The indie beauty market pulled in roughly $2.8 billion in US prestige sales in 2023 alone — and most of those brands launched without a single independent safety test on their formulas. That’s not a scandal waiting to break. It’s how the regulatory system is designed. Unlike pharmaceuticals or even medical devices, cosmetics sold in the United States have never required pre-market approval from the FDA. A founder can develop a face oil in their kitchen, design a beautiful label, list it on a Shopify store, and legally sell it before any lab has verified it won’t cause harm.
That changed — slightly — with the Modernization of Cosmetics Regulation Act (MoCRA), signed into law in December 2022. But “slightly” is doing a lot of work in that sentence.
What MoCRA Changed (And What It Didn’t)
Before MoCRA, FDA authority over cosmetics was governed by the Federal Food, Drug, and Cosmetic Act of 1938 — legislation written before synthetic fragrances, microplastics, or direct-to-consumer e-commerce existed. For 84 years, the agency had no power to mandate recalls without going to court, no authority to require facility inspections without consent, and no centralized database of who was even making cosmetic products sold in the US.
MoCRA addressed some of this. As of December 29, 2023, any company with annual cosmetics sales exceeding $1 million is required to register its manufacturing facilities and list its products with the FDA. Companies earning under that threshold had until December 29, 2024. The law also requires companies to maintain safety substantiation records — documented evidence that each product is safe — and to report serious adverse events to the FDA within 15 business days.
Here’s what it still doesn’t require: proof that you’ve tested anything before you sell it.
The FDA cannot reject a cosmetic product before it launches. It can only act after harm is documented — and “documented” typically means reported, which means consumers have to be hurt first. For brands selling $28 face serums to people scrolling social media at midnight, that’s a meaningful gap. And smaller indie brands are exactly where that gap shows up most often.
The Four Tests Most Indie Brands Skip
Independent safety testing isn’t just bureaucratic box-checking. Each test category catches a specific failure mode. And each carries a real cost that creates a genuine incentive for smaller brands to quietly skip it.
Preservative efficacy testing (PET) — sometimes called challenge testing — verifies that a product’s preservative system actually prevents microbial growth under real-world use conditions. Water-containing formulas like creams, lotions, serums, and toners are particularly vulnerable: without adequate preservation, bacterial contamination can develop within weeks of opening. A PET study typically costs between $300 and $800, depending on the lab. For a brand doing $60,000 in annual revenue, that’s a meaningful line item they may rationalize away.
Stability testing checks whether a product maintains its appearance, scent, texture, and chemical integrity over time. Labs typically run accelerated aging at 40°C and 75% relative humidity for three months, which simulates roughly a year of real-world shelf life. Unstable formulas can separate, oxidize, develop off-odors, or — critically — shift in pH in ways that compromise preservative effectiveness and allow microbial growth. Stability studies run $500 to $2,000 per formula. Many indie brands skip them and simply hope the product holds up.
Repeat insult patch testing (RIPT) is what sits behind claims like “dermatologist tested” or “clinically validated.” A properly conducted RIPT involves 50 to 100 human subjects, applying the product under occlusion for repeated exposure cycles to assess sensitization potential. These studies cost $3,000 to $6,000 each. The alternative — slapping “dermatologist approved” on the label because one dermatologist glanced at the formula — costs nothing. There is no regulated definition for that phrase, so it can mean almost anything.
Heavy metal screening matters most for color cosmetics — lipsticks, eyeshadows, blushes, bronzers — where pigments derived from iron oxides, micas, or synthetic dyes can carry trace levels of lead, arsenic, cadmium, chromium, or nickel as natural contaminants. The FDA recommends keeping lead below 10 ppm in finished cosmetics. A 2018 FDA survey of 400 lipstick samples found lead in 99% of them, with concentrations ranging up to 7.19 ppm. Those products were fine — but only because someone actually tested them and confirmed it. ICP-MS heavy metal panels for cosmetics run approximately $150 to $400 per sample. Brands that skip this testing simply don’t know what’s in their pigments.
The Label Red Flags Worth Knowing
You can’t run lab tests on every product you own. But there are label signals that tell you a great deal about how seriously a brand takes safety — and you can check them in about 90 seconds before you buy.
