Drinking Water Standards: PFAS Limits, Lead Lines, and Notices

The Environmental Protection Agency sets enforceable drinking water standards under the Safe Drinking Water Act that cap how much of each regulated contaminant can reach your tap, require public water systems to test regularly, and require those systems to tell customers when something is wrong. The rules cover roughly 150,000 public water systems serving most Americans. They do not cover private wells that serve fewer than 25 people, which fall entirely outside federal drinking water law.¹

What the Standards Cover

A “public water system” under federal regulations is any system that pipes water for human consumption to at least 15 service connections or regularly serves an average of at least 25 people daily for at least 60 days a year.² That definition sweeps in big-city utilities, small residential communities, and businesses running their own supply. It doesn’t reach smaller private wells at all.

The Safe Drinking Water Act, codified at 42 U.S.C. §300f and following sections, gives the EPA authority to set standards that these systems must meet to protect against naturally occurring and industrial contaminants.³ The law creates a federal floor. No public water system anywhere in the country can lawfully deliver water worse than what the EPA permits, regardless of local industry or geography.

How the Standards Work

The National Primary Drinking Water Regulations are the legally enforceable standards, and they apply to every public water system in the country.⁴ They work through two related concepts.

For each regulated contaminant, the EPA first sets a Maximum Contaminant Level Goal (MCLG). That’s the concentration at which no known or anticipated health risk exists, with a margin of safety. MCLGs are not enforceable, because they don’t account for whether current technology can actually detect or remove the contaminant down to that level. For some of the most dangerous contaminants, the goal is zero.⁵

The enforceable number is the Maximum Contaminant Level (MCL), the highest permissible level of a contaminant in water delivered to any customer.⁵ The EPA sets each MCL as close to the goal as feasible using the best available treatment technology and considering cost. Exceeding an MCL triggers legal consequences, including mandatory public notice.

When it isn’t economically or technically feasible to measure the exact concentration, the EPA can require a specific treatment technique instead of a numerical MCL.⁶ Lead is the best-known example: the rules require corrosion control treatment and set action levels that trigger additional interventions. Systems drawing from surface water must also meet treatment technique requirements for pathogens, including at least 99.9% removal of Giardia and 99.99% removal of viruses before water reaches the first customer.⁴

Who Actually Enforces the Rules

Day-to-day oversight usually isn’t the EPA. The agency delegates primary enforcement authority, called “primacy,” to state and territorial governments that adopt regulations at least as strict as the federal ones. Currently, 49 states, U.S. territories, and the Navajo Nation hold primacy for the drinking water program.⁷ In practice, your state environmental or health agency handles inspections, reviews monitoring data, and takes initial enforcement action. The EPA retains backstop authority and can step in with administrative orders if a state fails to act.

New PFAS Limits

In April 2024, the EPA finalized the first national drinking water standards for per- and polyfluoroalkyl substances, known as PFAS or “forever chemicals.” These synthetic compounds resist breaking down in the environment and have been linked to cancer, immune system effects, and developmental problems. The rule sets enforceable MCLs for five individual compounds:⁸

PFOA: 4.0 parts per trillion
PFOS: 4.0 parts per trillion
PFHxS: 10 parts per trillion
PFNA: 10 parts per trillion
HFPO-DA (GenX chemicals): 10 parts per trillion

The rule also sets a “Hazard Index” of 1 for mixtures containing two or more of PFHxS, PFNA, HFPO-DA, and PFBS. That means the combined risk from a mix of these chemicals is regulated even when no single compound exceeds its individual limit.⁹ Compliance is measured using running annual averages at the sampling point.

Public water systems must complete initial PFAS monitoring and begin reporting results to customers by 2027.⁸ The original rule gave systems until 2029 to install treatment and meet the MCLs. As of early 2026, the EPA has proposed extending that compliance deadline to 2031 to give water systems more time to design and build treatment infrastructure, with a final rule expected in spring 2026.¹⁰ The MCLs themselves are not changing, only the timeline for systems to meet them.

Lead Service Line Replacement

Lead in drinking water typically doesn’t come from the source water. It comes from lead service lines, solder, and fixtures in the distribution system and inside buildings. The EPA’s Lead and Copper Rule Improvements, finalized in 2024, require drinking water systems across the country to identify and replace all lead service lines within 10 years.¹¹

Key deadlines include a baseline service line inventory due by November 1, 2027, inventory validation by the end of 2034, and full replacement of all lead service lines by December 31, 2037. Systems must begin submitting annual inventory updates by January 30, 2029.¹² For a homeowner, the practical point is that your water system should be able to tell you whether a lead service line connects your property, and if one does, the system is responsible for replacing it at no direct cost to you.

Secondary Standards for Taste and Appearance

Secondary regulations address contaminants that affect how water looks, tastes, or smells rather than posing direct health threats. Iron, manganese, and sulfate are typical examples. They can stain laundry, produce a metallic taste, or make water appear cloudy, but at levels normally found in public supplies they don’t create health risks.¹³

These secondary limits are not federally enforceable. They function as guidelines for states, which can adopt them into their own regulations and make them binding within their borders. States can also set their own secondary standards higher or lower than the federal guidelines based on local conditions, so aesthetic water quality varies more from place to place than the health-related standards do.

