Every July, roughly 50,000 community water systems across the United States are required to deliver a document to their customers. It is called the Consumer Confidence Report — the CCR. It details what is in your drinking water, where that water comes from, and whether any of it exceeds federal safety standards. It is, by law, your right to have this information.
Most people have never read theirs. Many don't even know it exists.
According to research published in the Journal of Water and Health, the average Consumer Confidence Report is written at an 11th- to 14th-grade reading level — comparable to the Harvard Law Review. The CDC recommends that public health communications be written at a 6th- to 7th-grade level to ensure broad comprehension. The gap between those numbers is not an accident. It is a design problem that has persisted for decades, and it means the one document intended to empower you to understand your drinking water is, for most Americans, effectively unreadable.
We believe that needs to change. But in the meantime, we believe you should know how to read the report you already have.
What a CCR Is (And What It Isn't)
The Consumer Confidence Report exists because of the 1996 amendments to the Safe Drinking Water Act. Congress recognized that the public had a right to know what was coming out of their taps, and it mandated that every community water system — any system serving at least 15 service connections or 25 residents year-round — produce an annual water quality report for its customers.
The report must include several categories of information: where your water comes from (surface water, groundwater, or a mix), what contaminants have been detected, at what levels those contaminants were found, and whether those levels comply with federal and state standards. It must also include definitions of key terms, potential health effects of any violations, and contact information for the water system and the EPA's Safe Drinking Water Hotline.
What the report does not tell you is equally important. A CCR reflects the quality of water leaving the treatment plant. It does not reflect what happens between the plant and your faucet. Lead from aging service lines, copper from corroding pipes, bacteria from compromised distribution systems — none of these are captured at the point of treatment testing. If you live in an older home with lead solder or galvanized pipes, the water at your tap may be substantially different from the water described in the report.
Additionally, CCRs only cover public community water systems. If your water comes from a private well — as it does for roughly 43 million Americans — no CCR exists for you. You are entirely on your own for testing and treatment.
The Numbers Game: MCL vs. MCLG
The single most important distinction in any Consumer Confidence Report is the difference between two acronyms that look almost identical: MCL and MCLG.
The Maximum Contaminant Level Goal (MCLG) is the level of a contaminant below which there is no known or expected risk to health. It is a public health goal set by the EPA with an adequate margin of safety. It is not enforceable. For carcinogens — contaminants known or likely to cause cancer — the MCLG is typically set at zero, because science has not identified a universally safe exposure level for cancer-causing substances.
The Maximum Contaminant Level (MCL) is the legally enforceable standard. It is the highest level of a contaminant that is allowed in drinking water delivered by a public water system. The EPA sets MCLs as close to MCLGs as "feasible," but feasibility here accounts for the cost of treatment, the capabilities of available technology, and the ability to measure the contaminant at low concentrations.
This is where you should pay close attention. When your CCR shows a contaminant with an MCLG of zero and a detected level that is technically below the MCL, your water is in legal compliance. But "legal" and "safe" are not the same word. The health goal says zero. The law says something higher. The difference is a policy compromise — one that balances public health against economic reality.
The gap between what science recommends and what the law requires is where most drinking water risk lives. Your CCR shows you both numbers. Most people only notice one.
What the Data Table Is Telling You
The heart of every CCR is the contaminant data table. It is also where most readers give up. Here is how to read it.
Each row represents a contaminant that was detected during sampling. The table typically includes the contaminant name, the unit of measurement (usually parts per million or parts per billion), the MCLG, the MCL, the level detected in your system, the range of detection across all sampling points, whether a violation occurred, and the likely source of the contaminant.
Start with the violation column. If it says "Yes" or "Y," that contaminant exceeded the legal limit at some point during the reporting year. The report is required to explain the violation, its duration, the potential health effects, and what the system did to fix it.
Then look at the detected level compared to the MCLG. Even if no violation occurred, a contaminant that registers close to the MCL — or well above an MCLG of zero — deserves your attention. Common examples include disinfection byproducts like trihalomethanes and haloacetic acids, which form when chlorine reacts with organic matter in the water. Their MCLGs are zero (they are potential carcinogens), but their MCLs are 80 and 60 parts per billion, respectively. Your water can be perfectly legal and still contain these substances at levels the EPA acknowledges have no safe threshold.
Pay attention to the "likely source" column as well. When you see phrases like "erosion of natural deposits" or "discharge from petroleum refineries," you are being told, in bureaucratic language, what industrial and geological forces are affecting your water supply.
