PFAS in Drinking Water

The EPA's April 2024 final rule establishes five individual MCLs for specific per- and polyfluoroalkyl substances plus a Hazard Index for mixtures of four PFAS compounds. Compliance monitoring must be completed by April 26, 2027, and most utilities will first report PFAS results in their 2028 CCR — the report covering 2027 data, due July 1, 2028.

What PFAS are

Per- and polyfluoroalkyl substances are a class of thousands of synthetic chemicals that have been manufactured and used in industrial and consumer products since the 1940s. The carbon-fluorine bond that makes them useful — in nonstick cookware coatings, stain-resistant fabrics, food packaging, and firefighting foams — is also what makes them persistent. They don't break down readily in the environment or in the human body, earning the informal label "forever chemicals."

The EPA regulates PFAS under the Safe Drinking Water Act. The 2024 National Primary Drinking Water Regulation (NPDWR) for PFAS is the first time the agency has set enforceable drinking water limits for any PFAS compound. (89 FR 32532, April 26, 2024)

How PFAS get into drinking water

PFAS enter drinking water sources through several routes:

Industrial discharge and manufacturing sites. Facilities that produced or used PFAS compounds have historically discharged them to surface water and groundwater near their operations.

Aqueous film-forming foam (AFFF). Military bases, airports, and industrial fire training sites used PFAS-based AFFF for decades. Spills and routine testing deposited PFAS into soil and groundwater near many of these sites, and contamination has migrated into nearby drinking water supplies.

Landfill leachate. Consumer and industrial products containing PFAS end up in landfills. Leachate from these sites can carry PFAS into groundwater.

Wastewater treatment plant effluent. Conventional wastewater treatment does not fully remove PFAS. Surface water receiving treated effluent can carry PFAS into downstream drinking water intakes.

Agricultural application of biosolids. PFAS-laden biosolids applied to farmland have contaminated groundwater in several agricultural regions.

Groundwater-dependent systems — those drawing from wells near any of these sources — tend to carry higher PFAS detection rates than surface water systems, though the contamination geography varies significantly by region.

Health effects

Research on PFAS health effects has grown substantially since the early 2000s. ATSDR and EPA both maintain active research programs. The documented associations as of 2024 include:

The MCLG — the non-enforceable health goal set at the concentration where no known or anticipated adverse health effect occurs — reflects this evidence. For PFOA and PFOS, the MCLGs are zero (40 CFR § 141.62(c)), meaning there is no identified safe threshold. The MCLGs for PFNA, PFHxS, and HFPO-DA are set above zero but below the enforceable MCL.

PFAS exposure at the concentrations found in many drinking water systems represents a genuine public health concern, not a hypothetical one. The EPA's decision to set the PFOA and PFOS MCLs at 4 ng/L — as low as the agency determined was reliably measurable and achievable with treatment — reflects the weight of the health evidence.

The 2024 PFAS NPDWR: 5 MCLs plus a Hazard Index

EPA finalized the PFAS NPDWR on April 26, 2024 (89 FR 32532; document ID 2024-07773). The rule is authorized under the Safe Drinking Water Act, 42 U.S.C. § 300g-1, and adds new PFAS entries to 40 CFR § 141.61 and § 141.62. The statutory chain runs from SDWA (1996) through the America's Water Infrastructure Act (AWIA, 2018) to the 2024 final rule.

The rule sets five individual MCLs and one Hazard Index for four-PFAS mixtures:

| Compound | Full name | MCL | MCLG | |---|---|---|---| | PFOA | Perfluorooctanoic acid | 4.0 ng/L (ppt) | 0 | | PFOS | Perfluorooctane sulfonic acid | 4.0 ng/L (ppt) | 0 | | PFNA | Perfluorononanoic acid | 10 ng/L (ppt) | 10 ng/L | | PFHxS | Perfluorohexane sulfonic acid | 10 ng/L (ppt) | 10 ng/L | | HFPO-DA | Hexafluoropropylene oxide dimer acid (GenX Chemicals) | 10 ng/L (ppt) | 10 ng/L | | PFBS (Hazard Index only) | Perfluorobutane sulfonic acid | No individual MCL — regulated only via Hazard Index | — |

Source: 40 CFR § 141.61(c)(2); 89 FR 32532

Concentrations in this rule are expressed in nanograms per liter (ng/L), which is equivalent to parts per trillion (ppt). For reference, 4 ng/L is 4 parts per trillion — one drop of PFOA in roughly 17 million gallons of water. The analytical methods required to measure at these concentrations were not widely available until recently, which is one reason the rule could not have been promulgated much earlier.

What the Hazard Index means

The Hazard Index (HI) addresses a specific problem: PFNA, PFHxS, HFPO-DA, and PFBS individually may be present at concentrations below their individual MCLs (or, in PFBS's case, with no individual MCL at all), but their combined presence can still pose a health risk because these compounds act through similar biological mechanisms.

