Scans a packaged food's barcode, ingredient label, and manufacturing facility history to score allergen cross-contamination risk
Every allergen risk assessment starts with turning a printed label into structured data. A smartphone camera or handheld scanner reads the UPC/EAN barcode to identify the exact product SKU, then applies optical character recognition (OCR) to the ingredient panel — converting a photograph of dense, often tiny, low-contrast text into a clean list of discrete ingredient tokens the rest of the pipeline can reason about.
The scanning pipeline runs in three steps:
• Barcode decode: the UPC/EAN-13 barcode is read first, instantly identifying manufacturer, brand, and product variant against a retail product database. This pulls in metadata the label itself may not show, including the manufacturing facility, other products made on the same line, and any prior recall or contamination history.
• Image preprocessing: the ingredient-panel photo is deskewed, contrast-enhanced, and binarized to compensate for curved packaging, glare, and the very small "fine print" typically used for the mandatory "Contains:" and "May Contain:" statements.
• OCR + text segmentation: a trained text-recognition model (similar in principle to Tesseract or a commercial vision-language OCR model) extracts each word, then a rule-based parser splits the block into three functional zones: the primary ingredient list, the bolded "Contains:" statement, and the separate precautionary "May contain / processed in a facility with" statement — because these three zones carry very different legal and risk weight.
US labeling law requires ingredients to be listed in descending order by weight, so an ingredient near the top of the list is present in a larger quantity — relevant for dose-dependent reactions. The parser also has to handle sub-ingredients in parentheses (e.g. "Natural flavor (contains milk)"), alternate legal names (e.g. "casein" and "whey" for milk, "albumin" for egg), and regional spelling differences.
Ambiguous or compound ingredients are the hardest case: "natural flavor," "spices," and "starch" can legally hide allergenic sub-components in some jurisdictions, though FALCPA closed most of this loophole for the Big 9 in the US by requiring the allergen source to be named in plain English regardless of which technical ingredient it came from.
Under FALCPA, if a packaged food contains any of the nine major allergens, the specific food source (e.g. "milk," "wheat," "peanut") must be named in plain English — either directly in the ingredient list or in a "Contains:" statement — even if the allergen is only a minor component of a more complex ingredient.
The output of this stage is a tagged token stream: every word in the ingredient panel is classified as (a) part of the direct ingredient list, (b) part of the mandatory "Contains:" statement, (c) part of the voluntary "May contain:" advisory statement, or (d) unrelated text (nutrition claims, marketing copy). This structured output feeds directly into Stage 2, where each tagged token is checked against the user's personal allergy profile.
Direct ingredient declaration is the one part of allergen labeling that carries the force of law in the United States. The Food Allergen Labeling and Consumer Protection Act (FALCPA, 2004) — expanded by the FASTER Act in 2021 — requires that any of nine major allergens present as an actual ingredient be named in plain language. A direct match here is the highest-confidence signal the scanner can produce.
FALCPA (2004) originally named eight major food allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, and soybeans. The FASTER Act (Food Allergy Safety, Treatment, Education, and Research Act, signed 2021) added a ninth — sesame — effective January 1, 2023, making it the first new major allergen added to the mandatory list since the original law.
Together these nine allergens are responsible for roughly 90% of documented IgE-mediated food-allergic reactions in the United States. For any of these, direct presence as an ingredient (not just trace cross-contact) must be disclosed by law — either inline in the ingredient list itself or in a separate bolded "Contains:" statement immediately after it.
For each tagged token from Stage 1, the matcher checks:
• Direct string match against the allergen's common name and known legal synonyms (e.g. "casein," "whey," "lactose" → milk; "albumin," "lysozyme" → egg; "durum," "semolina," "spelt" → wheat) • Cross-reference against the user's stored allergy profile (a subset of the Big 9 the user has flagged, optionally with severity level per allergen) • Confidence scoring: an exact ingredient-list match scores near 100% confidence; a match only within a "Contains:" restatement (redundant with the ingredient list, as required by law) reinforces the same score rather than adding a second independent signal
Because this disclosure is legally mandatory, a direct match is treated by the scanner as a near-certain risk — false negatives here would mean the label itself is non-compliant, which does happen (mislabeling recalls occur every year) but is treated as a rare edge case rather than the primary source of uncertainty in the model.
Direct ingredient declaration is mandatory and enforced by the FDA. This is fundamentally different from the advisory ("may contain") labeling covered in Stage 3, which has no legal standard at all in the United States — the scanner must weight these two signal types very differently.