When Your Water System Has to Tell You Something Is Wrong

Federal regulations require public water systems to notify customers when something goes wrong, and the urgency depends on the severity of the problem. There are three tiers.

Tier 1: Within 24 Hours

The most dangerous situations require notice within 24 hours. Tier 1 triggers include violations of the E. coli MCL, nitrate or nitrite MCL exceedances, waterborne disease outbreaks, and other situations with significant potential for serious health effects from short-term exposure.¹⁴ Exceedance of the action level for lead also triggers a Tier 1 notice. The water system must also begin consulting with its primacy agency within 24 hours to decide whether additional steps, like boil-water advisories over broadcast media, are needed.

Tier 2: Within 30 Days

Other MCL, treatment technique, and compliance violations require notice as soon as practical but no later than 30 days after the system learns of the violation.¹⁵ Posted notices must remain in place for at least seven days. If the violation continues, the system must repeat the notice every three months. Failure to comply with the terms of a variance or exemption also falls into this tier.

Tier 3: Within a Year

Less urgent issues like missed monitoring deadlines or late reporting generally fall under Tier 3, which allows up to a year for notification. That notice typically goes out through the system’s annual Consumer Confidence Report.

Your Annual Report

Every community water system must deliver a Consumer Confidence Report to its customers by July 1 each year.¹⁶ The report identifies where your water comes from, lists the levels of any detected contaminants, and flags instances where the system fell out of compliance. Systems can deliver it by paper mail, by email with a direct link or attached file, or by a mailed notice with a direct URL to the report on a public website. A link to a general webpage that requires the customer to search for the report doesn’t count as direct delivery, and neither do social media posts or automated phone calls. If a system knows a customer can’t receive electronic delivery, it must provide a paper copy.¹⁷

Penalties for Water Systems That Violate the Rules

The Safe Drinking Water Act authorizes civil penalties of up to $25,000 per day per violation as the statutory base amount.¹⁸ After inflation adjustments required by federal law, the current maximum for most Safe Drinking Water Act violations is $71,545 per day, applicable to penalties assessed on or after January 8, 2025.¹⁹ Some provisions carry different structures. Tampering or endangerment violations under the underground injection control program can reach over $357,000 per day, and certain emergency-related violations can exceed $1.7 million per day.

Enforcement typically starts with the primacy agency, which may issue compliance orders, require corrective action plans, or impose state-level penalties. If the state doesn’t act, or the violation is severe enough, the EPA can issue its own administrative orders or bring a civil action in federal district court. Courts weigh the seriousness of the violation, the population at risk, and the time needed to comply when deciding penalty amounts.¹⁸

If You’re on a Private Well

If your home gets water from a private well that serves fewer than 25 people, none of the standards above apply to you. No federal agency monitors your water quality, and no one will notify you if contamination develops.¹ You’re responsible for testing and maintaining the well yourself.

Most environmental and health agencies recommend testing private wells at least once a year for bacteria and nitrates, with additional testing for other contaminants based on local conditions such as nearby agricultural activity, industrial sites, or known geological risks like arsenic or radon. A basic bacteria and nitrate test typically costs between $20 and $150 through a certified laboratory, though comprehensive panels can run several hundred dollars. Some states require well testing when property changes hands, but the requirements vary widely. The burden falls entirely on you as the well owner to ensure your water is safe to drink.

1
U.S. Environmental Protection Agency. Overview of the Safe Drinking Water Act
2
eCFR. 40 CFR 141.2 – Definitions
3
Office of the Law Revision Counsel. 42 USC 300f – Definitions
4
eCFR. 40 CFR Part 141 – National Primary Drinking Water Regulations
5
eCFR. 40 CFR Part 141 – National Primary Drinking Water Regulations – Section 141.2
6
Office of the Law Revision Counsel. 42 USC 300g-1 – National Drinking Water Regulations
7
U.S. Environmental Protection Agency. The Safe Drinking Water Act and the National Primary Drinking Water Regulations
8
U.S. Environmental Protection Agency. Per- and Polyfluoroalkyl Substances (PFAS)
9
U.S. Environmental Protection Agency. Final PFAS National Primary Drinking Water Regulation
10
U.S. Environmental Protection Agency. EPA Announces It Will Keep Maximum Contaminant Levels for PFOA, PFOS
11
U.S. Environmental Protection Agency. Lead and Copper Rule Improvements
12
U.S. Environmental Protection Agency. Lead Service Line Inventory
13
eCFR. 40 CFR Part 143 Subpart A – National Secondary Drinking Water Regulations
14
eCFR. 40 CFR Part 141 Subpart Q – Public Notification of Drinking Water Violations
15
eCFR. 40 CFR 141.203 – Tier 2 Public Notice
16
eCFR. 40 CFR Part 141 Subpart O – Consumer Confidence Reports
17
U.S. Environmental Protection Agency. Consumer Confidence Report Delivery Options and Considerations
18
Office of the Law Revision Counsel. 42 USC 300g-3 – Enforcement of Drinking Water Regulations
19
eCFR. 40 CFR 19.4 – Statutory Civil Monetary Penalties, as Adjusted for Inflation