Off the Books

The word on the box is usually "organic." Sometimes "natural," sometimes "made without nasties," sometimes "non-toxic." It is the word a lot of people reach for in the period-care aisle — and not, mostly, because they are chasing a trend. They reach for it because they want to opt out of an argument. They have read enough about what turns up in everyday products to want, for this one thing worn this close, the version that sounds like somebody checked.

Here is what the word is actually attached to. Under UK law a tampon or a pad is not a cosmetic. It is not, in almost every case, a medical device. It falls into the category left over when the other rulebooks decline it: the General Product Safety Regulations 2005, which require that a product be "safe," and which treat its chemical make-up as one thing to "take into account" — not as something anyone is obliged to test for, or to print on the box.¹

So the reassuring word tells you how the cotton was grown. It does not tell you what the finished object against your body contains, because no rule requires anyone to find out. And the shopper who chose "organic" specifically to leave the chemistry question behind has, without knowing it, chosen the one aisle where the question was never asked.

This is not the story of a safety limit set too low, or a number that is law in one country and only guidance in another — that was the question about PFAS in tap water. It is not the story of a single word on a label doing work the test behind it never did — that was the "PFAS-free" claim on activewear. This is the more basic thing sitting underneath both: a whole product category that no rulebook is assigned to check at all. The difference between a speed limit set too high and a road with no highway authority.

Three rulebooks, and the space between them

Start with the rulebooks that say "not mine," because the void is built out of three correct answers.

The first is cosmetics law. In Great Britain the retained Cosmetics Regulation defines a cosmetic as a product for the "external parts of the human body" or "the mucous membranes of the oral cavity," used "exclusively or mainly" to clean, perfume, protect or improve their appearance.² A tampon has no cosmetic purpose, and the surface it is worn against — the vaginal mucosa — is not among the sites the definition lists; only the mouth's mucous membrane is named. So the regime that would give a shopper the fullest ingredient discipline she can picture — the INCI list on a shampoo, the mandatory safety assessment behind a moisturiser — does not reach this product at all.

The second is the medical-devices regime. The UK's medicines and devices regulator, the MHRA, publishes borderline guidance on what counts as a device, and it lists "feminine hygiene products (sanitary towels, tampons)" among the goods "not normally considered to be medical devices."³ There is one edge: some menstrual cups are marketed with a device mark, because a cup can be sold with the kind of physiological claim that crosses the line. But the mainstream products — tampons, pads, period underwear — sit outside the device rules.

The third is general product-safety law, and it takes whatever the first two decline. The General Product Safety Regulations 2005 impose a real duty — "No producer shall place a product on the market unless the product is a safe product" — and require producer identification and appropriate safety information or warnings where needed.¹ It is a genuine obligation, and an unsafe product can be enforced against. But it is a duty defined by an outcome ("safe"), not by a positive account of what the thing is made of. Read the whole instrument and the only chemistry it mentions is "composition," listed once, as a factor to weigh in judging safety — never as a duty to test the product or to tell the buyer what is in it.

Three desks, three correct refusals, and the sum of the correctness is a gap. That is the jurisdictional finding, and it is worth holding still for a moment: nobody dropped this category. It was filed accurately, three times, into rulebooks that were each right to say it wasn't theirs.

The fourth rulebook — the one that touches chemistry

There is a fourth rulebook, and it is the one an industry lawyer would reach for first, so it is worth meeting head-on. Chemical safety in ordinary articles — socks, bedsheets, a child's coat worn against the skin all day — is mostly delivered not product-by-product but horizontally, by chemicals law. In Great Britain that is UK REACH.

REACH does bite on composition, but only in a specific way. It works, in the Health and Safety Executive's words, by restrictions that "limit, ban or set conditions on the manufacture, placing on the market or use of a substance or group of substances."⁴ The restrictions live in a list — Annex 17 — that runs as a numbered table: one named substance or group per entry, with the conditions that apply to it. It is a closed list of named chemicals, added one at a time. It is not a duty to test a product category's make-up, and it is not a duty to disclose that make-up to the person buying it.