What Your CCR Doesn't Test For
The EPA currently regulates roughly 90 contaminants under the Safe Drinking Water Act. There are, conservatively, tens of thousands of chemicals in commercial use in the United States. The gap is staggering.
The Unregulated Contaminant Monitoring Rule (UCMR) is the EPA's mechanism for studying emerging contaminants. The most recent cycle, UCMR5, ran from January 2023 through December 2025 and monitored 29 per- and polyfluoroalkyl substances (PFAS) along with lithium across thousands of water systems. As of early 2026, approximately 95 percent of UCMR5 results have been received by the EPA, and those results have contributed to the agency's growing understanding of PFAS prevalence in American drinking water.
In April 2024, the EPA established the first legally enforceable maximum contaminant levels for six PFAS compounds — a landmark step after years of voluntary guidelines. But the monitoring data continues to paint a troubling picture. Recent EPA data suggests that approximately 165 million Americans may be served by water systems with detectable levels of PFAS, a number that has grown as more testing results come in.
Your CCR may now include PFAS data if your utility participated in UCMR5 monitoring. Look for it. If it's there, read it carefully. If it's not, ask your water utility why.
The Compliance Problem
In 2023, the most recent year for which comprehensive national data is available, the EPA reported that nearly 28 percent of the nation's 148,541 active public water systems had at least one drinking water standard violation. That amounts to roughly 41,000 systems. Of those, more than 6,000 systems violated a health-based drinking water standard — not a paperwork technicality, but a standard directly tied to human health.
Formal enforcement actions were initiated at 2,398 of those systems. That leaves thousands of systems that violated health-based standards and faced no formal enforcement. By the end of 2023, approximately 24,800 systems had returned to compliance, but the pattern repeats itself annually. Systems violate, some are cited, some fix the problem, and the cycle continues.
State-level data reinforces the trend. New York State reported that 4,136 public water systems had violations in 2024 — an 11 percent increase from 2023 — totaling 8,188 individual violations. These are not fringe, rural systems. Violations occur in cities, suburbs, and small towns alike.
Your CCR is required to disclose violations. If your system had one, it must be in the report. But if you never read the report, you will never know.
The 2024 CCR Rule Revisions
In May 2024, the EPA finalized revisions to the Consumer Confidence Report rule — the first significant update since the reports were mandated in 1998. The revised rules take effect for reports summarizing 2026 data, which will be due by July 1, 2027.
The changes are meaningful. Water systems serving more than 10,000 people will be required to issue CCRs twice per year instead of once. Reports must include a new summary section at the beginning that highlights key information, including any violations, in plain language. Stricter requirements for translation and accessibility will apply for communities with limited English proficiency or residents with disabilities. Electronic delivery methods will be formally codified. And the timeline for certifying CCR delivery to state agencies will be tightened.
These are improvements. They are also long overdue. For 26 years, the most important public health document most Americans receive about their drinking water has been written at a level that most Americans cannot comfortably read. The revised rules acknowledge that problem and begin to address it.
What You Should Do Right Now
First, find your CCR. If you receive a water bill, you may have received a printed copy. Many utilities also post them online — the EPA maintains a tool at epa.gov/ccr where you can search for your system's report by state or zip code. If you cannot find it, call your water utility and request a copy. They are legally required to provide one.
Second, read the data table. Look at every detected contaminant. Compare the detected level to both the MCL and the MCLG. If there's a violation, read the explanation carefully. If there isn't, but contaminant levels are close to the MCL, note that too.
Third, look for PFAS data. If your system participated in UCMR5, the results should be included or referenced. If they are not, contact your utility and ask for the UCMR5 results directly. They are required to share them.
Fourth, consider independent testing. A CCR tells you what's at the treatment plant. A home water test tells you what's at your faucet. If you have concerns about lead, bacteria, or contaminants specific to your plumbing, hire an accredited laboratory to test your tap water directly.
Finally, show up. Your water utility holds public meetings. Your city or county commission approves budgets that determine whether aging infrastructure gets replaced or deferred for another decade. The CCR is a starting point for engagement, not an endpoint.
A document you never read cannot protect you. A document you understand can change what you demand.
At the EPR Foundation, we believe transparency only works when people can actually understand what they're being told. The Consumer Confidence Report is a powerful tool — but only if you pick it up, open it, and know what you're looking at. We hope this guide makes that a little easier.