Even mandatory labeling has failure modes worth building into a risk model: mislabeled packaging (wrong label applied to wrong product during a packaging-line changeover) is one of the leading causes of FDA Class I food recalls each year. Imported products may not follow US labeling conventions, and reformulations ("new recipe!") can silently add an allergen that a previously safe product never had. This is why a responsible scanner treats even a clean direct-match result as time-stamped to a specific scan and package lot, not a permanent verdict for the product line.
Once direct ingredients are cleared, the harder problem begins: precautionary allergen labeling (PAL) — phrases like "may contain peanuts" or "made in a facility that also processes tree nuts" — is entirely voluntary in the United States. There is no legal threshold, no required testing, and no standard wording, so the same real-world contamination risk can appear on some products' labels and be silently omitted from others.
Unlike the mandatory "Contains:" statement, phrases such as "may contain," "processed in a facility that also processes," "manufactured on shared equipment with," or "produced in a facility with" are entirely at the manufacturer's discretion in the US. The FDA has issued draft guidance but, as of this writing, has not finalized binding rules on when PAL must be used, what testing (if any) must precede it, or what wording is acceptable.
The practical result: some manufacturers apply PAL labels defensively to almost every product that shares a facility with an allergen — regardless of actual contamination risk — while others omit PAL labels even when meaningful cross-contact risk exists, simply because they are not required to disclose it at all. Neither pattern reliably tracks the true probability of contamination in a given package.
The scanner weights PAL statements using known facility characteristics rather than treating all "may contain" labels as equivalent:
• Shared equipment, no dedicated cleaning between runs: highest risk — the same conveyor, mixer, or filling line processes an allergenic product, then this one, with only a standard changeover • Shared equipment with validated allergen cleaning (wet wash + ATP or protein-swab verification between runs): materially lower risk, though rarely disclosed on-label • Shared facility, but the allergen is only handled in a physically separate room/line with no shared air handling or equipment: lower risk, closer to the "dedicated facility" case • Fully dedicated single-allergen-free facility: lowest risk, though still not zero (raw material supply chains and incoming ingredients can carry undisclosed cross-contact from farm or shipping/storage)
This is exactly why the scanner treats "facility shared-line risk" as an independent, adjustable input rather than folding it into a single flat "may contain" probability.
A "may contain" label and a "processed in a facility that also handles X" label are legally interchangeable in the US — but in practice they often signal different underlying risk, since the second phrasing is sometimes used specifically to indicate facility-level rather than equipment-level exposure.
Where available, the scanner cross-references brand and facility identifiers pulled from the barcode lookup (Stage 1) against a database of known shared-line manufacturing relationships: which allergens a given facility handles across its full product catalog, any past FDA recall history tied to undeclared allergens at that site, and whether the manufacturer publishes third-party allergen-control certification (e.g. SQF, BRCGS allergen management modules). Where this data is unavailable, the model falls back to a conservative default based on the facility category alone (single-purpose plant vs. multi-allergen co-packer).
The final score has to combine two fundamentally different kinds of evidence: a near-certain, legally-backed direct match, and a probabilistic, unregulated advisory/facility signal. Simply averaging them would understate genuine direct-ingredient risk and overstate the reliability of a bare "may contain" label. The scanner instead uses a weighted composite, visualized as a single gauge that recolors in real time as the underlying inputs change.
The composite risk score R (0–100) is computed as:
R = 0.45 × Direct + 0.30 × Advisory + 0.25 × Facility
Direct-ingredient matches dominate the weighting because they represent legally mandated, essentially certain exposure — if a declared allergen is in the user's profile, the product is unsafe regardless of what the advisory or facility signals say. Advisory-label and facility-history terms are weighted lower individually because each is independently uncertain, but together they still meaningfully shift the score, since published testing shows PAL-labeled products are positive for real allergen protein a substantial fraction of the time (see Stage 5).
Not every allergic reaction requires the same dose. Some individuals react to sub-milligram trace exposure; others tolerate low-level cross-contact without incident, reacting only to substantial direct exposure. The "Allergen Sensitivity Threshold" control lets the score reflect this: setting it toward "Trace" amplifies the weight given to uncertain advisory and facility signals (because even a small chance of minute contamination matters at that sensitivity), while setting it toward "Severe" discounts those same signals, since only large, direct exposures are assumed to matter clinically for that user.