Two facts about that list decide whether it closes the gap. There is no entry in it for tampons, pads or period products — REACH restricts substances, not product categories, so it structurally cannot impose a category-wide test-or-disclose duty. And Great Britain's list has stood still on one family in particular. EU REACH was brought into UK law on 1 January 2021; since that date, as the campaigning chemicals group ChemTrust records, "no PFAS sub-groups have been banned in the UK."⁵ The European Union, on the other side of the same fork, will restrict one PFAS — PFHxA — in consumer clothing and textiles from 10 October 2026, a rule that would catch a treated period-underwear fabric.⁵ Great Britain has no equivalent.

So the horizontal rulebook is real, and it restricts named metals and named chemicals in any article. But the very finding this report is built on — a fluorinated finish that independent testers have measured in period underwear — sits in a substance-class Great Britain's list has not moved on since 2021. REACH catches lead above its limit. It does not catch a finish that isn't yet on the list, a soil-borne metal that varies field to field, or a residual from the manufacturing step. The void is not "no chemical rule touches this product, ever." It is narrower and harder to argue with: no rule requires anyone to test this category's composition or to disclose it, and the one horizontal regime that restricts named substances has not been updated to catch the substances the testing is actually finding.

What the reassuring word actually covers

Now go back to "organic," because once you know which lifecycle step it governs, the word stops being a reassurance and becomes a map with one road drawn on it.

"Organic" is chiefly a farming standard. It governs how the cotton was grown — restricting synthetic pesticides at the field — and that is a real and governed thing. What it does not do, by itself, is certify every chemical input or contaminant in the finished object. The trouble is that chemistry enters a finished period product at more steps than the farm, and each independent finding of the last two years enters at a different one.

Glyphosate enters at the agricultural step. When the campaign groups PAN-UK, Wen and the Pesticide Collaboration tested fifteen boxes of tampons in 2025, they found glyphosate in one, at 0.004 mg/kg — a trace, in a single box out of fifteen. To describe that trace the campaigners reached for the limit on glyphosate in drinking water, which is an ingestion benchmark for something you swallow, not a measure of what crosses a mucosa and never a dose you receive; by that swallow-it yardstick the residue in the one positive box sat some forty times above the limit, a multiple that grades the wrong route rather than an exposure through a tampon.⁶ As a signal it is small — one box in fifteen. As a lifecycle point it is exact: pesticide residue is the one contamination route that organic certification is actually built to govern.

Metals enter earlier still, from the soil, and organic certification does not touch them. The first study ever to measure metals in tampons — Jenni Shearston and colleagues, published in Environment International in 2024 — ran 30 tampons from 14 brands (60 sub-samples) through a mass spectrometer. It screened sixteen metals, and twelve of them — lead among them — showed a detectable concentration in every sample, a 100% detection rate that marks the metal as present in the fibre, not as a dose delivered to the body.⁷ Then the detail that breaks the word from the inside: "lead concentrations were higher in non-organic tampons while arsenic was higher in organic tampons. No category had consistently lower concentrations of all or most metals."⁷ A plant takes up arsenic from the ground it grows in, not from the pesticide plan; a farming standard cannot certify soil chemistry it does not test. This is one study, not yet replicated, and its authors are the first to bound it — more on that below. But the mechanism holds whether or not the exact figure repeats: "organic" governs the field, and metals arrive from the field's chemistry, which the word says nothing about.

The fluorinated finish enters later, at the textile step. And the manufacturing steps — the superabsorbent polymer in a pad, the solvent used to make viscose — are further entry points still, less measured, but downstream of the fibre by definition. Count them and the picture is plain: chemistry enters at the farm, the soil, the finishing line and the factory, and the certification watches the first gate only. The word is not false. It is scoped. It certifies the field, and the buyer, reasonably, reads it as certifying the object.

The evidence exists because no one was required to find it

Notice where all of this evidence comes from. Not from a regulator's testing programme, because there isn't one. It comes from academics and campaigners doing the checking that no rule obliges anyone to do.

