FDA's gluten-free labeling rule under 21 CFR 101.91 defines a voluntary claim — brands are not required to label products as gluten-free, but when they do, the product must meet specific requirements. Using "gluten-free," "free of gluten," "without gluten," or "no gluten" on a food label that doesn't meet the standard is a misbranding violation.
The primary standard: less than 20 ppm of gluten in the finished product.
Twenty ppm is the scientifically established threshold below which most people with celiac disease can consume a food without triggering an immune response. It is not zero gluten — it's the level at which FDA determined the claim becomes meaningful for the intended audience.
What Makes a Product Non-Gluten-Free
Under 21 CFR 101.91(a)(3), a food is considered to contain gluten if it:
Contains a gluten-containing grain (wheat, rye, barley, or their crossbred varieties)
Is derived from a gluten-containing grain and has not been processed to remove gluten (e.g., wheat starch that hasn't been processed to reduce gluten to <20 ppm)
Is derived from a gluten-containing grain, was processed to remove gluten, but still contains ≥20 ppm of gluten
Wheat-derived ingredients: Products that contain wheat flour, wheat starch (unless specially processed), wheat germ, wheat bran, spelt, kamut, durum, emmer, or einkorn contain gluten. Wheat-derived ingredients appear in many compound ingredients and flavoring systems — hydrolyzed wheat protein is a common flavor enhancer, for example, and requires gluten review.
Barley and rye: Less commonly identified but equally regulated. Barley malt, barley flour, rye flour, and related ingredients contain gluten. Malt vinegar is derived from barley and is not gluten-free. Malt flavoring is barley-derived.
Crossbred varieties: Triticale (a wheat-rye hybrid) is covered. Spelt and kamut are ancient wheat varieties and are covered.
The Oats Question
Oats are the most complex ingredient in gluten-free labeling. Oats themselves don't contain gluten — they contain a protein called avenin, which is distinct from the gliadin and glutenin proteins in wheat, rye, and barley. Most people with celiac disease can tolerate oats.
However, conventional oats are almost universally contaminated with wheat, rye, or barley gluten through commingled farming, transportation, and processing equipment. Conventional rolled oats typically test well above 20 ppm of gluten.
For a product to be labeled gluten-free while containing oats:
The oats must be purity protocol oats — grown, harvested, and processed under controls that prevent cross-contamination with gluten-containing grains — and the finished product must test at <20 ppm
OR the oats must be mechanically sorted to remove gluten-containing grain seeds — a lower-rigor approach that may not reliably achieve <20 ppm
A small subset of people with celiac disease react to avenin in oats regardless of cross-contamination. Some gluten-free certification programs exclude oats entirely for this reason. For brands targeting the celiac community specifically, oat inclusion should be disclosed even when the product meets the <20 ppm standard.
Cross-Contact in Manufacturing
Cross-contact — the inadvertent introduction of gluten into a product through shared equipment, shared production lines, or shared facilities — is one of the most common ways a product that should be gluten-free ends up with measurable gluten levels.
FDA's gluten-free rule does not specify manufacturing controls — it only specifies the finished product standard (<20 ppm). But maintaining a <20 ppm level in a facility that also processes wheat-containing products requires specific controls:
Dedicated equipment for gluten-free production runs, or validated cleaning procedures between runs
Production scheduling that minimizes cross-contact risk (gluten-free runs before wheat runs, not after)
Environmental monitoring to detect gluten cross-contact
Finished product testing to verify the <20 ppm standard is being met
Brands that manufacture on shared equipment without validated controls are at significant risk of having gluten levels above 20 ppm in products labeled gluten-free — which is a misbranding violation regardless of whether the ingredients themselves are gluten-free.
"Certified Gluten Free" vs. "Gluten Free"
"Certified gluten free" and "gluten free" are two different claims with different regulatory and commercial implications.
"Gluten free" (FDA definition): The product must contain <20 ppm of gluten. No third-party testing or certification is required — the brand is responsible for ensuring the standard is met.
"Certified gluten free" (third-party certification): Organizations like the Gluten-Free Certification Organization (GFCO), NSF, and others certify products that meet their specific standards — which are often more stringent than FDA's rule. GFCO, for example, requires <10 ppm. Certification involves facility audits, product testing, and ongoing compliance monitoring.
For brands selling to celiac consumers specifically, third-party certification carries significant commercial value because it provides independent verification. For brands that want to use the "gluten free" claim without the certification overhead, FDA's standard is legally sufficient — but the brand bears the full responsibility for verifying the <20 ppm standard in production.
Restaurant and Foodservice Exemption
FDA's gluten-free labeling rule applies to packaged foods regulated by FDA. It does not directly apply to restaurant menu items. However, FDA has made clear that restaurants are not exempt from the general misbranding prohibition — a restaurant that represents a menu item as "gluten free" when it contains gluten may face state consumer protection actions and FTC scrutiny, even if the FDA packaged food rule doesn't technically apply.
For CPG brands that sell to foodservice channels: the packaged food FDA rule applies to the CPG product, regardless of what the foodservice operator does with it after purchase.
Gluten-Free Labeling for Dietary Supplements
The gluten-free labeling rule applies to dietary supplements as well as conventional foods. Supplements with tablets, capsules, or powder formulations may contain wheat-derived excipients (microcrystalline cellulose from wheat, pregelatinized wheat starch as a binder, maltodextrin from wheat). These ingredients trigger the same <20 ppm requirement if the supplement is labeled gluten-free.
For supplement brands: review every excipient, coating, capsule shell, and processing aid for wheat-derived sources. Hydroxypropyl methylcellulose (HPMC) capsules are plant-derived but not wheat-derived. Gelatin capsules are animal-derived. Starch-based binders and coatings are the primary risk area.
Practical Testing Requirements
FDA's rule doesn't mandate specific testing frequency or methods — it requires that the finished product contain <20 ppm. In practice, brands should:
Test finished product lots periodically to verify compliance
Use validated gluten testing methods — competitive ELISA tests for gluten (R5 sandwich ELISA or equivalent) are the standard
Maintain testing records as part of labeling substantiation documentation
Revalidate when formulations or manufacturing processes change
A single passing test from product development doesn't establish ongoing compliance — production variability, ingredient changes, and facility changes can all affect gluten levels in subsequent production runs.
The 20 PPM Standard Is the Floor, Not the Target
For brands in the gluten-free category, meeting the <20 ppm standard is a legal baseline. The competitive and consumer-trust standard in the category has moved toward third-party certification and lower thresholds. Understanding both the regulatory floor and the category expectations is the starting point for building a gluten-free compliance program.
Truli's AI compliance platform reviews gluten-free claims on food and supplement labels — flagging wheat-derived sub-ingredients in compound ingredients, evaluating whether manufacturing controls are documented, and checking for required labeling elements. Book a demo to see how Truli handles gluten-free label compliance.
