What Is a Consumer Confidence Report? Plain-English Guide to CCRs

Last reviewed: 2026-04-19 by Andy Zhang.

If your tap water comes from a public utility, you have a legal right to a yearly report on what is in it. That report is called a Consumer Confidence Report (CCR) — sometimes branded as an "Annual Water Quality Report" or "Annual Drinking Water Report." It is not marketing, it is not optional, and it is not the thing you see on the news about holiday spending. This page covers the EPA drinking-water Consumer Confidence Report, not the economic Consumer Confidence indicator from the Conference Board. The water CCR is required by the Safe Drinking Water Act and governed by 40 CFR Part 141, Subpart O.

The short answer

A Consumer Confidence Report is a plain-language annual water-quality disclosure that every community water system in the United States has to give its customers. It tells you where your drinking water comes from, what contaminants were detected in the last testing cycle, whether any of those detections crossed federal health limits, and what the utility is doing about it. If you pay a water bill to a city, a private utility, or a homeowner association system, you are entitled to one every year.

What goes in a CCR

Federal rule 40 CFR §141.153 lays out the required contents. A compliant report always contains these sections:

• Water source information. The type of source (surface water, groundwater, purchased water) and the specific name of the river, reservoir, aquifer, or wholesale supplier. If the state has completed a source water assessment, the CCR must summarize it or tell you where to read it.
• Detected contaminants table. Every regulated contaminant detected during the reporting period, with its measured level (average and range), the Maximum Contaminant Level (MCL), the Maximum Contaminant Level Goal (MCLG), the likely source of contamination, and the date of the sample if older than one year. Unregulated contaminants that the utility is required to monitor also appear here.
• Violations and enforcement actions. Any MCL violation, treatment technique violation, or monitoring and reporting violation that occurred during the year, along with health effects language pulled verbatim from the regulation.
• Health-effects language. For every violation and for certain detections (lead, arsenic, nitrate, total trihalomethanes, and others), the utility must include the EPA-mandated health-effects statement word-for-word. You cannot paraphrase it.
• Special vulnerable-population language. A standard paragraph warning immunocompromised people, infants, pregnant people, and the elderly about Cryptosporidium and other pathogens, and pointing them to the Safe Drinking Water Hotline. Systems that detected lead must include additional lead-specific language.
• Contact information and public participation notice. A phone number for questions and the time and place of meetings where water-quality decisions are made.

If you want a deeper walkthrough of each section, see our full CCR requirements breakdown.

Who has to publish one

The CCR rule applies to community water systems (CWSs), which EPA defines as any public water system that serves at least 15 service connections used by year-round residents, or regularly serves at least 25 year-round residents. That threshold sweeps in:

• Municipal utilities (cities, counties, water districts)
• Investor-owned utilities like American Water, Aqua America, or SJW
• Tribal water systems on reservations
• Mobile-home park systems, HOA systems, and small private utilities that meet the 15/25 threshold
• Systems that purchase finished water wholesale and redistribute it

Every one of these, regardless of size, has to produce and deliver a CCR every year. A 26-person rural system in Montana is held to the same Subpart O content requirements as Los Angeles DWP. The delivery mechanics change at the 10,000-customer line, but the content floor is identical.

Who doesn't

Not every water source comes with a CCR. The rule explicitly does not apply to:

• Non-community water systems. Think office parks, factories, highway rest areas, or campgrounds that serve transient users rather than year-round residents.
• Transient non-community systems (TNCWSs). Gas stations, restaurants on wells, state parks — these monitor a narrower set of contaminants and have no CCR duty.
• Private wells. If you draw water from your own well, no federal regulator oversees its quality and no one owes you a report. Your state health department may offer testing, but the CCR rule does not touch you.
• Bottled water. Bottled water is regulated by the FDA under 21 CFR Part 165, not EPA, and bottlers are not required to produce a CCR. A few publish voluntary quality reports, but most do not.