The metals came from a university lab. The pesticide came from three NGOs pooling a testing budget. And the fluorine came from a physicist's screening method. Graham Peaslee at the University of Notre Dame and Marta Venier at Indiana University's O'Neill School tested 59 reusable products in 2025. They found fluorine "at levels consistent with intentional use in nearly 30 percent of the samples," concentrated in the synthetic categories — around a third of period underwear, a quarter of reusable pads.⁸ In a subset of the highest-fluorine products the researchers sent for detailed analysis, every one contained PFAS; in the most extreme, total fluorine passed 100,000 parts per million — about a tenth of the fabric, by mass — which the team described as a finish "added directly to the synthetic fabric when it is being made," not a stray contaminant.⁸ The complement matters just as much: roughly seventy per cent of the reusable products tested were not at those intentional-use levels. Most were clean.

That last fact is the point, not a hedge against it. If most products are fine and some are not, and nothing on the pack lets you tell which is which, then the missing thing is precisely the information. The pattern had already surfaced in a courtroom before the scientists formalised it: in the United States, the brand Thinx settled a class action alleging PFAS in its period underwear for up to five million dollars in 2023 — a settlement in which, in its own words, the company said it "denies all allegations made in the lawsuit" and admitted no wrongdoing.⁹ The claims were resolved without any finding. But the market pattern the testers went on to measure was already visible in the litigation.

Present, released, absorbed

Before this tips into the thing it must not become, hold the three words that keep it honest: present, released, absorbed. They are not the same, and almost everything measured so far stops at the first.

Everything in the studies above is presence — a chemical detected in the material. Whether it is released — migrates out of the product under real use, warm and moist and worn for hours — is largely unmeasured; the lead author of the tampon-metals study has said her team is running those leaching experiments now. Whether it is then absorbed at a dose that matters is not demonstrated at all. This is not YAN's caution talking. It is the US Food and Drug Administration's own finding: reviewing nine contaminant studies in 2024, the FDA reported that "none of the studies reviewed address how much, if any, of the contaminants identified are released from the tampon or absorbed through the vagina," and concluded that tampons "remain a safe menstrual product option."¹⁰ The American College of Medical Toxicology is blunter: "There is no evidence that metals are absorbed efficiently through vaginal mucosa in quantities that would cause clinical effects."¹¹

So why does the missing test matter, if no harm has been shown? Because of what the surface is. The reassurance everyone reaches for is that absorption through the body's outer covering is minimal — and that is true. Dermal uptake of glyphosate, for instance, tops out at around 2%.¹² But it answers the wrong anatomy for the internal products. A tampon or a cup does not sit against skin. It sits against the vaginal mucosa, a surface medicine uses on purpose as a systemic delivery route. That is because, as the tampon-metals study itself notes, chemicals absorbed there "do not undergo first-pass metabolism and detoxification via the liver and directly enter systemic circulation."⁷ That makes the mucosa a more permeable route than skin, which is why medicine sometimes uses it on purpose — but a permeable route describes how the door works, never how much, if anything, actually crosses it. (Pads, liners and the top layer of period underwear sit against the vulva — external tissue that is largely keratinised skin, not the non-keratinised vaginal mucosa a tampon or cup meets inside — so for the external products the exposure question is closer to the dermal case, where the "absorption is low" reassurance does apply. An earlier YAN report looked at chemicals crossing the skin; the internal products are pointedly not that story, and the two must not be blurred.)

That distinction is why the missing measurement is worth taking — never a claim that a dose is being received. A trace metal bound in dry cotton is not a drug formulated to cross a membrane, and the honest position is neither "toxic" nor "safe." It is that the one experiment that would settle it — how much comes out of the finished product, and how much crosses — is exactly the experiment no rule requires. If the leaching studies now under way find that the released fraction is trivial at real-world exposure, the chemical worry narrows sharply toward asked-and-answered, and the mucosa becomes the reason the test was worth running rather than a live concern. That is the honest shape of the doubt, and it points at a lab bench, not a bin.

The one time the line was crossed

The regulatory machine is not incapable of switching on for a period product. It has done it — exactly once — and how it happened tells you which kind of harm the system can see.

