FALCPA and Cross-Contact: What the Law Says About Shared Equipment

Food allergen labeling in the United States has come a long way since the early 2000s, but one of the most persistent grey areas for food business owners remains the question of shared equipment and cross-contact. You can list every intentional ingredient perfectly on your label and still expose a customer to a life-threatening allergen through a piece of machinery that processed peanuts an hour before your product ran through it. For small and mid-sized food businesses selling through Shopify, this gap between what the law requires and what customers actually need to know creates real compliance and liability risk.

The Food Allergen Labeling and Consumer Protection Act (FALCPA), signed into law in 2004, established the framework that most US food businesses still operate under today. But FALCPA's requirements around cross-contact and shared equipment are widely misunderstood — and that misunderstanding leads to both under-disclosure and over-disclosure, each carrying its own set of problems. Some businesses plaster "may contain" warnings across everything out of excessive caution, while others say nothing and leave customers guessing.

In this post, you will learn exactly what FALCPA requires regarding cross-contact, what voluntary advisory statements are permitted, how the FDA views shared equipment scenarios, and what practical steps your business should take to stay compliant while building genuine customer trust around allergen safety.

What FALCPA Actually Requires — and What It Doesn't

FALCPA mandates that manufacturers disclose the presence of any of the nine major food allergens — milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame — when those allergens are intentionally added as ingredients. The law requires this disclosure either in the ingredient list itself, using plain language (for example, "whey (milk)"), or in a separate "Contains:" statement immediately following the ingredient list. This requirement applies to packaged foods regulated by the FDA and sold in the United States, which includes most food products sold through Shopify stores shipping to US customers.

What FALCPA does not do is mandate disclosure of unintentional allergen presence resulting from cross-contact. If your facility processes both peanut-containing and peanut-free products on shared lines, FALCPA does not legally require you to say so on the label. The FDA has consistently treated advisory statements — phrases like "may contain peanuts" or "manufactured in a facility that also processes tree nuts" — as voluntary. This distinction matters enormously because it means the absence of a "may contain" warning is not a legal guarantee that a product is allergen-free.

This creates a significant responsibility gap for business owners. Customers with severe allergies often interpret the absence of an advisory statement as a safety signal, when legally it means almost nothing. Understanding that FALCPA's mandatory provisions and the voluntary advisory framework operate as two separate layers is the foundational knowledge every food business owner needs before making any labeling decisions around shared equipment.

How the FDA Defines Cross-Contact

Cross-contact occurs when an allergen is inadvertently transferred from one food to another through shared surfaces, equipment, utensils, or the air in a production environment. The FDA distinguishes cross-contact from cross-contamination, which typically refers to microbial transfer — a distinction that matters in regulatory conversations but is often blurred in everyday business practice. For allergen purposes, even trace quantities of a major allergen transferred during production can trigger a reaction in highly sensitive individuals, which is why the FDA takes the issue seriously in both guidance documents and enforcement actions.

The FDA's Current Good Manufacturing Practice (cGMP) regulations, found in 21 CFR Part 117, require food facilities to take reasonable precautions to prevent allergen cross-contact. These precautions include physical separation of allergen-containing ingredients, rigorous equipment cleaning protocols, and proper scheduling of production runs. Critically, the cGMP framework does not specify exactly how clean is clean enough — it uses a reasonableness standard, which means the adequacy of your cleaning procedures will be judged in the context of the specific allergens involved and your production environment.

For a Shopify merchant producing food products in a shared commercial kitchen or co-manufacturing facility, this regulatory landscape means that "we clean between runs" is not a compliance statement on its own. You need documented cleaning procedures, validation data where possible, and a clear understanding of which allergens your facility or co-manufacturer handles. Without that documentation, you are exposed both to regulatory risk and to civil liability if a customer has an allergic reaction.

Advisory Statements: Voluntary Doesn't Mean Unregulated

Because advisory statements are voluntary under FALCPA, many business owners assume they can write whatever they like — or nothing at all. The FDA's position is more nuanced. While the agency does not require "may contain" language, it also prohibits statements that are misleading. A label claiming a product is "peanut-free" when peanuts are processed on the same line could constitute a false or misleading statement under Section 403 of the Federal Food, Drug, and Cosmetic Act, regardless of FALCPA's voluntary advisory framework.

The FDA has issued draft guidance on voluntary allergen advisory statements, most recently updated in 2022, recommending that businesses only use such statements when there is a genuine, demonstrated risk of cross-contact based on a thorough allergen risk assessment. The guidance specifically discourages the use of precautionary statements as a blanket liability shield when no real cross-contact risk has been evaluated. In plain terms, this means you should not add "may contain nuts" to a product simply because your co-manufacturer also makes nut products somewhere in their facility — the risk needs to be real and assessed.

