PFAS Under CERCLA: Reporting, Liability, and Landowner Defenses

In May 2024, the EPA designated PFOA and PFOS as hazardous substances under CERCLA, and that single rulemaking pulled the PFAS CERCLA hazardous substance rules and cleanup liability framework into full effect. Facilities that release a pound or more of either chemical in a 24-hour period must report it immediately, and current owners, past owners, generators, and transporters can be held strictly liable for cleanup costs stretching back decades. The rule reaches only PFOA and PFOS for now; the thousands of other PFAS compounds remain outside the Superfund hazardous substance list.¹

What the 2024 Designation Covers

The final rule designates perfluorooctanoic acid (PFOA) and perfluorooctane sulfonic acid (PFOS), including their salts and structural isomers, as hazardous substances under CERCLA Section 102(a). That provision authorizes the EPA to designate any substance that may present a substantial danger to public health, welfare, or the environment.² The agency based the designation on evidence that PFOA and PFOS travel easily through water, migrate far from their sources, resist natural degradation for decades, and accumulate in living tissue.

Two features of the designation shape everything that follows. It operates retroactively, which is a defining feature of Superfund: liability reaches contamination that occurred long before the rule took effect. And it is narrow in coverage. Only PFOA and PFOS are designated. Compounds like GenX chemicals, PFBS, and other short-chain PFAS remain outside CERCLA’s hazardous substance list, though the EPA has solicited public input on whether to designate broader categories in the future.¹ A site contaminated only with other PFAS variants is not currently subject to these rules, but most real-world contamination involves mixtures, and any detectable PFOA or PFOS pulls the whole site into Superfund’s reach.

When You Must Report a Release

Any person in charge of a facility that releases a pound or more of PFOA or PFOS within 24 hours must report it immediately. One pound is CERCLA’s default reportable quantity, and the EPA chose not to set a higher threshold for these chemicals.² Compared with many industrial chemicals, that is a low trigger.

Reports go to the National Response Center at 1-800-424-8802, which operates around the clock. Facilities must also notify the state or tribal emergency response commission and the local emergency planning committee. The notification should include the substance name, estimated quantity, time and duration of the release, and the affected medium (soil, water, or air).³

Failure to report carries serious consequences. A knowing failure to notify can bring up to three years in prison under Title 18, rising to five years for repeat offenders.⁴ Civil penalties for reporting violations reached $71,545 per violation as of the January 2025 inflation adjustment.⁵ The reporting obligation applies whether the release was accidental or intentional.

Continuous Release Option

Facilities with ongoing, stable emissions may qualify for reduced reporting under 40 CFR 302.8. If a release is continuous and consistent in quantity and rate, the operator can file a single initial notification and periodic follow-up reports rather than calling the National Response Center every time the one-pound threshold is met.³ The release has to be genuinely stable. A spike above the reported range triggers a new immediate notification.

Who Can Be Held Liable for Cleanup

CERCLA Section 107 imposes strict liability, so a party can be responsible for cleanup costs even if it complied with every rule in force at the time. Liability is also joint and several when contamination from multiple sources cannot be separated, which means the government can pursue a single party for the entire cost at a site even if dozens of other entities contributed.⁶

Four categories of potentially responsible parties can be pulled in:

Current owners and operators of a facility where a release occurred, even if the contamination predates their ownership.
Past owners and operators who held or ran the facility at the time hazardous substances were disposed of there.
Generators and arrangers who produced the chemicals or arranged for their disposal or treatment, including manufacturers who sold PFAS for use in other products.
Transporters who moved hazardous substances to a disposal site they selected.

Together these categories reach across the full lifecycle of a chemical, from manufacturer to hauler to landfill operator.⁷ Responsible parties must reimburse the government for response costs, which can include site investigations, laboratory analysis, engineering controls, soil removal, and groundwater treatment. Private parties who clean up contamination on their own can also sue responsible parties to recover those expenses.

The Narrow Defenses

Statutory defenses under CERCLA rarely succeed. A responsible party can escape liability only by proving the contamination was caused solely by an act of God, an act of war, or the act of an unrelated third party with no contractual connection to the defendant. Even the third-party defense requires showing that the defendant exercised due care and took precautions against the third party’s foreseeable actions.⁸ In PFAS cases, where contamination usually flows through a chain of commercial relationships, these defenses almost never fit.

Landowner Protections for Property Buyers

The 2002 Brownfields Amendments added three protections that matter now that PFOA and PFOS are hazardous substances: the innocent landowner defense, the bona fide prospective purchaser defense, and the contiguous property owner defense. All three require the buyer to conduct “all appropriate inquiries” into the property’s contamination history before closing.

All appropriate inquiries, codified in CERCLA Section 101(35)(B), require an environmental professional to review historical uses, interview past and present owners, examine government records and aerial photographs, search for cleanup liens, and inspect the site visually.⁹ After acquisition, the buyer must meet continuing obligations: stopping ongoing releases, preventing future ones, and not interfering with cleanup activities.

