PFAS Compliance in Food Packaging: A State-by-State Guide for Brands
Key Takeaways
- 14 US states have enacted PFAS food-packaging laws as of December 2025, each with its own thresholds, scope, and compliance dates.
- Most states ban PFAS only when intentionally added. California is the outlier, it also caps total organic fluorine at 100 ppm, whether added on purpose or not.
- One Certificate of Compliance doesn't cover a multi-state footprint. The standard that applies depends on where each supplier's packaging actually ships.
- A verified 200+-supplier compliance review closed in eight weeks, reviewing 423 material codes and resolving every account, compliant, non-compliant, or non-responsive.
- The bigger risk isn't the 14 states already enforcing PFAS rules. It's the 10 more with bills pending, and teams with no repeatable process for the next one.
PFAS Compliance in Food Packaging
PFAS compliance in food packaging is the process of confirming packaging materials meet the specific PFAS restrictions of every state a product ships to, not a single national standard. Because thresholds, scope, and enforcement dates vary by state, compliance depends on verified documentation from each supplier, not a blanket manufacturer assurance.
The Regulatory Patchwork Packaging Teams Are Actually Facing
Fourteen US states have enacted laws restricting PFAS in food packaging as of December 2025, with ten more bills pending. That's not a future problem, it's already the operating environment for any brand distributing packaged food nationally.
The laws don't move together. Some restrict plant-based packaging only. Others cover every material. Effective dates run from 2022 through 2032, and there's no federal standard tying them into one rule.
PFAS sits alongside the other packaging-related sustainability and regulatory documentation brands are already expected to maintain, it's rarely the only compliance thread a packaging team is managing at once.
| State | Scope | Effective |
|---|---|---|
| New York | Plant-based packaging | Dec 2022 |
| California | Plant-based + 100 ppm total-fluorine floor (all materials) | Jan 2023 |
| Washington | Plant-based packaging | Feb 2023 |
| Vermont | All food packaging materials | Jul 2023 |
| Colorado, Maryland | Plant-based packaging | Jan 2024 |
| Connecticut, Minnesota | All materials | Jan 2024 |
| Hawaii | Plant-based packaging | Dec 2024 |
| Oregon, Rhode Island | All materials | Jan 2025 |
| Maine, New Hampshire, New Mexico | Phasing in | Through 2032 |
Source: BCLP, state-by-state PFAS packaging regulation tracker (data as of December 2025).
"Intentionally Added" vs. California's Total-Fluorine Standard
Most state laws use an “intentionally added” test, PFAS introduced on purpose, for a functional effect like grease resistance, which is banned; trace contamination generally isn't the target.
California doesn't stop there. It also sets a 100 ppm total-organic-fluorine ceiling that applies regardless of intent. A supplier can have added nothing on purpose and still fail a California test if total fluorine reads high enough. That single distinction is why a supplier's word isn't enough, the standard that applies depends on both the state and the specific packaging material, and only testing or documented certification settles it.
This mirrors a shift already underway in the EU. PFAS thresholds for food-contact packaging became directly enforceable under PPWR on August 12, 2026, see PPWR After August 12, 2026: What's Actually Operational Now for the EU-side equivalent of this same documentation problem.
Why a Supplier Assurance Isn't the Same as a Verified Compliance Record
A global confectionery manufacturer ran into this directly. Its secondary packaging for US distribution came from a supplier base of more than 200 vendors, spread across geographies with no shared reporting standard. The manufacturer needed to know, supplier by supplier, format by format, which packaging lines actually met the rules for the states they shipped into. Not an assumption. A documented answer.
That's a materially different problem than “ask suppliers if their packaging is PFAS-free.” It requires mapping each supplier to the right regulatory standard for its shipping geography, collecting Certificates of Compliance against that specific standard, and closing out every account, not just the ones that respond first. It's the same discipline that underpins a well-run supply chain automation programme: scattered supplier data brought into one governed, auditable system instead of a folder of individual assurances.
Building a Supplier Compliance Program That Actually Closes
Phase 1: Map Suppliers to the Rules That Actually Apply to Them
Before outreach starts, sort the supplier base by shipping geography and packaging format. A supplier shipping only to Vermont faces an all-materials standard; one shipping to New York faces a plant-based-only rule. Applying one blanket ask to both wastes review time and produces compliance answers to the wrong question.