If you are on a private well and want to understand what to test for, start with the lead contaminant page and work outward from there.

When you get it

Under the current rule, every community water system must deliver a CCR to customers by July 1 each year, covering the previous calendar year's monitoring data. A system that took its last sample in December 2025 has until July 1, 2026, to put the report in customers' hands.

The 2024 Revised CCR Rule changes that cadence for larger utilities. Starting with reports covering calendar year 2026 (delivered in 2027), systems serving 10,000 or more people (the threshold is inclusive) must deliver a CCR twice a year — once by July 1 and again by December 31, per §141.155(j)(2). Smaller systems stay on the annual July 1 schedule. The 2027 deadline calendar walks through the new dates system by system.

How you get it

Historically, CCR delivery meant one of three things: a paper copy mailed to every billing address, a printed insert in your water bill, or — for some states — a notification that the report was available on request. Starting in 2027, the Revised CCR Rule adds a fourth mechanism that is not just allowed but often required:

• Direct-URL electronic delivery. The utility must mail or email you a direct link to the specific CCR document, not a link to the utility's homepage. "Go to ourwater.gov and look around" no longer counts.
• Paper on request. Every customer retains the right to request a paper copy at no charge, and the utility must tell them how.
• Bill inserts remain allowed for systems that still mail paper bills.
• Good-faith efforts to reach renters, apartment residents, and non-bill-paying consumers are required — posting in common areas, contacting property managers, or working with local media.

We wrote a dedicated guide on finding your CCR with the fastest paths for each delivery type, and a companion piece on electronic delivery mechanics for utilities implementing the new rule.

The 2027 changes in plain English

The Revised CCR Rule was finalized in May 2024 and takes effect for reports covering calendar year 2026. Here is what actually changes for the average water customer:

• Per-customer contaminant information. Utilities must present detected contaminants in a way that lets customers understand what is in their water — including a "top contaminants of concern" callout and clearer source-of-contamination language.
• Direct-URL delivery. As above, vague "check our website" notices are gone. The link has to land on the report.
• Twice-yearly reporting for large systems. Anyone at 10,000 service population or more publishes two CCRs a year.
• Translation thresholds. When a utility serves a "large proportion" of non-English speakers of a given language, the CCR or a summary must be translated. EPA's guidance uses a 10 percent or 1,000-person threshold as a practical benchmark, and the translation and accessibility rules go into more detail on what that means in practice.
• Plain-language rewrites. Lead, nitrate, and disinfection byproduct language is being rewritten to be understandable at roughly an eighth-grade reading level.
• A new up-front summary section. Reports must now open with a short plain-language summary of key findings, codified as §141.156, before the detailed tables. If you have ever had to hunt for the "did they find anything bad" answer in a 20-page PDF, that is the problem §141.156 is trying to fix.

Our revised CCR rule summary is the best single page for the full change list.

If you run a water utility

If you are on the other side of the report — writing it, not reading it — the 2027 rule changes your workflow materially. You need to map your customer database to the new per-customer contaminant output, stand up direct-URL delivery, update your translation workflow, and in many states file a compliance certification with your primacy agency.

We have a how-to-write-a-CCR guide aimed at utility operators, and a full CCR software guide comparing the tools utilities are using to produce compliant reports without building everything from scratch. Small systems (under 3,300 population, in particular) have additional flexibility — see the small-utility compliance notes linked from the related pages list above.

CCR jargon in one table

If you are opening a CCR for the first time, these are the terms that cause the most confusion. Keep this handy next to the contaminant table.