No lot or batch number. Every properly manufactured cosmetic should carry a traceable batch identifier. If there’s no lot number on the packaging, there’s no way to link your specific bottle to a manufacturing run. If a contamination issue surfaces later, there’s no mechanism to determine whether your product is affected. It’s also a signal the brand isn’t maintaining the production traceability records that MoCRA now requires.
No period-after-opening (PAO) symbol or expiration date. That open-jar icon with a number and “M” — 12M, 24M — tells you how long a product is safe to use after opening. Its absence doesn’t guarantee the product is unsafe, but it suggests the brand hasn’t done the stability work needed to make that determination with any confidence. You’re essentially guessing.
Drug claims on a cosmetic label. If a “moisturizer” claims to “eliminate acne-causing bacteria” or a “toner” promises to “treat rosacea,” those are drug claims under 21 CFR Part 201. They legally require FDA pre-market approval and clinical substantiation. Brands making these claims without approval are either uninformed about regulatory requirements or counting on customers not knowing the difference. Either scenario is instructive about that brand’s overall approach to compliance.
“Fragrance” listed with zero further disclosure. Under 21 CFR Part 701.3, fragrance components can be grouped collectively as “fragrance” without identifying individual ingredients — an exemption originally created to protect trade secrets. Responsible brands increasingly disclose their fragrance allergens voluntarily, or use IFRA-compliant fragrance safety assessments. A brand that defaults entirely to the blanket fragrance exemption, especially on a product marketed as “clean” or made with natural skincare ingredients, is choosing opacity when transparency is available.
How to Quickly Vet an Indie Brand
You don’t need a chemistry background to do this. A few targeted steps get you most of the signal you need.
Search the brand’s facility name in the FDA’s Cosmetics Registration Portal at FDA.gov. Under MoCRA, larger companies were required to register by the end of 2023. If a brand that’s been selling for several years doesn’t appear, that’s worth noting. Absence alone isn’t disqualifying — very small brands had until late 2024 — but absence combined with other red flags from this list adds up quickly.
Ask the brand directly, via email or their contact form: “Do you have a Certificate of Analysis for this product batch?” and “Has this formula undergone preservative efficacy and stability testing?” Brands that have done the work can answer quickly and often share documentation without hesitation. Brands that haven’t tend to respond with marketing language about their commitment to quality — which is very different from actually having quality data.
Look for third-party certifications with genuine substance behind them. EWG Verified, MADE SAFE, and COSMOS Organic all require documented safety assessments as part of the certification process — they’re not self-declared. “Cruelty-free” and “vegan” certifications, while meaningful ethically, say nothing about product safety testing. Don’t conflate them.
The Bigger Picture
None of this is an argument against indie beauty. Some of the most responsibly formulated natural skincare products on the market come from small, founder-led brands that invested in testing early because they genuinely cared about getting it right. The indie space has also driven real innovation in ingredient transparency and formulation philosophy that larger brands have been slow to match.
But “indie” and “safe” are not synonyms. And neither are “natural” and “low-risk.” Botanical extracts can be potent sensitizers. Plant-derived preservatives can fail at higher rates than synthetics. “No parabens” means nothing if the replacement preservative system hasn’t been properly tested for efficacy against the microbial challenges a real product faces.
MoCRA created a regulatory floor — facility registration, adverse event reporting, safety substantiation requirements. But it’s still a largely self-reported system. The FDA is not walking into indie brand fulfillment centers and pulling products for lab review. You are still, in many cases, the last line of quality control.
That’s an uncomfortable truth. But it also means the questions you ask — and the brands that can answer them clearly — matter more than you might realize.
Written by Nour Abochama, Host & Quality Control Expert, Nourify & Beautify. Learn more about our team
Have questions about product safety? Talk to our experts. Contact us
Related from our network
- Cosmetic formula and finished product safety testing — Qalitex Laboratories offers ISO 17025-accredited testing for preservative efficacy, stability, and heavy metals in cosmetics
- Raw material identity and purity verification for beauty brands — Ayah Labs helps indie formulators confirm ingredient quality and supplier documentation before production
