State Environmental Rules That Outpace Federal EPA Limits

Federal environmental law was never meant to be the ceiling. It was built as the floor. Section 116 of the Clean Air Act (42 U.S.C. §7416), Section 510 of the Clean Water Act (33 U.S.C. §1370), and Section 3009 of RCRA (42 U.S.C. §6929) each say a version of the same thing: nothing in the federal statute stops a state from adopting standards that are more stringent than what EPA requires. Most companies read that as a technicality. I read it as the reason a facility can pass an EPA inspection clean and still get cited the following month by a state agency for something the federal rule never touched.

I have spent enough time inside food, cosmetics, and dietary supplement manufacturing operations to know where this gap actually bites. It is rarely the big, well-known programs — companies budget for those. It is the state-specific add-on nobody wrote into the compliance calendar: a labeling trigger, a chemical disclosure, a waste classification that only exists in one state's code. This article walks through where states go further than EPA, why the legal structure allows it, and what a manufacturer selling into multiple states actually needs to track.

Why States Are Allowed to Exceed EPA Requirements

The regulatory structure is called cooperative federalism, and it shows up in nearly every major environmental statute. EPA sets a national minimum — a National Ambient Air Quality Standard, a Maximum Contaminant Level, a hazardous waste listing — and then delegates day-to-day permitting and enforcement authority to states that apply for and receive "authorized" or "delegated" status. As of today, the large majority of states run their own authorized RCRA hazardous waste programs and their own NPDES-equivalent water discharge programs under EPA oversight. Authorization is not a ceiling on state ambition. It is permission to run the program, and states that run it can and do write requirements the federal rule never mentions.

This is worth saying plainly because it changes how a compliance program should be built: reading the Code of Federal Regulations tells you what EPA requires everywhere. It does not tell you what any specific state requires. Those are two different research projects, and treating them as one is the most common gap I see in manufacturing environmental compliance.

California: Where the Federal Floor Gets Rebuilt Into a Ceiling

California is the state every compliance officer already knows about, but knowing it exists and knowing what it actually requires are different things. A few of the programs that matter most for regulated manufacturers:

Proposition 65 (formally the Safe Drinking Water and Toxic Enforcement Act of 1986, Cal. Health & Safety Code §25249.5 et seq.) requires a clear and reasonable warning before exposing anyone in California to a listed carcinogen or reproductive toxicant above a safe harbor level. The list, maintained by the Office of Environmental Health Hazard Assessment, currently carries more than 900 chemicals — far beyond anything EPA requires a warning label for.

The safe harbor thresholds are themselves precise and citable:

• The No Significant Risk Level for carcinogens is defined in 27 CCR §25703 as an exposure posing no more than one excess cancer case per 100,000 people over a 70-year lifetime.
• The Maximum Allowable Dose Level for reproductive toxicants under 27 CCR §25801 is set at one-thousandth of the no-observed-effect level.

Prop 65 also carries a private right of action, and civil penalties run up to $2,500 per violation per day under Cal. Health & Safety Code §25249.7 — which is why so much Prop 65 litigation is filed by private enforcers rather than the state itself.

California's hazardous waste program goes beyond RCRA in a specific, technical way that trips up a lot of manufacturers. Under Title 22 CCR §66261.24, California adds its own toxicity characteristic based on Total Threshold Limit Concentration and Soluble Threshold Limit Concentration testing, categories that do not exist under the federal Toxicity Characteristic Leaching Procedure.

The practical effect: a waste stream that is non-hazardous under federal RCRA can be a regulated hazardous waste the moment it crosses into California.

Cosmetics-specific rules matter directly for the cosmetics and personal care manufacturers I work with. SB 312, the Cosmetic Fragrance and Flavor Ingredient Right to Know Act of 2020, took effect January 1, 2022, and requires manufacturers to disclose to the California Department of Public Health any fragrance or flavor ingredient in a cosmetic product that appears on the Prop 65 list, the European Union's list of prohibited cosmetic substances, or specified IFRA restricted lists. AB 2762, the Toxic-Free Cosmetics Act, went further and banned 24 specific chemicals — including formaldehyde and certain PFAS-related compounds — from cosmetic products manufactured or sold in California starting January 1, 2025. Neither disclosure obligation exists at the federal level under the FDA's Modernization of Cosmetics Regulation Act.

Climate disclosure is the newest front. SB 253, the Climate Corporate Data Accountability Act, requires any entity with total annual revenues over $1 billion doing business in California to report Scope 1 and Scope 2 greenhouse gas emissions starting in 2026, with Scope 3 reporting following in 2027, administered by CARB under Health & Safety Code §38532. SB 261 layers on a separate obligation for entities with revenues over $500 million to publish biennial climate-related financial risk reports. There is no equivalent federal mandate in force for private companies today.

Beyond California: Other States Writing Their Own Bar

California gets the attention, but it is not alone, and treating it as the only state that matters is its own kind of blind spot.

New York's Climate Leadership and Community Protection Act, signed in July 2019 and codified at ECL Article 75, commits the state to a 40% reduction in greenhouse gas emissions from 1990 levels by 2030 and 85% by 2050, with a statutory target of net-zero emissions economy-wide. That is a legislated mandate, not a voluntary goal, and it is already shaping New York's utility and industrial permitting decisions.

Washington's Model Toxics Control Act (RCW 70A.305) frequently produces cleanup standards more conservative than CERCLA's federal baseline. Method B, the default unrestricted-land-use cleanup level under WAC 173-340, is built with additional safety factors that push required cleanup concentrations lower than what a comparable federal Superfund cleanup would demand on the same site.

