What a US label guarantees, what it quietly does not, and the asymmetry that explains most accidental exposures.
The FDA said so in its own words in the Federal Register on 22 January 2026: because barley, rye and oats are not major food allergens, a packaged food containing them may not have to name the source. The agency gave the example itself. Malt extract, derived from barley, "may be labeled as barley malt, but it can also be referred to as malt extract or malt syrup, which do not disclose the barley source."
Major allergens are also exempt from the collective-term escape hatches. Wheat hiding inside "natural flavor," "spice" or "color" must still be declared. Barley and rye inside those same terms need not be.
The practical rule: trust "no wheat" from a US label. Never trust "no barley or rye."
Under 21 CFR 101.91, a product labeled gluten-free must contain less than 20 parts per million of gluten. The claim is voluntary, but once made it is legally binding, and a product that fails is misbranded.
"No gluten," "free of gluten" and "without gluten" are legally interchangeable with "gluten-free." "Gluten friendly" is not. That phrase has no legal definition, no threshold and no enforcement behind it, and only about 22% of people with celiac disease say they trust it, against 41% for "gluten-free."
Coverage gaps worth knowing: the rule does not cover USDA-regulated meat, poultry or egg products, and it does not cover most alcohol. A gluten-free claim on a hot dog or a beer is governed differently.
A plain gluten-free claim is the manufacturer asserting compliance. Third-party certification means somebody else audited it, usually to a stricter threshold. GFCO certifies at 10 ppm, half the regulatory limit. The National Celiac Association recognition seal is stricter still at 5 ppm.
Neither is a guarantee, but the ordering is real: certified beats claimed, and claimed beats silence. A clean ingredient list with no claim at all means nobody tested the product and nobody took responsibility for it. That is the status of most food in a grocery store.
"May contain wheat" and "made in a facility that also processes wheat" are entirely voluntary. There is no threshold, no required testing, and no agency enforcing them. Two products with identical risk can carry different advisory language because of a legal-department decision.
The practical rule used by patient organizations: if a product carries both an advisory statement and a gluten-free claim, the binding claim governs and the advisory can be disregarded. If it carries an advisory and no claim, treat it as may-contain.
One more gap: the FDA draft guidance on advisory labeling covers only the nine major allergens, so "may contain wheat" is an advisory about wheat specifically. There is no advisory framework for barley or rye at all.
This site answers the question you knew to ask. The app answers the one you didn't: the barley malt in a rice cereal, the wheat starch in a gummy. Scan the barcode, or photograph the panel when the barcode isn't in any database, and CiCi shows which words on the label produced the answer.
14 days free, then $29.99 a year. Cheaper than Fig, and it does what three separate apps do. This website stays free forever either way: every answer on it, permanently, with no account.