The new EU limits, and what they change for a face mask

Commission Regulation (EU) 2026/909 was adopted on 27 April 2026, published in the Official Journal the following day, and came into force on the twentieth day after that: 18 May 2026. It amends the EU Cosmetics Regulation, 1223/2009, which is the law every product in this catalogue is sold under. Twelve substances are named in its title. Three of them turn up in face masks, and this piece is about those three: Benzyl Salicylate, Citral and aluminium-containing ingredients.

of 215 masks here declare one of the three

28of 215 masks here declare one of the threecounted from the printed INCI lists, not from a status field

when non-compliant stock may no longer be placed on the market

1 Jan 2027when non-compliant stock may no longer be placed on the marketand 1 July 2028 before it may no longer be sold

of 215 packs tell you to rinse the mask off

58of 215 packs tell you to rinse the mask offwhich is what decides the limit that applies to it

Two of the other nine are worth naming precisely because this catalogue contains neither. Triphenyl Phosphate, a plasticiser, is now prohibited outright: the regulation records that the Scientific Committee on Consumer Safety could not conclude on its safety because the information industry provided was insufficient to exclude potential genotoxicity. It appears in none of these 215 masks. Silver zinc zeolite moved the other way, out of the prohibited list and into the permitted preservatives, capped at 1% in spray deodorant and powder foundation and only where the silver content of the zeolite stays under 2.5%. Neither of those is a mask, and the ingredient appears in none of them.

Water-soluble zinc salts were rewritten too, and that one is easy to misread. The new rows are about toothpaste and mouthwash; the row a face mask falls under is “other products”, still capped at 1% as zinc, exactly as before. 6 masks here declare one of the salts named in that entry, and nothing about them has changed.

The new limits took effect in May, but they do not bite on any product yet. The transitional footnote gives two dates, and the difference between them is the difference between two definitions in the parent regulation.

From 1 January 2027, non-compliant products may not be placedon the Union market. Placing on the market means “the first making available” of a product: the moment it enters the market at all. From 1 July 2028, they may not be made available, which is defined as any supply in the course of a commercial activity, paid or free. That is the date a shop can no longer sell through the stock it already holds.

So there is an eighteen-month window in which a mask on a shelf may lawfully predate the limits, and nothing you already own is affected at any point: the two prohibitions bind the people selling a product, not the person who has bought it. There is nothing to throw away.

The limits are not written as one number per ingredient. They are written as a table of product types, and a face mask does not sit in one row of it. A mask you rinse off is a rinse-off skin product; a mask you leave on, or peel, or sleep in, is a leave-on skin product. The same tube of ingredients meets a different ceiling depending on what the pack tells you to do at the end.

Citral is allowed at eight times the concentration in a mask you wash off. Aluminium runs the other way, and harder: the rinse-off ceiling is very nearly twelve times stricter than the one for a face product left on the skin. Benzyl salicylate does not care either way, and lands on 0.5% whatever you do with it.

There is no general rule hiding in that, and it is worth resisting the one that suggests itself. Rinsing is not inherently safer or more permissive. Each substance was assessed on its own, against how much of it a person is actually exposed to in each kind of product, and the direction of the difference is a property of the substance rather than of the format. The regulation records the committee’s conclusions in the same terms: citral safe “in relation to the induction of sensitisation at the concentrations proposed by the industry”, aluminium safe “under specific conditions of use”. The numbers in the table are those conditions, written into law.

Which leaves a practical question that this site is unusually well placed to answer: which row is your mask in? The pack decides it. 58 of the 215 masks here print an instruction to rinse or wash the mask off; the remaining 157 do not, and are leave-on products for this purpose - sheet masks whose essence is patted in, overnight masks, and every other kind that ends without a tap.

Counted across 215 masks from 89 brands: 28 declare at least one of the three. Citral appears in 13, Benzyl Salicylate in 6, and an ingredient with aluminium in its name in 17. There are only four of those names in the whole corpus - Aluminum Glycinate, Aluminum Hydroxide, Calcium Aluminum Borosilicate and Magnesium Aluminum Silicate, spelled the American way because INCI is.

By format, the citral masks are 6 clay, 3 cream, 3 sheet and 1 wash-off. The 6 carrying benzyl salicylate are DERMASEL Totes Meer Anti-Age Tuchmaske, DERMASEL Totes Meer Mineralien Nährende Arganöl Maske, LA MER Ultra Booster Premium Mask Effect, lavera Hydro Tuchmaske, Luvos-Heilerde Vital-Maske and Santé Naturkosmetik Skin Vitality Maske Parakresse.

One thing this count is not: a list of masks that are over a limit. It is a list of masks that print the ingredient. An INCI list carries no concentrations, so nothing here says whether any of these products is anywhere near 0.15% or 0.89%. Most will be nowhere close.

The aluminium entry is written as a class rather than as a list of ingredients. It covers “aluminium-containing ingredients”, with the exceptions given only as entry numbers in four annexes. That wording is broader than the four INCI names above, because a great many minerals contain aluminium without saying so in their name.

Talc is dealt with explicitly: it gets a row of its own, at 2.0% as Al. The reasoning is in the committee’s opinion, and it is about availability rather than quantity - aluminium in talc is not bioavailable, so it does not count towards what a body absorbs. Kaolin, Bentonite, Mica, Illite and Montmorillonite are aluminosilicates too, and they get no row and no named exception. 36 masks here declare at least one of them, and in 28 of those it sits in the first five lines of the list rather than in the tail - a base rather than a trace.

Citral and benzyl salicylate are on these lists at all because of a labelling duty that this regulation did not touch: as fragrance allergens they must be declared by name above 0.001% in a leave-on product and 0.01% in a rinse-off one. Their presence therefore tells you they cleared a threshold of a thousandth of a per cent. It does not tell you they cleared anything else.

The ≈1% line is where that runs out. Citral sits below the line in 13 of the 13 masks that carry it, and benzyl salicylate in 6 of 6- and below the line, INCI order stops carrying information at all. The new leave-on limits, 0.15% and 0.5%, are inside that fog. Neither a reader nor this site can check them from the box. The one new limit that does sit above the line is citral’s rinse-off ceiling of 1.2%, and even there the list only tells you the ingredient is under about 1%, which is a different statement from telling you it complies.

Compliance is not a thing a label can demonstrate, and it was never designed to. It is established in the product safety assessment every manufacturer must hold before selling. What the list does tell you is whether the ingredient is present at all, which is the fact a reader can actually act on - and it is exactly as informative today as it was in April.

1. Nothing, if the question is what to throw away. The prohibitions bind selling, not owning, and the first of them is in 2027.
2. If you react to a fragrance allergen, its name on the list is still the fact that matters. The labelling thresholds are unchanged, so a mask that declares Citral today declares it for the same reason it did before. The fragrance-free filter is the blunt version of the same answer.
3. Read the last line of the instructions, not the front of the box. Rinse or no rinse is what decides which ceiling applies, and for citral and aluminium the two ceilings are a long way apart.
4. Expect reformulation rather than announcements. Manufacturers have until January 2027 to stop placing non-compliant product on the market, and the usual response is a quietly adjusted formula rather than a withdrawal.