We kept seeing posts about arsenic in candy. So we tested some of them ourselves.
Canopy's heavy metals results for Nerds, Sour Patch Kids, a Hershey's snack-size bar, and Welch's Fruit Snacks.
In January, Florida's Department of Health published a table showing arsenic in 28 of 46 candies, with a "pieces per year" allowance for each one (Florida DOH, Jan 26, 2026; exposingfoodtoxins.com/candy). Posts about how much candy a child can eat followed for months. The National Confectioners Association pushed back. It questioned the method, called the announcement misguided, and pointed to FDA's published averages for candy (ConfectioneryNews, Jan 29, 2026). As far as we can tell, no company released its own test data for its own product.
That left two positions: trust Florida's number, or trust the trade group's reading of FDA's averages. In September we opened tests on three candies from Florida's list and one fruit snack that wasn't on it. The results are back. Arsenic, the metal in every post since January, wasn't detected in any of the four. Lead was detected in three, and cadmium in the chocolate. A serving of each comes to 20% or less of FDA's daily guidance for a 50 lb child.
What we tested and how
We bought four products in Northern California in early October and shipped them to the lab. Our qualified laboratory partner tested each for arsenic, cadmium, lead, and mercury using ICP-MS, a standard method for measuring trace metals in food. The reporting limit, the lowest level the lab can reliably report, was 5 µg/kg for every metal in every sample.
Each result below is a single test of one sample from one lot. The lot number is on each product page, so a later test of a different lot can be compared with this one.
For each serving, we calculated how much of each metal a 50 lb child would take in, then compared that with health agencies' guidance for daily intake. For lead we used FDA's Interim Reference Level for children, 2.2 µg/day (FDA Closer to Zero, 2022). For cadmium we used the upper end of FDA's toxicological reference value, which matches EFSA's and works out to 8.1 µg/day for a 50 lb child (Flannery et al., Food and Chemical Toxicology, 2022). For arsenic we used the European Food Safety Authority's reference point for inorganic arsenic, which is 1.36 µg/day at that body weight (EFSA, 2024). Each percentage below is the share of a day's guidance that one serving provides. Arsenic wasn't detected in our samples, so it appears only in the Florida comparison.
The results
| Product (serving size) | Arsenic | Cadmium | Lead | Mercury |
|---|---|---|---|---|
| Nerds Halloween Strawberry Mini Boxes (1 box, 12 g) | -- | -- | -- | -- |
| Sour Patch Kids (12 pieces, 30 g) | -- | -- | 10% (7 µg/kg, 0.21 µg per serving) | -- |
| Hershey's Milk Chocolate, Snack Size (2 bars, 26 g) | -- | 20% (63 µg/kg, 1.6 µg per serving) | 17% (14 µg/kg, 0.36 µg per serving) | -- |
| Welch's Fruit Snacks, Mixed Fruit (1 pouch, 22.7 g) | -- | -- | 6% (6 µg/kg, 0.14 µg per serving) | -- |
A dash (--) means the metal was not detected at the 5 µg/kg reporting limit. Each bold percentage is the share of FDA's daily guidance for a 50 lb child that one serving provides.
Our numbers next to Florida's, in pieces a day
Florida's table gives each candy a yearly allowance for a child: 96 pieces of Nerds Strawberry, where it reported 450 µg/kg of arsenic, and 36 pieces of Sour Patch Kids, at 470 µg/kg. We divided those by 365 to get pieces a day. For our results, we calculated how many pieces a day a 50 lb child would eat to reach FDA's daily guidance for lead or cadmium, whichever comes first. Pieces are the sizes Florida lists (0.5 g for Nerds, 1.25 g for Sour Patch Kids). A snack-size Hershey's bar is 13 g, and Welch's is counted in pouches.
| Candy | Florida | Canopy |
|---|---|---|
| Nerds Strawberry | 0.3 | >544 |
| Sour Patch Kids | 0.1 | 250 |
| Hershey's Milk Chocolate, Snack Size | >0.5 bar | 10 bars |
| Welch's Fruit Snacks | -- | 16 pouches |
Pieces of candy a day for a 50 lb child. Florida's numbers are for arsenic. Canopy's are for lead or cadmium, whichever comes first. Where nothing was detected, the number is arsenic at the lab's detection limit, and > means the test could not see arsenic below that level. Florida doesn't publish its limit, so its limit here is inferred from its lowest reported value, 180 µg/kg. A dash means no number, because Florida didn't test.
Hershey's Milk Chocolate. Florida: "risk not identified" for arsenic. Canopy: arsenic not detected at 5 µg/kg. Both found no arsenic, but Florida published no detection limit. Its lowest reported value is 180 µg/kg, so its limit is no higher than that, about 36 times our 5 µg/kg. At 180 µg/kg, a 50 lb child would reach EFSA's reference point at about 0.6 of a snack-size bar a day. Florida's table also covers arsenic only and doesn't say whether other metals were tested, so there's no way to tell if the chocolate was checked for cadmium and lead. Those are the two metals we found in our bar.
Why the numbers never added up
Since January, a parent could have seen a Florida table allowing 36 pieces a year of one candy, a trade group calling the announcement misguided and pointing to FDA's averages, and a class action over Nerds (Top Class Actions, 2026). As far as we can tell, neither the pushback nor the lawsuit came with new testing of the products themselves. Florida's table did give a pieces-per-year number for each candy, but not how those numbers were worked out.
When numbers don't add up, people stop reading them. The cost is that when a result does deserve attention, it reaches an audience that has learned to scroll past.
The bind the companies are in
For a company, publishing test results is risky. Cadmium gets into cacao from the soil it grows in, so levels in chocolate depend on where the cacao was grown (FDA, Cadmium in Food and Foodwares, 2024). Lead appears to reach cacao beans after harvest, from dust and dirt (USITC, Heavy Metal in Chocolate, 2024), and it can enter other foods, fruit-based ones included, from the environment where they are grown or processed (FDA, Lead in Food and Foodwares, 2025). A company that tested and published would be publishing detections. Many consumers read a detection as a problem even when it's a small fraction of daily guidance. Staying quiet looks like the less risky choice.
So the companies that may hold the most data say the least, and whoever posts fills the gap. Lot-level results published with a health benchmark beside them would change that. Canopy publishes a checkable number with its health benchmark attached, so a small fraction reads as a small fraction.
What it means for the candy bowl
Exposure goes up with how much is eaten, and on Halloween a child may eat well over one serving. Five servings of the chocolate, ten snack-size bars, would reach FDA's cadmium reference value for a day for a 50 lb child. The benchmarks in this post describe daily intake continued over years: FDA's lead and cadmium values and EFSA's arsenic reference point. One heavy night isn't the same as eating that much every day, and the guidance addresses the second case. For lead, where no level has been identified without risk for children (CDC, About Childhood Lead Poisoning Prevention, 2025), the long-run average is what matters most.
What's next
Each product page lists the lot number and has a body-weight input, so you can rerun the math for your own child: Nerds, Sour Patch Kids, Hershey's, Welch's. Community members can request a new test of any of these products with the "Test again" button on its page.
If the candy you care about isn't one of these, request a test on any product and share it with everyone you know who buys it. The test runs once enough people have chipped in.
Ready to pool in? Open tests are waiting for backers right now.
Browse open tests →