Phase 2: Standardize the Ask, in a Form Every Supplier Can Actually Use
A single CoC template, sent with clear instructions, cuts down the back-and-forth that eats review timelines. For an internationally distributed supplier base, that means multilingual instructions, not just a template in the buyer's language and an assumption it translates cleanly.
Phase 3: Track to Closure, Not Just to Response
A response isn't the same as a validated compliance record. Every document needs review against the correct threshold for that supplier's geography, logged centrally so the compliance team has one live view of status, the same centralized discipline a specification management system brings to pack data, applied here to compliance documentation instead. A second review pass on each document catches what a single reviewer misses, which matters more than it sounds like it should when hundreds of certificates are moving through in parallel.
Phase 4: Resolve, Don't Just Flag
A supplier that doesn't respond isn't a closed file, it's an open risk. A working program sorts every supplier into compliant, non-compliant, or non-responsive, and routes the latter two toward a resolution decision rather than letting them sit unresolved. Regular governance checkpoints, not just a kickoff and a final report, keep issues visible while there's still time to act on them.
What This Looked Like in Practice
Run end-to-end, that structure closed a full review in eight weeks: 100% supplier response and document review, across a base of 200+ suppliers spanning 8 secondary packaging formats. The review tracked 230+ email communications and 100+ direct supplier interventions, and validated 423 material codes against the applicable state-level standard for each supplier's shipping footprint.
What the numbers actually show
423 material codes reviewed against 14 different state standards isn't a checklist exercise, it's a coordination problem. The eight-week timeline held because the program tracked to closure by design, not because the compliance questions were simple.
The review also surfaced suppliers that needed follow-up, a normal, expected outcome of an audit this size, not a failure of the process. Each was referred forward with corrective action guidance rather than left open, which is the actual point of running a compliance review instead of collecting a stack of unverified assurances.
Where Most Compliance Reviews Break Down
The blanket-standard trap
Sending every supplier the same compliance ask, regardless of where their packaging ships, produces answers to a question nobody asked. A supplier shipping only to states with plant-based-only bans has nothing to certify against California's total-fluorine rule, and testing them against it wastes time on both sides.
The response-equals-resolution trap
A high response rate looks like success on a dashboard. It isn't the same as a validated compliance record. Every response needs review against the correct threshold before it counts, and a program without a second review pass will miss a share of documents that don't actually hold up.
Frequently Asked Questions
Is PFAS allowed in food packaging?
PFAS in food packaging is restricted, not universally banned, the rules depend on which state a product ships to. Fourteen states prohibit PFAS in some or all food packaging materials, most targeting intentionally added PFAS rather than trace amounts. There's no federal standard, so packaging compliant in one state can still fail another's rule, particularly California's stricter total-fluorine threshold.
What are the current PFAS regulations for food packaging?
Current PFAS regulation in food packaging is a state-by-state patchwork, not one federal rule. Fourteen states have enacted laws as of December 2025, with ten more bills pending. Most restrict intentionally added PFAS in plant-based or all packaging materials; California adds a 100 ppm total-organic-fluorine ceiling that applies regardless of intent. Compliance means checking the specific rule for every state a product is distributed into, not applying one blanket standard.
Which US states currently restrict PFAS in food packaging?
New York, California, Washington, Vermont, Colorado, Maryland, Connecticut, Minnesota, Hawaii, Oregon, Rhode Island, Maine, New Hampshire, and New Mexico all restrict PFAS in food packaging as of December 2025. Effective dates run from 2022 through 2032, and scope varies, some cover plant-based packaging only, others apply to all materials.
What's the difference between an “intentionally added” PFAS ban and California's threshold rule?
Most states ban PFAS only when it's deliberately added during manufacturing for a functional effect, such as grease resistance. California goes further, setting a 100 ppm total-organic-fluorine ceiling that applies regardless of whether PFAS was intentionally added, meaning packaging can fail California's standard even without deliberate use.
What should a PFAS Certificate of Compliance actually confirm?
A usable Certificate of Compliance confirms a specific packaging material meets the specific PFAS standard for the state it will be distributed in, not a general “PFAS-free” claim. Because requirements differ by state, a certificate written against one state's rule doesn't automatically establish compliance in another.
How long does a full supplier PFAS compliance review typically take?
A structured review across a large supplier base can close in around eight weeks, provided it runs on standardized documentation, centralized tracking, and defined resolution checkpoints from the start. Reviews without that structure tend to stall on non-responsive suppliers rather than reaching a clean close.
