Heavy Metal Testing for Bulk Cocoa, Spices & Specialty Ingredients: California Prop 65 & FDA Action Levels Explained

Heavy metal contamination is now a routine line item on Quality Assurance (QA) audits for cocoa, spices, and several specialty categories. Consumer Reports cocoa testing, the FDA's Closer to Zero initiative, and California Proposition 65 enforcement have tightened buyer expectations. The guide below covers where lead, cadmium, arsenic, and mercury come from, how FDA action levels differ from Prop 65, and how to write enforceable testing into supplier specs and Purchase Orders (POs).

Why Cocoa, Spices, and Specialty Ingredients Carry the Most Risk

Heavy metals enter food crops mainly through soil and water uptake. The most exposed categories grow in regions with high mineralization or industrial contamination and use processing with limited removal steps.

Where Lead and Cadmium Come From

Cadmium in cocoa is largely geographic, with higher levels in volcanic soils of Latin America. Lead in cocoa is mainly post-harvest, picked up during drying and transport. Lead and arsenic in spices often come from adulteration (lead chromate in turmeric) and grinding equipment.

Soil, Geography, and Processing

Spices grown near industrial fallout or roadways carry higher lead loads. Root crops concentrate cadmium more than leafy plants. Long fermentation and natural drying can add metals if water and surfaces are not controlled.

High-Risk Categories

Highest-scrutiny categories are:

• Cocoa and cacao powder, nibs, butter

• Spices (turmeric, ginger, cinnamon, paprika, chili powders)

• Rice and rice-based ingredients (arsenic)

• Botanicals and herbal extracts

FDA Action Levels vs California Prop 65 Thresholds

The two frameworks share lab methods but apply different math.

How FDA Action Levels Work

FDA action levels are concentration limits on the food itself, expressed in parts per million (ppm) or parts per billion (ppb). The numbers carry real enforcement weight, with finished products testing above the limit subject to seizure, recall, or import refusal at the port. The Closer to Zero plan is progressively tightening the numbers for foods commonly consumed by infants and young children, with several categories moving first:

• Apple juice and other single-strength juices (inorganic arsenic)

• Infant rice cereals and grain-based purees

• Root vegetable purees (carrots, sweet potato)

• Processed foods marketed for babies and toddlers

Action levels vary by category and intended consumer, so the same metal can carry different limits across SKUs. Cocoa and spice ingredients usually fall under category-specific guidance rather than blanket limits.

Why Prop 65 Is the Tighter Standard

Prop 65 applies daily exposure thresholds rather than concentration limits, which is what makes it a tougher gate for retail placement in California. Manufacturers calculate expected per-serving exposure based on the finished product and label serving size, then compare against the threshold. 

The two numbers most relevant for cocoa and spices are:

• Maximum Allowable Dose Level (MADL) for lead, 0.5 micrograms (μg) per day

• No Significant Risk Level (NSRL) for cadmium, 4.1 μg per day

Exceeding either triggers a Safe Harbor warning on the label, which most national retailers will not accept. Enforcement is largely driven by private settlements rather than government action, which raises the financial risk and the speed at which a non-compliant SKU can land in litigation.

Which Retailers Enforce Prop 65 in Supplier Audits

Major California-facing retailers push Prop 65 compliance back through the supply chain rather than absorbing the risk themselves. The list of channels treating Prop 65 as a routine audit line keeps growing:

• National grocery chains (Kroger, Albertsons, Whole Foods)

• Club stores (Costco, Sam's Club)

• Online marketplaces (Amazon, Walmart.com)

• Natural and specialty channels (Sprouts, Erewhon)

Audit teams typically require lot-level heavy metal Certificates of Analysis (COAs), calculation of expected per-serving exposure, supplier indemnification in master purchase agreements, and annual third-party testing on high-risk SKUs. A Prop 65 settlement can run six to seven figures, and plaintiff firms actively monitor shelves and online listings for non-compliant labels. One consent decree can pull an entire SKU from California distribution, which is why retailer audit teams treat the framework as a procurement gate.

Building Heavy Metal Testing Into Supplier Specs

A spec sheet without heavy metal language usually fails an audit.

COA Requirements and Test Methods

The reference method for heavy metals in food is Inductively Coupled Plasma-Mass Spectrometry (ICP-MS), which detects lead, cadmium, arsenic, and mercury at the parts-per-billion level. The spec should require:

• Test method (ICP-MS, USP <232> or <233> for some categories)

• Detection limits (Limit of Detection (LOD), Limit of Quantification (LOQ))

• Reporting units (ppm or ppb)

• Accredited lab (ISO 17025 or equivalent)

Testing Frequency and Lot Coverage

Risk-based testing usually runs:

• Every lot for high-risk SKUs (cocoa, turmeric, ginger, rice)

• Quarterly or semi-annual for moderate-risk SKUs

• Annual for low-risk commodity ingredients

Frequency tightens during launches, qualification, and after adverse findings.

Language for Specs and POs

Robust supplier language includes maximum allowable levels per metal, the test method, lot-level COA, Prop 65 indemnification, and a right-to-test clause for buyer-initiated third-party testing. The clause should define action on out-of-spec lots: quarantine, retest, reject, or rework.

Wrapping Up

Heavy metal compliance is no longer optional for cocoa, spices, and several specialty categories. FDA action levels set the regulatory floor, Prop 65 sets the practical ceiling for retail placement, and supplier audits enforce both. Writing test method, frequency, indemnification, and out-of-spec response into the supplier agreement separates a passing program from one that creates risk.

Need bulk cocoa, spices, or specialty ingredients with lot-level heavy metal COAs? Contact Global Resources Direct for same-day quotes, competitive pricing, and flexible minimums.

Frequently Asked Questions

What FDA action levels currently apply to lead, cadmium, arsenic, and mercury in cocoa and spice ingredients?

FDA publishes action levels for specific food categories (particularly foods for infants and young children under Closer to Zero) rather than blanket limits across all ingredients. Always check current FDA guidance for the finished product category before finalizing a spec.

How do California Prop 65 thresholds differ from FDA action levels, and which retailers enforce Prop 65 in their supplier audits?

Prop 65 sets daily exposure thresholds (0.5 μg/day lead, 4.1 μg/day cadmium) on the finished product per serving, not concentration limits on the ingredient. Major California-facing retailers, including national grocery chains, club stores, and online marketplaces, enforce Prop 65 in supplier audits.

What testing frequency and lot coverage should a bulk cocoa or spice supplier maintain?

High-risk SKUs (cocoa, turmeric, ginger, rice) typically receive lot-by-lot testing. Moderate-risk SKUs run quarterly or semi-annually. Frequency tightens during qualification audits, product launches, and after out-of-spec findings.

How should procurement teams structure heavy-metal language in supplier specification sheets and POs?

Include maximum allowable level per metal, test method (ICP-MS or USP <232>/<233>), accredited lab requirement (ISO 17025), lot-level COA delivery, Prop 65 indemnification, right-to-test clause, and action on out-of-spec lots.

What test method is the industry standard for heavy metals in bulk food ingredients?

ICP-MS is the standard reference method, detecting lead, cadmium, arsenic, and mercury at the parts-per-billion level. USP <232> and <233> provide the procedural framework for many regulated categories.

Does third-party testing replace supplier COAs or supplement them?

Third-party testing supplements rather than replacing the supplier COAs. Many buyers run annual or quarterly verification testing on high-risk SKUs to validate supplier data and protect against COA fraud. The right-to-test clause should appear in every supplier agreement.