Massachusetts' Toxics Use Reduction Act (M.G.L. c. 21I; 310 CMR 50.00) requires facilities that manufacture, process, or otherwise use listed toxic chemicals above specified thresholds to file a Toxics Use Reduction Plan every two years, developed by a state-certified TUR planner. This sits on top of — not instead of — the federal Toxics Release Inventory reporting required under EPCRA §313. A facility can be fully current on its federal TRI filing and still be out of compliance with Massachusetts' planning requirement.

Comparing Federal Baselines to State Enhancements

Why This Matters for Regulated Manufacturers

If you make food, cosmetics, or dietary supplements, EPA compliance was never the whole picture, and it still isn't. FDA governs the product. EPA governs the facility's air, water, and waste footprint at the federal floor. States govern everything layered on top — and for a facility selling nationally, "on top" means tracking the strictest applicable requirement in every state a product touches, not just the state where the plant sits. Prop 65's warning obligation, for example, attaches to any product sold to a California consumer regardless of where it was manufactured. A cosmetics company with no California facility can still owe a California disclosure.

I have seen this gap show up most often in three places:

• Waste classification — a byproduct treated as non-hazardous under federal rules gets reclassified the moment it's shipped to or generated in a stricter state.
• Labeling — a formulation compliant with FDA's ingredient rules still needs a Prop 65 warning if a listed substance is present above the safe harbor threshold.
• Corporate reporting — a mid-size company crosses California's SB 253 or SB 261 revenue threshold without anyone flagging that a new filing obligation just attached.

This is exactly the kind of gap a formal environmental management system is designed to catch, because ISO 14001:2015 clause 6.1.3 explicitly requires an organization to determine and keep current its "compliance obligations" — plural, and not limited to federal ones. A facility that builds its EMS around the federal rule alone has, by definition, not implemented clause 6.1.3 correctly. Our ISO 14001 consulting work usually starts by building that state-by-state legal register before touching anything else, because everything downstream in the EMS depends on getting the obligation list right first. For cosmetics manufacturers specifically, the same gap analysis has to run alongside ISO 22716 GMP implementation, since ingredient disclosure and chemical restriction requirements now sit right next to the manufacturing controls the standard already governs.

Building a Compliance Program That Accounts for State Variation

A federal-only compliance calendar is not a compliance program, it's half of one. Here is the structure I use with clients:

1. Build a state-specific legal register before anything else. List every state where the company has a facility, and separately, every state where its products are sold or distributed. Those are two different exposure maps and they rarely overlap perfectly.
2. Classify obligations by trigger, not by agency. Some state rules trigger on physical presence (a facility in the state), some trigger on sales volume into the state (Prop 65, SB 253), and some trigger on revenue thresholds regardless of where the company operates. A single compliance calendar organized only by "federal vs. state" will miss the sales-trigger and revenue-trigger categories entirely.
3. Re-run the register on a fixed cadence, not just at onboarding. State legislatures move faster than federal rulemaking. AB 2762 and SB 312 didn't exist a decade ago. SB 253 and SB 261 didn't exist three years ago. A legal register built once and never revisited will silently go stale.
4. Assign ownership by obligation, not by department. Waste classification usually sits with operations, labeling with regulatory affairs, and corporate emissions disclosure with finance or legal. If nobody owns the cross-referencing between them, gaps get discovered during an audit or a lawsuit instead of during a review.

FAQ

Does complying with federal EPA regulations guarantee state compliance? No. Federal environmental statutes set a floor, not a ceiling. The Clean Air Act, Clean Water Act, and RCRA each explicitly preserve state authority to impose more stringent requirements, and most states run their own authorized programs on top of the federal minimum.

Which states have the broadest additional environmental requirements? California is the widest-reaching, through Proposition 65, its Title 22 hazardous waste program, and its newer climate disclosure statutes (SB 253, SB 261). Washington, New York, and Massachusetts each run programs — Model Toxics Control Act cleanup standards, the Climate Leadership and Community Protection Act, and the Toxics Use Reduction Act, respectively — that go beyond their federal counterparts in specific, well-defined ways.

Do state rules like Prop 65 apply to companies with no facility in that state? Often, yes. Prop 65's warning requirement attaches to products sold to California consumers, not to where the product was manufactured. A company can have zero physical presence in California and still owe a compliance obligation there.

How should a manufacturer track this across many states at once? Build a legal register organized by trigger type — facility location, sales destination, and revenue threshold — rather than one organized only around federal versus state agencies. ISO 14001:2015 clause 6.1.3 requires exactly this kind of compliance obligations register as part of a certified environmental management system.

What is the penalty exposure for missing a state-specific requirement like Prop 65? Prop 65 carries civil penalties of up to $2,500 per violation per day under Cal. Health & Safety Code §25249.7, and it allows private citizen enforcement, which is why the majority of Prop 65 litigation is filed by private plaintiffs rather than the state attorney general.

If there's one thing I'd want a manufacturer to take from this, it's that the federal rulebook was never the whole rulebook. States were built into the system as the place where stricter standards happen, and for anyone selling into more than one of them, that's not a footnote. It's the compliance program.

Legal citations above reflect the cited statutes and regulations as of the date below; given the volume of pinpoint citations here, confirm current text and effective dates with qualified environmental counsel before relying on them for a specific facility or product line.

Last updated: 2026-09-05