For Shopify food businesses, the practical implication is that your advisory statement policy should be driven by documented risk assessment, not by legal anxiety or marketing instinct. If your facility genuinely shares equipment with allergen-containing products and cleaning validation is incomplete, a "may contain" statement is both honest and legally defensible. If there is no realistic cross-contact pathway, using advisory language could undermine customer trust and create the impression that your entire product line carries allergen risks it does not actually have.

Shared Equipment Scenarios: Three Common Situations

Consider three scenarios that Shopify food businesses frequently encounter. First, you produce your own products in a dedicated home or commercial kitchen and you also process ingredients containing a major allergen for a different product line — a bakery selling both nut-free cookies and almond bark, for example. In this case, FALCPA requires disclosure of the almond in the almond bark, but your nut-free cookies carry cross-contact risk that should be assessed and, if real, disclosed through a voluntary advisory statement.

Second, you use a co-manufacturer or shared production facility where you have limited visibility into what else is being produced. This is increasingly common among Shopify merchants scaling up from cottage production to third-party manufacturing. In this scenario, you are legally responsible for the accuracy of your label even though you do not control the production environment directly. You need written allergen risk information from your co-manufacturer and should contractually require them to notify you of any changes to their allergen inventory or production schedules that could affect your products.

Third, you are a reseller or multi-vendor marketplace operator listing food products from multiple suppliers. In this case, your allergen disclosure obligations depend on whether you are the legal "manufacturer" under FALCPA or whether you are simply fulfilling and distributing. If you are repackaging or creating private-label products, FALCPA applies to you directly. Managing this complexity across a large product catalogue is exactly the kind of challenge that a dedicated tool like Allergen Matrix is designed to solve — tracking allergen data at the product level and surfacing disclosure gaps before they become compliance problems.

Documentation and the Role of Allergen Risk Assessments

A formal allergen risk assessment is not legally mandated for most small food businesses under FALCPA, but it is the practical foundation of any defensible labeling program. A basic risk assessment for shared equipment cross-contact should identify every major allergen handled in your production environment, map the contact points where cross-transfer could occur, evaluate your cleaning procedures against the residue levels those procedures are likely to achieve, and assign a risk level to each product in your range. This does not need to be a hundred-page document — a clear, dated, signed one-page assessment per product line is far more useful than no documentation at all.

Where this becomes operationally important for Shopify merchants is at the intersection of your product catalogue and your online store's allergen information. If your risk assessment concludes that a product carries a genuine cross-contact risk for tree nuts, that information needs to flow from your internal records through to your product listings, your packaging, and any allergen filters or declarations you display on your storefront. Gaps between your internal documentation and your customer-facing information are where liability concentrates.

Retailers like Selfridges and corporate clients like Accenture or Red Bull will often request allergen documentation as part of their supplier onboarding process, and informal or undocumented risk assessments will not satisfy those requirements. Building a systematic allergen documentation habit from the beginning — even when your Shopify store is small — positions you to scale into retail and wholesale channels without scrambling to reconstruct records you should have been keeping all along.

What Happens When Things Go Wrong

When a customer has an allergic reaction to a product and cross-contact is implicated, the regulatory and legal exposure for a food business can be severe. The FDA has authority to require product recalls, issue warning letters, and pursue civil penalties under the Federal Food, Drug, and Cosmetic Act. In cases where a labeling deficiency contributed to a serious adverse event, the agency can escalate to criminal referral. For a Shopify merchant, a recall is not just a regulatory event — it typically means pulling listings, notifying customers, managing logistics, and absorbing costs that can run into tens of thousands of dollars for even a relatively contained product range.

Civil liability from allergen-related injuries operates independently of regulatory enforcement. A customer injured by undisclosed allergen cross-contact may have grounds for a negligence or products liability claim, and the adequacy of your labeling and risk assessment documentation will be central to your defense. Courts have consistently looked at whether businesses followed industry standards and FDA guidance, not just whether they technically complied with FALCPA's mandatory disclosure provisions.

The practical takeaway is that allergen compliance is not a one-time labeling exercise — it is an ongoing operational commitment. Staff training, supplier communication, production scheduling, and cleaning validation all feed into the quality of your allergen disclosures. Building those systems now, while your business is manageable, is far less costly than reconstructing them in response to a complaint, a regulatory inquiry, or worse.

Conclusion

FALCPA creates a clear mandatory floor for allergen labeling in the United States, but the shared equipment and cross-contact question lives largely in the voluntary layer above that floor — and that is precisely where careful food business owners need to focus their attention. Understanding the difference between mandatory ingredient disclosure and voluntary advisory statements, grounding any advisory language in documented risk assessment, and maintaining clear records that can withstand regulatory or legal scrutiny are the three practical pillars of a defensible allergen labeling program.

For Shopify food businesses managing multiple products, co-manufacturing relationships, or wholesale supply chains, the operational challenge of keeping allergen information accurate and consistent across every customer touchpoint is real and ongoing. The businesses that get this right are the ones that treat allergen management as a system, not a series of one-off labeling decisions.

Try Allergen Matrix free at saltai.app — no credit card required.