In the summer of 1980, young women in the United States began dying of a fast, acute illness. The Centers for Disease Control traced the rising cases to toxic shock syndrome and, in particular, to a highly absorbent tampon — Procter & Gamble's Rely — which the company recalled that September.¹³ This was a hazard the system could act on: sudden, attributable, countable in bodies within days. In the United States, where tampons are regulated as medical devices, the FDA moved. By 1990 it had a rule on the books forcing every box to carry a standardised absorbency rating, so that a shopper could compare across brands.

Set that rule beside the British one, verbatim, and the forty-five-year silence stops being an inference and becomes a transcript.

The 1990 US rule, 21 CFR 801.430, tells a manufacturer exactly what to do with the one physical property that mattered: "A manufacturer shall measure the absorbency of individual tampons … and calculate the mean absorbency … by rounding to the nearest 0.1 gram" — and print one of six standard terms on the box.¹⁴ A measurement, mandated, to a tenth of a gram, and disclosed to the buyer.

The British rule that governs the same product's chemistry, GPSR 2005, defines a safe product as one that "does not present any risk or only the minimum risks compatible with the product's use," taking into account "the characteristics of the product, including its composition."¹ Composition is there — as a thing to weigh. Nowhere in the instrument is a producer obliged to measure it, test it, or name it.

That is the seam. When a state had a menstrual product open on the table for a physical hazard it could see, it wrote a rule that forced a measurement to a tenth of a gram. For the chemistry it could not see, it wrote a duty that mentions composition once and requires no one to look. The physical dimension crossed the regulatory line in months. The chemical dimension waited.

The state's own admission, forty-five years later

Here is where the waiting ends, and it ends with the state saying so in its own hand.

In a consultation on the UK's new product-safety framework that closed on 23 June 2026, the government included a box headed "Spotlight: Safe period products." In it, it conceded the concern directly: recent scrutiny "has led to concerns about the presence and potential leaching of harmful chemicals and traces of heavy metals in period products, both internal (such as tampons and menstrual cups) and external (including pads and panty liners)."¹⁵ And then, in question A20, it asked, in as many words: "Are there any further actions you believe we should take beyond the existing and proposed requirements to ensure period products are safe?"¹⁵

Read through the seam, A20 is the chemical dimension's first approach to the regulatory line — not pushed there by a body count, but by the university labs and campaign groups of the last two years, doing the checking no one was required to do. It took a physical hazard months to summon a mandated measurement. It has taken the chemical question roughly forty-five years merely to become a consultation bullet point.

And the same page that raises the concern is careful to be fair on the dose. The government notes that "an internal literature review" found "that across all categories, chemical levels were consistently low," that "conservative exposure models showed that the risk is well below thresholds of concern," and that this suggested "minimal toxicological risk."¹⁵ That finding belongs in this report as prominently as the concern does. It is the fair axis, in the state's own words: on the modelling done so far, the levels are low. The gap this report describes survives it — a favourable model is not a mandatory test, and it rests on content data, because release and absorption are the very things the FDA said nobody has measured — but it is not chemophobia to hold both. Present is not released is not absorbed, and the government's own conclusion sits on the low end of that ladder.

A void being chosen, not inherited

The natural reading of A20 is that the government is finally getting round to it. The more accurate reading is on the same page, and it is that the government has already decided how — in the cheapest available way, and for reasons that are partly defensible.

The consultation states its instrument plainly: under the new framework, "we should make better use of standards and codes of practice rather than introduce additional detailed product-specific regulations, which may not keep up with product innovations."¹⁵ It sets this inside a whole-of-government aim "to cut the administrative costs of regulation for business by 25% over this Parliament."¹⁵ The chosen tool for period products is a voluntary standard — ISO 25130, an international menstrual-products standard, which the consultation expects "to be in effect by 2028," to be "designated" later so that meeting it counts as evidence of safety.¹⁵ Not a statutory duty to test composition and disclose it. A voluntary floor that a maker may choose to meet.

