Reading Gluten-Free Labels: Certifications, Ingredients, and Hidden Gluten

By Gregory Wilson · Excerpt from Chapter 4 of Celiac vs Me

A few months into all of this, I was standing in the cereal aisle at Whole Foods, holding two boxes.

They were not the same brand. They were not the same kind of cereal. But they were both labeled gluten-free on the front of the box, in clear, friendly letters, and the labels did not look the same. One had a small logo that said Certified Gluten-Free, a third-party mark, from an outside organization that had audited the manufacturer. The other just had the words gluten-free on the front. No seal. No certifier. No third-party mark. Just the claim. Both said gluten-free. Both, presumably, were.

I stood there for what was probably a minute and a half, looking from one box to the other, because I had hit a thing that nobody had told me about. There were tiers of gluten-free. The boxes were not making the same promise.

Three sources, none of them enough on their own

There are three sources of information you are going to use, for the rest of your celiac life, to decide whether a product is safe. They are: the certifications on the package, the ingredients on the label, and the community of people who have already eaten it.

None of those three is, by itself, enough. All three together are how you do this. A celiac who relies only on certifications will miss the great products that don't bother to certify. A celiac who relies only on label-reading will miss the products that read fine but are made on shared equipment in a flour-dusted facility. A celiac who relies only on the community will miss the products that nobody has gotten around to writing about yet.

One phrase, more than any other, holds celiac eating together. I will use it through the rest of the book: signal, not gospel. Every label is signal. Every certification is signal. Every Reddit comment is signal. Your body's own response is signal. None of them, on its own, is the whole truth. You collect every signal you can, and then you make the call.

What 20 ppm really means

When the FDA finalized its gluten-free labeling rule in 2013, it set a single standard: a product that calls itself gluten-free on the package must contain less than 20 parts per million of gluten. Twenty ppm is the legal floor for the words gluten-free in the United States.

Twenty parts per million is a very small number. Stated more literally: twenty milligrams of gluten in a kilogram of food. Picture a single grain of uncooked rice dispersed evenly through a full kilogram of cereal. The FDA chose 20 ppm because it is, more or less, the lowest level standard testing methods can reliably detect, and because most people with celiac disease can tolerate trace amounts at or below that floor without intestinal damage. It is small enough that for the vast majority of celiacs, a product at that level will not cause a problem. But it is not zero. And for some celiacs — the very sensitive ones, the kids, the ones who flare easily — even 20 ppm is too much in the wrong combination.

So a few independent organizations got into the business of certifying products at a stricter standard. The most common one in the US is the Gluten-Free Certification Organization, usually abbreviated GFCO. They certify at 10 ppm or below — half the FDA threshold — and they audit the facilities. There is also a 5 ppm certification mark, historically the CSA Recognition Seal, now generally associated with the National Celiac Association, which is the strictest of the common marks.

The layering, from highest reassurance to lowest: a third-party certification on the package is the most reassuring signal. The plain gluten-free claim with no certifier sits one tier below — the manufacturer asserts they meet the 20 ppm floor, but no third party has audited it. Below that is the product with clean ingredients but no gluten-free claim at all (a bag of plain frozen broccoli, a jar of olives). And below that, on something otherwise safe, is the dreaded little sentence: manufactured in a facility that also processes wheat.

The Rice Krispies trap

Reading a label as a celiac is not like reading a label as a casual eater. You are not looking for whether something has wheat in it. You are looking for whether something has wheat anywhere on the entire ingredient list, including in places where wheat does not look like wheat.

The canonical example, the one that catches every newly-diagnosed celiac at least once: Rice Krispies.

Rice is gluten-free. Rice is, in fact, the canonical gluten-free grain. It would be reasonable to assume that a cereal called Rice Krispies, made of rice, is gluten-free. I made that assumption. I poured myself a bowl of Rice Krispies for breakfast at some point in the first month, more than once, before anyone told me otherwise.

It was the Fig app that first told me I had been wrong.

Rice Krispies contain malt flavoring. Malt flavoring is made from sprouted barley. Barley contains gluten. Therefore Rice Krispies, despite being a cereal whose headline ingredient is rice, are off-limits to celiacs.

This is the first big trap. The headline ingredient does not tell you whether the product is gluten-free. The full ingredient list does. And the word you are scanning that list for, more than almost any other, is malt. Malt flavoring, malt syrup, malt extract, malted barley flour, malted milk. Anywhere the word malt appears, gluten is almost certainly present.

The reason this trap is so easy to fall into is that wheat is one of the FDA's nine major allergens — the so-called Big Nine — and manufacturers are required to flag those nine in bold or in a separate "Contains" statement at the bottom of the label. Barley and rye are not on that list. So a product can have barley in it, and therefore have gluten in it, without any bold print to warn you. You have to read the full ingredients yourself, every time, until the patterns are second nature.

Other places malt is hiding: most cornflakes, including the standard Kellogg's Corn Flakes and Special K. Whoppers candy. Malt vinegar (and therefore most British-style fish-and-chips condiments). Malted milkshakes and malted milk powder. Plenty of "rice" and "corn" cereals that look obviously safe but aren't.

You will, after a few months, develop a kind of label-reading peripheral vision. You'll pick up a package, your eyes will sweep the ingredient list, and either nothing will catch and you'll move on, or something will and you'll slow down. This skill is real, and you will get it. I promise.