What’s Actually in Your Tap Water and Who Decides What’s Safe

by Jay | Updated on August 4th, 2026

Municipal water customers already have a real answer sitting in an annual report most of them have never opened. Well owners have no such report at all, and that gap sits at the center of almost everything else in this article. The federal rules that decide what gets an enforceable limit, what gets tested only for research purposes, and what gets left entirely to a homeowner’s own judgment are more specific, and more full of gaps, than the phrase “safe drinking water” usually implies.

Two different regulatory tracks control what happens to your water before it reaches the tap, and the newest pieces of both changed within the last two years. Neither one applies to a private well the way it applies to a city connection, which is the single biggest thing this article corrects.

Two rulebooks decide what actually gets enforced

The Safe Drinking Water Act splits every regulated substance into two separate lists, and only one of them is legally binding. National Primary Drinking Water Regulations set enforceable maximum contaminant levels, called MCLs, for a specific roster that currently runs to 91 substances: 7 microorganisms including Cryptosporidium, Giardia, and total coliform bacteria, 3 disinfectants, 4 disinfection byproducts, 16 inorganic chemicals such as arsenic, lead, and nitrate, 51 organic chemicals, 6 PFAS compounds or groups, and 4 radionuclide categories, according to EPA’s own regulation table.

National Secondary Drinking Water Regulations cover a shorter, separate list of 15 substances tied to taste, odor, and appearance rather than health, among them iron, manganese, sulfate, chloride, copper, pH, and total dissolved solids. None of these carry a federal enforcement requirement. The one exception is fluoride’s separate 2.0 mg/L secondary threshold, which triggers a mandatory customer notice even though it isn’t itself enforceable. A utility can pass every primary health standard and still hand you water that tastes metallic or leaves a ring in the toilet bowl, because the secondary list was never built to be enforced the same way the primary list is.

PFAS just got its first real number, and the number is already moving

PFAS, the so called forever chemicals, had no enforceable drinking water limit at all until April 2024. EPA’s final rule set individual limits of 4.0 parts per trillion each for PFOA and PFOS, plus a combined hazard index of 1 covering PFHxS, PFNA, HFPO-DA (also called GenX), and PFBS, each of which also carries its own 10 ppt individual limit. Utilities had until 2027 to finish initial monitoring and until 2029 to have treatment running.

That timeline isn’t settled. In May 2026, EPA proposed pushing the PFOA and PFOS compliance deadline back two more years, to 2031, and proposed dropping the hazard index and the individual limits for the other four compounds entirely. The proposal is still working through public comment, so a utility currently over the PFOA or PFOS limit isn’t locked into fixing it by 2029 anymore. Worth checking your own utility’s status directly rather than assuming the original deadline still holds.

Lead’s action level moved too, and some numbers online haven’t caught up

EPA finalized the Lead and Copper Rule Improvements in October 2024, and it lowered the lead action level from 15 parts per billion to 10 ppb, the threshold that triggers mandatory corrosion control and customer notification. Utilities now have to notify affected customers within 24 hours of an exceedance, not the slower timeline the original rule allowed. The rule also mandates full replacement of lead and certain galvanized service lines within 10 years nationwide, with a conditional path to defer corrosion control if a utility commits to replacing at least 20 percent of its lines every year. If you read the 15 ppb figure anywhere else, treat 10 ppb as the current number.

Chlorine’s own byproducts carry separate limits

Water disinfection creates a second category of regulated substance almost nobody thinks about until they read the fine print on their own CCR. Chlorine reacting with organic matter already in the source water forms trihalomethanes and haloacetic acids, each capped independently, total trihalomethanes at 0.080 mg/L and the five regulated haloacetic acids at 0.060 mg/L combined. Chlorite is capped at 1.0 mg/L in systems that switch to chlorine dioxide, and bromate at 0.010 mg/L in systems that use ozone. Both are disinfection byproducts, and both are invisible to a taste test.

None of these ride along with the chlorine a utility adds on purpose. They form afterward, as a side effect of doing the disinfection part correctly. A carbon filter rated for chlorine reduction pulls the chlorine out before it has the chance to keep reacting, which is a large part of why carbon shows up in almost every whole house system built for a municipal supply.

Being unregulated doesn’t mean nobody is looking

A contaminant with no MCL isn’t automatically a contaminant nobody has checked for. The Unregulated Contaminant Monitoring Rule requires larger utilities to test for specific substances that lack an enforceable standard, purely to build a dataset EPA can use later to decide whether a future MCL is warranted. The fifth round, covering a 12 month monitoring window between 2023 and 2025, tracked 29 additional PFAS compounds and lithium, none of which carry a limit yet. A contaminant’s absence from your CCR’s violation table can mean it was tested and came back clean. It can also mean nobody was required to test for it in the first place, and those are two very different situations to be in.

The report your utility already owes you

Every community water system has to deliver a Consumer Confidence Report by July 1 each year, listing every detected regulated contaminant alongside its MCL and flagging any violation from the prior year. This is where the search for what is actually in your water should start, not a generic contaminant list, since it reflects your specific utility’s specific source and treatment process rather than a national average. Pair the numbers in it with a real certification framework, choose a filter based on what’s actually in your water once you know the specific numbers, and the buying decision stops being a guess.

A CCR only covers what your utility measured, and utilities vary widely in source and treatment history, which is a large part of why the same contaminant turns up regionally rather than uniformly. The fuller regional picture, documented across North America, is worth reading once the CCR raises a specific concern rather than before.

Private wells answer to nobody but the owner

The Safe Drinking Water Act only reaches public water systems, defined as at least 15 service connections or an average of 25 people served for 60 days a year or more. A private well serving one household falls entirely outside that definition. No CCR gets mailed, no MCL gets enforced, and no utility is testing anything on your behalf. CDC recommends testing a private well at least once a year for total coliform bacteria, nitrates, total dissolved solids, and pH at minimum, then checking with a local health or environmental department for substances tied to regional geology, arsenic in parts of New England, radon in granite bedrock areas, nitrate near agricultural land.

Once a real number exists, from either a CCR or a private lab, matching it to how each filtration method actually removes what showed up turns a vague purchase into a specific one.

Get the number before you get the filter

The right fix depends on the specific number, not a general sense that filtered water is better than unfiltered. Pull your CCR first if you’re on a municipal system, since it already lists what showed up and how it compares to the limit. Test before you buy anything if you’re on a well, since nobody else is going to do it for you. If lead, PFAS, arsenic, or nitrate turns up on either report, a reverse osmosis system certified under NSF 58 is the one home technology built to knock all four down at once, not a pitcher filter picked because it was the cheapest thing in the aisle. If nothing shows up beyond a chlorine taste, save the money and buy the carbon filter instead.

Jay

Jay is a health and wellness enthusiast with expertise in water quality and nutrition. As a knowledgeable advocate for holistic well-being, Jay successfully manages Type 2 Diabetes through informed lifestyle choices. Committed to sharing reliable and authoritative insights, Jay combines firsthand experience with a passion for enhancing health."