This deserves a fair hearing rather than a raised eyebrow, because a bespoke, per-product testing law for a hazard that has not demonstrated harm is exactly the kind of disproportionate rule good regulation is supposed to avoid — and the honest objection to it comes from the affordability side, not the industry side. A testing-and-certification cost applied box by box is regressive by its nature. Certification schemes tend to run on a fixed annual band, so the per-unit cost falls hardest on the cheapest, lowest-volume products — the own-label box a teenager buys on a tight budget. And the people most exposed to that squeeze are the ones least able to absorb it: even before the recent cost-of-living years, the charity Plan International UK found in 2021 that more than a third of girls aged 14 to 21 in the UK had struggled to afford or access period products.¹⁶ A blunt per-box duty would land heaviest exactly there.

Which is why the useful fix is not "regulate the brands," and not a single test bolted onto every finished box. It is a matter of where the cost sits. A testing-and-disclosure duty could be built as a shared, upstream standard — testing carried out at the fabric, fibre and finishing stages and passed down, so a cheap own-label product can inherit compliance instead of paying for it a box at a time. This is not a fantasy of cost-free regulation; it is how modular textile standards already distribute the bill. The OEKO-TEX scheme describes its own logic in exactly these terms: "the costs for certification are distributed across the production steps," and "the testing costs for the finished product are waived if all the components have already been successfully tested."¹⁷ The point isn't that any one existing scheme is the answer — OEKO-TEX, for instance, screens a list of named PFAS rather than total fluorine, so it would not by itself have caught the finding this report rests on. The point is the shape: a duty designed to test upstream and share the result across every product that uses the component, so the burden doesn't ride on the cheapest shelf. If ISO 25130 arrives on time in 2028 and is widely adopted, and if it is built to cover the finishing and processing steps rather than the fibre alone, the duty gap starts to close on the timeline the government has already set — and this report's central complaint narrows to "a slow fix arriving" rather than "a void being held."

What to do the next time you shop

None of this warrants clearing out the bathroom cupboard. The evidence is of presence, not harm; the government's own modelling puts the levels low; most of the products tested were clean. A panic purchase is the wrong move, and it is also the move the alarm rail wants from you.

The useful move is smaller and more durable: stop trusting the word, and start looking for the practice. The signal worth anything here is not "organic" or "natural" or "non-toxic" — it is a maker that publishes third-party test results and discloses what the product is actually made of. That is the one thing no rule requires, which is exactly why it tells you something when a maker does it anyway.

A few concrete ways that looks in practice:

• Look for published lab results, not adjectives. Natracare, an independent brand, publishes heavy-metal test results from accredited third-party laboratories and lists every material in its products¹⁸ — an illustration of the practice, not an endorsement of the brand. The thing to copy is the behaviour: a maker showing you the test, dated, from a lab it doesn't own.
• For synthetic products, ask specifically about PFAS testing — and read the history. Period underwear is the exact category where fluorinated finishes turned up, so a general "non-toxic" claim isn't enough. Saalt publishes dated third-party PFAS results reading "not detected," and discloses its own history plainly: an internal pre-launch test in 2020 flagged one of its fabrics, which it says it then redeveloped; and a separate, unaffiliated third-party test in 2021 detected trace PFAS, which the same lab re-tested as "not detected" in 2023.¹⁹ That candour — the earlier results left visible, not scrubbed — is more trustworthy than a brand with no history at all.
• You do not need to buy anything today. A plain organic-cotton product with its full materials disclosed is a reasonable default, and "the one you already have" is a legitimate answer while you switch to better-disclosed options as you replace them. The durable lever isn't a purchase at all: the consultation that closed in June is the document where a testing-and-disclosure duty will, or won't, appear. Backing one built as a shared upstream standard — rather than a per-box premium — is the move that would actually close the gap, for the £1 box as much as the £5 one.

The word on the box was never lying to you. It was answering a smaller question than the one you were asking. It told you how the cotton was farmed. Whether anyone checked what the finished thing against your body contains is a different question — and the honest answer, for now, is that no one was ever required to.