Term	What it means in a CCR	Who sets it
MCL (Maximum Contaminant Level)	The legal limit. If a utility's measured level exceeds this, it is a violation.	EPA, enforceable
MCLG (Maximum Contaminant Level Goal)	The health-based target with no known or expected risk. Non-enforceable; for some contaminants (lead, cancer-causing chemicals) the MCLG is zero.	EPA, aspirational
AL (Action Level)	Used for lead and copper instead of an MCL. If more than 10% of sampled homes exceed the AL, the utility must act — corrosion control, public education, line replacement.	EPA, §141.80
TT (Treatment Technique)	For contaminants without a set MCL, a required process the utility must follow (e.g., filter surface water).	EPA
ppm / ppb / ppt	Parts per million, billion, trillion. 1 ppm = 1 mg/L; 1 ppb = 1 µg/L. Most CCR tables use mg/L.	Units, not standards
Detected / ND	ND = "not detected" above the laboratory reporting limit. It does not mean zero, just below the detection floor.	Lab convention
Source	The pollution origin EPA assigns: natural geology, agriculture, industry, corrosion of household plumbing, or disinfection byproducts.	EPA per-contaminant list
Compliance year	The calendar year whose monitoring data the report covers — typically the year before the report is delivered.	40 CFR §141.153

If a row in your CCR's detected-contaminants table has a measured level below the MCL but above the MCLG, the utility is legally in compliance but there is still some health consideration to read — pull up the contaminant-specific page before panicking. Our lead page walks through the most common example.

FAQ

Is a CCR the same as a water quality report?

In common usage, yes. "Water quality report," "annual water quality report," and "Consumer Confidence Report" all refer to the same document when a community water system is the one producing it. Utilities often brand the public-facing version with a friendlier name ("Our Water Quality 2026") while still meeting Subpart O content requirements underneath.

Does bottled water come with a CCR?

No. Bottled water is regulated by the FDA, not EPA, and is not covered by the CCR rule. Some bottlers publish voluntary quality reports, but those reports are not standardized, not required, and not comparable to a utility CCR. The International Bottled Water Association offers a members-only disclosure framework, but there is no federal mandate.

Who enforces the CCR requirement?

EPA delegates enforcement to state primacy agencies — typically the state environmental or health department. In New Jersey that is NJDEP, in California it is the State Water Resources Control Board, in Texas it is TCEQ. The EPA Region office steps in when a state fails to act, and the Safe Drinking Water Hotline (1-800-426-4791) is the escalation path for customers who cannot get their utility to comply.

What if my landlord doesn't share the CCR?

If you rent, the CCR rule still protects you — utilities are required to make "good faith efforts" to reach non-bill-paying consumers, but that often means posting the report rather than handing it to you. Look up your utility using the ZIP lookup or the utility directory, then request the current CCR directly. By law they have to provide it, free, on request.

How do I read the contaminant tables?

Three numbers matter per row: the measured level, the MCL (the legal limit), and the MCLG (the health-based goal). If the measured level is below the MCL, the utility is in compliance, but a measured level above the MCLG may still carry health implications — the MCLG for lead, for example, is zero. The "likely source of contamination" column tells you whether a detection comes from natural geology, treatment byproducts, or infrastructure. When in doubt, pull up the contaminant-specific page (our lead page is the most-read example) for context the CCR alone cannot give you.

Sources

1. U.S. EPA, "National Primary Drinking Water Regulations: Consumer Confidence Reports" — Final Rule, 89 FR 45980, Federal Register document 2024-10919, docket EPA-HQ-OW-2022-0260, RIN 2040-AG14. Published May 24, 2024; effective June 24, 2024; compliance date January 1, 2027. Accessed 2026-04-19.
2. Code of Federal Regulations, 40 CFR Part 141, Subpart O — Consumer Confidence Reports, including §141.153 (content), §141.155 (delivery and biannual distribution under §141.155(j)(2); retention for 3 years under §141.155(h)), and new §141.156 (report summary). Accessed 2026-04-19.
3. U.S. EPA, Consumer Confidence Report landing page, including EPA's CCRiWriter tool for report generation. Accessed 2026-04-19.
4. U.S. EPA, National Primary Drinking Water Regulations — canonical list of MCLs, MCLGs, and treatment techniques referenced by CCRs. Accessed 2026-04-19.