This mirrors how real threshold-based systems work: Australia and New Zealand's voluntary VITAL (Vital Incidental Trace Allergen Labeling) program defines specific "Eliciting Dose" reference amounts per allergen, below which PAL is not recommended and above which it is — an attempt to make precautionary labeling quantitative rather than purely defensive.
The "Facility Shared-Line Risk" control represents what Stage 3 established: whether the specific manufacturing site is Low (dedicated line, validated cleaning, strong allergen-control certification), Medium (shared equipment with standard changeover), or High (shared equipment, minimal disclosed controls, or a recall history for undeclared allergens). Moving this control changes the Facility term directly, and — combined with the sensitivity threshold — demonstrates how the same printed label can correspond to meaningfully different real-world risk depending on where and how the product was actually made.
The only way to know whether a "may contain" label reflects real contamination is to test the product in a lab. ELISA (enzyme-linked immunosorbent assay) testing — the same class of assay used in most commercial allergen test kits — can detect allergenic protein down to single-digit parts-per-million. Published surveys applying ELISA to retail products consistently show that precautionary labeling is a noisy, inconsistent signal: allergen is found in a meaningful minority of PAL-labeled products, and, less often, in some products carrying no advisory label at all.
A sandwich ELISA for food allergen testing uses antibodies raised against a specific allergenic protein (e.g. Ara h 1/2/3 for peanut, Cor a for hazelnut, casein for milk). A food sample is homogenized and extracted; the extract is applied to a microplate well pre-coated with capture antibody specific to the target protein. If the allergen is present, it binds; a second, enzyme-linked detection antibody then binds the captured protein, and an enzymatic color reaction produces a signal proportional to the amount of allergen present — read on a plate spectrophotometer and compared against a calibration curve.
Commercial kits (e.g. Neogen, R-Biopharm, ELISA Systems) report detection limits typically in the low single-digit ppm range, sensitive enough to catch trace cross-contact contamination well below levels a consumer could taste or see, but potentially still clinically relevant for highly sensitive individuals.
Multiple independent lab surveys, testing retail products carrying "may contain" or shared-facility advisory statements, have found detectable allergen protein in roughly a third to half of tested products, depending on the allergen and study — meaning a substantial share of PAL-labeled products show no detectable contamination at all, while others confirm real risk. The same body of research has also found allergen protein, at lower but non-zero rates, in some products carrying no precautionary statement whatsoever.
This dual finding is the core problem with voluntary PAL: it is simultaneously over-applied (many "may contain" labels correspond to no detectable risk, training allergic consumers to distrust or ignore the warning) and under-applied (a meaningful minority of genuinely contaminated products carry no warning at all, because disclosure is optional).
Because PAL is unregulated, the presence or absence of a "may contain" statement is only weakly correlated with actual measured contamination. This is precisely why a rigorous risk scanner must combine advisory-label text with independent facility-history and cleaning-validation data rather than trusting the label wording alone.
Proposals for improving PAL reliability generally fall into three categories: (1) quantitative threshold systems like VITAL, which base the decision to label on an allergen-specific "Eliciting Dose" reference amount rather than manufacturer discretion; (2) mandatory routine ELISA or PCR verification testing for any facility that shares equipment across allergen categories, with results tied to standardized label language; and (3) consumer-facing risk scanners of exactly the kind modeled in this simulation — combining mandatory direct-ingredient data (highly reliable) with probabilistic advisory and facility signals (inherently uncertain) into a single, continuously-updated score, rather than presenting a binary "safe / not safe" verdict that the underlying data cannot actually support.
| Product | Indication | Trial Design | Key Result |
|---|---|---|---|
| Explicit ingredient / "Contains:" statement | Legally mandatory (FALCPA) | Allergen is a deliberate formulated ingredient | ~100% — treat as certain |
| "May contain" advisory label | Voluntary, unregulated in the US | Shared line/facility, manufacturer discretion | ~30–50% test positive by ELISA |
| No advisory label, shared facility (undisclosed) | No warning printed on package | Shared equipment risk exists but undeclared | ~5–15% test positive by ELISA |
| Dedicated allergen-free production line | Single-purpose equipment, no shared runs | No cross-contact opportunity on-line | ~2–5% (supply-chain trace only) |
| Third-party certified allergen-free | e.g. certified gluten-free (<20 ppm) programs | Audited process + routine verification testing | <1% test positive |