The innocent landowner defense specifically requires the buyer to show no knowledge or reason to know of the contamination at purchase, plus a third-party cause with no contractual link.⁸ A bona fide prospective purchaser may know about the contamination but still avoid liability if they conducted all appropriate inquiries, did not cause or contribute to the release, and comply with continuing obligations.

What Changed for Phase I Assessments

Because a Phase I Environmental Site Assessment under the ASTM E1527-21 standard must evaluate contamination from any CERCLA hazardous substance, PFOA and PFOS are now automatically in scope for every commercial property assessment. Other PFAS compounds that have not been designated remain optional under the ASTM standard, though some states require broader PFAS screening independently.

Environmental consultants now need to investigate whether a property has any history involving aqueous film-forming firefighting foam, metal plating, textile manufacturing, paper production, or fluoropolymer processing. They should also look at passive-receiver pathways like biosolids application, landfill leachate, and off-site migration from neighboring properties. If a Phase I identifies a recognized environmental condition involving PFOA or PFOS, the buyer typically needs a Phase II with actual sampling. Laboratory analysis for these compounds runs several hundred dollars per sample, and a thorough characterization can require dozens of soil and groundwater samples. A Phase I that skips PFAS puts the buyer’s landowner defense at risk.

Enforcement Discretion for Passive Receivers

The EPA issued a PFAS enforcement discretion and settlement policy acknowledging that many entities received PFOA and PFOS without being primary polluters. The agency stated it does not intend to pursue enforcement actions where equitable factors do not support it, including against:¹⁰

Community water systems and publicly owned treatment works
Municipal stormwater systems
Publicly owned municipal solid waste landfills
Publicly owned airports and local fire departments
Farms where biosolids were applied to the land

Two limits on this policy matter. It is a policy choice, not a statutory protection: these entities remain technically liable, and the EPA reserves the right to pursue any party whose involvement turns out to be more significant than initially believed. And it only governs the EPA’s own enforcement decisions. It does not prevent private parties or other potentially responsible parties from filing their own cost recovery or contribution lawsuits against the same entities.¹¹ The gap between agency discretion and private litigation exposure is where the real risk sits.

Contribution Protection Through Settlement

Under Section 113(f)(2), a party that resolves its liability to the United States or a state through an approved settlement cannot be sued by other potentially responsible parties for contribution on the matters covered by the settlement.¹² Settling with the government acts as a shield against contribution lawsuits from other polluters.

The EPA’s PFAS settlement policy adds another layer. When the agency settles with major responsible parties like PFAS manufacturers and large industrial users, it intends to require those settling parties to waive their right to sue the passive-receiver entities identified in the enforcement discretion policy. The agency may also enter into settlements directly with passive receivers, giving them statutory contribution protection from third-party claims.¹¹ For a water utility or fire department facing the prospect of a lawsuit from a manufacturer trying to spread liability, contribution protection can be the difference between manageable legal costs and financial disaster.

Deadlines for Cost Recovery

CERCLA imposes specific time limits on cost recovery claims. For removal actions, which are typically shorter-term emergency responses, the deadline is three years after the removal action is completed. For remedial actions, which are longer-term cleanups like groundwater treatment systems, a lawsuit must be filed within six years after physical on-site construction of the remedy begins.¹²

The statute of limitations runs from the completion or initiation of the response action, not from when the contamination occurred. Because most PFAS cleanups are just beginning, the clock on most cost recovery claims has barely started, and responsible parties should expect potential lawsuits well into the 2030s and beyond.

1
Federal Register. Designation of Perfluorooctanoic Acid (PFOA) and Perfluorooctanesulfonic Acid (PFOS) as CERCLA Hazardous Substances
2
GovInfo. Designation of Perfluorooctanoic Acid (PFOA) and Perfluorooctanesulfonic Acid (PFOS) as CERCLA Hazardous Substances
3
US EPA. Designation of PFOA and PFOS as Hazardous Substances Under CERCLA Release Reporting Requirements Factsheet
4
Office of the Law Revision Counsel. 42 USC 9603 – Notification Requirements Respecting Released Substances
5
eCFR. 40 CFR 19.4 – Statutory Civil Monetary Penalties, as Adjusted for Inflation
6
US EPA. Superfund Liability
7
Office of the Law Revision Counsel. 42 USC 9607 – Liability
8
US EPA. Third Party Defenses/Innocent Landowners
9
Office of the Law Revision Counsel. 42 USC 9601 – Definitions
10
US EPA. PFAS Enforcement Discretion and Settlement Policy Under CERCLA
11
U.S. Environmental Protection Agency. PFAS Enforcement Discretion and Settlement Policy Under CERCLA
12
Office of the Law Revision Counsel. 42 USC 9613 – Civil Proceedings