The Hazard Index MCL is 1 (unitless). A system calculates its HI by summing the ratios of each detected compound's measured concentration to its reference value:

HI = [PFNA / 10] + [PFHxS / 10] + [HFPO-DA / 10] + [PFBS / 2000]

If the sum exceeds 1, the system is in violation of the HI MCL, even if no single compound exceeds its individual limit. PFBS has no individual MCL; it only appears in the HI denominator, where its reference value of 2000 ng/L reflects the agency's current health risk estimate for that compound.

For a complete technical treatment of the HI calculation, see our PFAS Hazard Index glossary page.

Systems detecting any of these four compounds at any level should begin calculating their HI during compliance monitoring, not just checking for individual MCL exceedances.

Compliance and CCR reporting timeline

The PFAS NPDWR uses a phased compliance structure. The key dates, drawn from the final rule and 40 CFR §§ 141.153, 141.154, and 141.155, are:

April 26, 2024 — Rule effective date (June 25, 2024) The final rule was published April 26, 2024 (89 FR 32532) and took effect June 25, 2024. Systems became subject to the rule's monitoring requirements from this point forward.

April 26, 2027 — Initial monitoring complete Public water systems must complete initial compliance monitoring by April 26, 2027, three years after publication. Large systems (serving more than 10,000 connections, generally) must collect four quarterly samples. Smaller systems may be required to collect semi-annual samples. Primacy agencies assign monitoring schedules; check with your state drinking water program for your specific sampling requirements.

CCR reporting — first required in the 2028 CCR CCR reporting of regulated contaminants begins with the first calendar year for which compliance monitoring data exist (40 CFR § 141.153). For most systems, the first year of PFAS compliance data is calendar year 2027. That data goes into the 2028 CCR — the annual report covering 2027 data, which is due to customers by July 1, 2028.

Systems that begin quarterly monitoring in early 2027 will have data by mid-2027, but the CCR covering that data is the 2028 report (January 1, 2027 through December 31, 2027 data period).

Note: There is currently no CCR-specific boilerplate for PFAS in 40 CFR § 141.154. That section has not yet been updated to include mandatory PFAS health-effects language. Until EPA issues amended § 141.154 boilerplate, utilities should use technical language drawn from EPA's PFAS pages and the FR notice when reporting detected PFAS in their CCR. The 2027 rule changes page covers the broader set of reporting updates affecting the 2027 and 2028 CCR cycle.

April 26, 2029 — MCLs become enforceable Systems that find PFAS concentrations exceeding any MCL or the Hazard Index have until April 26, 2029 — five years after publication — to achieve compliance through treatment, source switching, or blending. This is the enforcement cliff, not the reporting cliff. Systems must report detected PFAS regardless of whether concentrations exceed an MCL.

Timeline summary:

| Date | What happens | |---|---| | April 26, 2024 | Rule finalized (89 FR 32532) | | June 25, 2024 | Rule effective | | April 26, 2027 | Initial monitoring complete | | July 1, 2028 | Most systems' first PFAS CCR reporting (covering 2027 data) | | April 26, 2029 | MCLs and Hazard Index become fully enforceable; treatment required if exceeded |

What this means for California water systems

California water systems face a more complex PFAS compliance picture than the federal baseline alone would suggest.

Federal floor plus state monitoring orders. California's Division of Drinking Water (DDW) has issued General Orders requiring community water systems and non-transient non-community systems to monitor for PFAS — an obligation that predates and runs alongside the federal NPDWR. Many CA CWS have already been collecting PFAS data under UCMR 5 (the EPA's Unregulated Contaminant Monitoring Rule, Fifth Edition) and DDW's orders. Systems that have been monitoring under these programs are better positioned for the 2027 compliance deadline.

State notification and response levels. California has established notification levels (NLs) and response levels (RLs) that operate alongside — and in some cases at the same threshold as — the federal MCLs. As of late 2025, California's NLs for PFOA and PFOS are both 4.0 ng/L, consistent with the federal MCL. Response levels are set higher (40 ng/L for PFOS, for example). When a source water exceeds a response level, California DDW requires the system to remove that source, treat it, or issue public notification — an obligation that runs before the 2029 federal enforcement date.

Public Health Goals. On April 5, 2024, California's Office of Environmental Health and Hazard Assessment (OEHHA) adopted Public Health Goals (PHGs) for PFOA (0.007 ng/L) and PFOS (1 ng/L). PHGs are not MCLs; they are non-enforceable health-based benchmarks that inform California's MCL rulemaking process. California CCRs must include a reference to PHGs and explain their relationship to the MCL, a requirement that already applies to other regulated contaminants under California Health & Safety Code § 116470. Systems should expect the same requirement to apply to PFAS once California finalizes its own MCLs.

State MCL rulemaking ongoing. As of 2026, California has not yet adopted its own PFAS MCLs through formal rulemaking. The federal MCLs are the operative standard for now. Systems should monitor DDW's PFAS MCL rulemaking record for state-specific developments that may affect CCR content requirements before the 2028 reporting deadline.

For a full breakdown of California-specific CCR requirements, see our California water systems CCR page.

Last reviewed: 2026-05-03. Next scheduled review: every 6 months or after EPA PFAS rule milestones.

Schema markup