum, a 1-gram daily serving would deliver 3 micrograms of lead, six times California’s 0.5-microgram MADL. That arithmetic compares two different regulatory measures. It does not by itself show that the product is unsafe or non-compliant under either system.

Why the same product gets different verdicts

A concrete example makes the problem visible. Take a hypothetical 1-gram capsule containing 2 micrograms of lead per gram (2 parts per million):

Two capsules per day instead of one, and the calculated exposure reaches 182 percent of the FDA children’s reference (4 µg/day against 2.2), while the USP allowance is still not reached (4 is under 5). Each system was designed for a different purpose. The problem is when a report uses one system’s reading and presents it as the universal answer.

The protein powder case study

The 2025 protein powder studies illustrate the disagreement perfectly.

Clean Label Project (January 2025): 160 products from 70 brands, tested by ICP-MS. Headline: 47 percent exceeded at least one federal or state benchmark used in its safety assessment, primarily Prop 65 criteria, with cadmium at 4.1 micrograms per day. Those benchmarks do not all carry the same legal status. Plant-based powders had 5 times the cadmium of whey, and chocolate flavors had 110 times the cadmium of vanilla.[10]

Consumer Reports (October 2025): 23 products, 2 to 4 lots each, purchased anonymously. Headline: more than two-thirds exceeded CR’s own lead level of concern, 0.5 micrograms per day, a number that happens to match the Prop 65 MADL. That is CR judging against its own benchmark, not a legal determination of Prop 65 compliance. Plant-based powders averaged 9 times the lead of dairy-based ones.[11]

The risk-modeling counterpoint (2020): Bandara et al. applied EPA reference doses to two earlier rounds of protein-powder testing, Consumer Reports’ 2010 round of 15 products and the Clean Label Project’s 2018 round of 133, and modeled exposure at one and three servings a day.[1] The hazard indexes came back below 1.0 in nearly every scenario. The fine print: the 95th-percentile model at three servings a day reached 0.93, and the single worst-cadmium product crossed 1.0 at triple servings. That reanalysis covers an earlier decade’s products, not the 160 in the January 2025 report above, and Consumer Reports bought and tested its own products for its 2025 round. Three testing rounds, three benchmarks, and no head-to-head comparison of the same sample set.

Each report applied its own criteria to a different dataset. The three headlines are not directly comparable, and each is best read inside the benchmark that produced it. A consumer who reads only one headline walks away with a different conclusion than a consumer who reads another.

Why plant-based powders carry more metals

In CLP testing, Consumer Reports testing, and a 2026 peer-reviewed study of 30 sports protein supplements bought in China, plant-derived protein powders averaged higher heavy-metal levels than dairy-based ones.[12]

Plants take up metals from soil and water. What survives into a finished powder depends on the raw material and the processing, and whether protein isolation itself concentrates every metal is part of the mechanism rather than a settled step. Dairy protein passes through an animal first: whey is a product of the cow’s metabolism rather than a direct extract of the field. In these datasets the plant-versus-dairy gap is a group-level average, not a guarantee that every plant-based product carries more metal than every dairy-based one. The mechanism behind the pattern is proposed more often than it is measured.

Cocoa is a special case: cacao trees take up cadmium from soil, and a screening study across Venezuela’s main plantation regions found levels that fluctuated significantly between states and even between farms within a state.[18] A chocolate-flavored plant protein stacks a second metal source on top of the base powder. Other plant categories show the same directional pattern: a study of 52 spirulina and chlorella products found all complied with EU toxic-metal limits, though pharmaceutical residues were a separate concern,[14] and a study of adaptogenic herbal supplements found lead exceeding permissible limits in several products.[13] These examples show that heavy-metal contamination can occur across several supplement categories. They do not establish that every plant-derived product is more contaminated than its animal-derived counterpart. Even prenatal multivitamins are not immune: one peer-reviewed study found measurable lead in 68 percent of 47 products tested, though none exceeded USP limits.[15]

How to read a contaminant number you encounter online

Before accepting any “this supplement failed” or “this supplement is safe” headline:

1. Convert to micrograms per day. If the report gives parts per million (ppm), multiply by grams per serving times servings per day. If serving size is not stated, the number is uninterpretable against any exposure-based standard.

2. Ask which benchmark was used. Prop 65 (0.5 µg/day for lead)? FDA benchmark (2.2 or 8.8)? USP (5 µg/day, only if the product claims USP)? EU concentration limit? The verdict changes with the yardstick.

3. “Below detection” is not zero. Different labs use different instruments, and detection limits differ by orders of magnitude between methods. ICP-MS detects far lower concentrations than ICP-OES or atomic absorption, so a “not detected” from one lab may be a measurable value at another.

4. One batch is not the product. The same brand’s protein powder can vary significantly between manufacturing lots. Consumer Reports averaged across multiple lots for this reason. A Hungarian study of 22 protein powders found no significant heavy metals above regulatory limits,[17] while a study of 45 supplements in Mexico found estimated lead exposure below its reference value for 80 percent of products, though some animal-origin products exceeded the reference for arsenic and hazard indexes topped 1 in both the animal and vegetable categories.[16] Different markets, different results.

5. Speciation matters. Total arsenic and inorganic arsenic are different things (Health Canada’s limits: 10 versus 2.1 micrograms per day). A lab reporting “arsenic” without qualification cannot be compared to a standard for inorganic arsenic.

What a Certificate of Analysis does and does not prove

A Certificate of Analysis (CoA) is a laboratory document showing test results for a specific batch of a specific product. Brands can provide them on request, and some publish them publicly. Which independent seals are worth looking for on the bottle is a separate guide.

Under FDA regulations (21 CFR 111.75), a maker must run at least one identity test on every dietary ingredient before use. For the identity of other components and for component specifications, including contaminant limits, the maker may rely on a supplier’s certificate of analysis instead of testing each incoming lot, provided five conditions are met: the supplier’s results are confirmed, the CoA includes the test methods, applicable limits, and actual test results, the supplier qualification is documented, the qualification is periodically reconfirmed, and quality-control personnel approve it.[2] This is a regulated pathway, not a free pass, but the practical consequence is that the CoA is only as good as the supplier’s lab and the ingredient sample it tested. Finished batches carry a separate verification duty under the same rule, on every batch or a statistically sampled subset, which is where a contaminant number for the blend in the bottle would come from.

When reading a CoA, check:

• Does the batch number match your bottle?
• Are actual numbers reported, or just “Pass”?
• What standard does the “Pass” reference, USP, Prop 65, an internal specification?
• Is the testing lab accredited (ISO 17025) or in-house?
• What is the test date relative to the product date?

FAQ

How this article was researched

Evidence scan: PubMed, FDA regulatory documents (21 CFR, guidance pages, Closer to Zero program), California OEHHA Prop 65 database, USP General Chapter 2232, EU Regulation 2023/915, Health Canada NNHPD quality guide, and published contaminant-testing studies (Clean Label Project 2025, Consumer Reports 2025, Bandara et al. 2020, plus 7 peer-reviewed studies 2024-2026). Every regulatory number was verified against its primary source document. Every PMID was verified against live PubMed records.

Three methodological traps recur in consumer-facing contaminant reporting, and this article documents each one: benchmark conflation (reporting Prop 65 exceedances as safety failures), unit mismatches (comparing mg/kg concentration limits to µg/day exposure limits without serving-size conversion), and speciation ambiguity (reporting total arsenic against inorganic-arsenic standards).

Research date: October 20, 2026. Updates planned when the FDA issues new contaminant guidance, when EU limits change, or when major new testing studies publish.