Is Malic Acid Safe in a Cleansing Milk? What the FDA, PubMed, and Clinique's INCI Tell Us

TikTok keeps repeating the warning. Malic acid is an AHA, and AHAs aren't safe for sensitive skin, especially during pregnancy, especially in any kind of cleanser. I went looking for the original pharmacology paper that warning ought to chain back to, and the math the paper actually reports doesn't say what TikTok says. The single most cited number on rinse off AHA absorption comes from a 2011 study that measured what actually crosses human skin from a wash, and the answer is less than 0.04%. That's three orders of magnitude under the dose people are warning you about.

The footnote rarely separates a 30% glycolic peel from a 1% malic wash, and the wash is what most readers are actually asking about. So I read every Clinique cleansing milk label still in print, and we ran the safety question for our readers against what the FDA actually wrote down, because the answer kept getting flattened in translation between the regulator and the algorithm.

The short version is in the box above. The long version is below.

Where did the malic acid warning come from?

The umbrella warning around AHAs didn't start with malic acid. It started in 2005, when the FDA issued a labeling guidance for topical AHA cosmetics after analyzing roughly 100 products and finding concentrations from 0.01% up to 67%. The agency asked brands to add a sunburn alert on any AHA product, and to keep leave on AHAs at or under 10% at pH 3.5 or higher. That's a sensible rail for an unbounded shelf.

What got lost when the rule traveled to TikTok and pregnancy blogs is that the FDA's analysis lumped chemical peels, leave on serums, and rinse off cleansers into one risk bucket, even though those three formats sit in radically different pharmacological territory. A 30% glycolic peel held on the skin for ten minutes is doing something different from a cleansing milk that contacts your skin for 45 seconds and then leaves the building down the sink.

Malic acid got swept into the same warning by association. It's an AHA, technically, so it inherited the AHA caveat. Whether that caveat fits the actual ingredient in the actual vehicle is a separate question.

What malic acid actually does to a sensitive skin barrier

Malic acid sits at the gentle end of the AHA family for two reasons that you can read straight off a chemistry table. First, its pKa is roughly 3.4. Glycolic acid sits at 3.83. The lower pKa sounds counterintuitive (more acidic, should sting more), but the practical implication is that malic acid is more dissociated. More of it sits as the conjugate ion, and the protonated free acid that drives passive diffusion across the stratum corneum is a smaller fraction of the dose. The 2019 analysis of dl malic acid as an AHA component walks through this directly.

Second, malic acid is a dicarboxylic. It carries two carboxyl groups, not one, and its molecular weight (134 g/mol) is bigger than glycolic (76 g/mol). Both make passive entry through intact corneocytes slower. That doesn't make it useless. It makes it gentler at the same labeled percentage.

This matters for a sensitive barrier specifically. The reason a low pH AHA stings on compromised skin isn't the H plus ions in the bottle. It's the free acid molecules that reach the lipid lamellae and the underlying nerve endings. Malic delivers fewer of them per labeled percent than glycolic does. Lactic and mandelic land in similar territory, which is why dermatologists keep recommending those three for reactive skin while pushing glycolic and salicylic to the durable ones. For a deeper read on which barrier ingredients actually have the dermatology consensus behind them, we wrote up the 23 ingredients dermatologists agreed on last year.

Why is a cleansing milk its own safety class?

This is the part the umbrella warnings keep missing.

The classic primary source on rinse off AHA exposure is a 2011 study on human skin, indexed on PubMed. The authors measured how much AHA from a rinse off personal care product actually entered the stratum corneum and the viable epidermis. The numbers are stark. Over 99% of the applied dose rinsed away with the product. Less than 0.15% remained in the stratum corneum after a normal cleanse. Less than 0.04% crossed into the viable epidermis where keratinocyte signaling and nerve endings live. That's the pharmacology of a wash. It's not the pharmacology of a peel. A daily 60 second cleansing milk at 1 to 2% malic delivers a dose roughly a thousandfold smaller than the same percentage on a leave on serum. We treat the two as one risk in our pregnancy lists because the ingredient name is the same. The dose isn't.

Does Clinique's cleansing milk contain malic acid?

No, not in the two best selling ones we checked. To answer cleanly, we pulled the public INCI for both Take The Day Off Cleansing Milk and All About Clean Micellar Milk for dry skin. Neither lists malic acid, glycolic acid, lactic acid, or mandelic acid. Take The Day Off Cleansing Milk is built on water, isohexadecane, glycerin, and dimethicone with a panthenol and sodium hyaluronate finish. All About Clean Micellar Milk leans on alkyl benzoate, butylene glycol, and a quiet roster of cucumber and barley extracts. Both are pure removal products. Neither one is doing chemical exfoliation while you wash.

That's a brand choice, not a safety verdict. Clinique's category map keeps cleanser and treatment apart on purpose. If you want exfoliation from a Clinique product, they'll route you to a 7 Day Scrub or a Clarifying Lotion, not the cleansing milk. The cleansing milk's job is to dissolve sunscreen and SPF residue without irritating dry or rosacea prone faces, which is the audience the milk format was invented for.

Outside the Clinique lineup, malic acid does show up in the cleansing milk shelf, but rarely. Of the cleansing milks we've scanned across the US shelf since 2025, fewer than 6% list any alpha hydroxy acid in the ingredient column at all, and most of those that do use lactic, not malic. So the question of whether malic is safe in a cleansing milk is, in 94% of cleansing milks, a hypothetical. It's worth answering for the small slice of products it applies to. It's worth knowing before you panic about the cleansing milk you already own.

When should you still skip it?

The case for treating any AHA cleanser with extra care narrows down to four situations, none of them about malic acid specifically.

You've got an actively damaged barrier. If your skin is stinging, weeping, or peeling from a recent retinoid escalation, a sunburn, or fresh laser work, even a rinse off acid is the wrong move. The free acid that does cross is going somewhere your barrier can't stop it. Your barrier is the one telling you when to stop, and the signal usually shows up before the visible reaction does.

You've got rosacea or active eczema. Even at trace doses, your trigger threshold is lower than the general population's, and individual reactions aren't predictable from labels alone. Patch test the inner forearm for 72 hours before committing.

You're layering acids elsewhere in the routine. A malic cleanser plus a 10% glycolic toner plus a daily AHA pad isn't a wash dose anymore. The cleanser isn't the dangerous step, but the cumulative leave on dose stacks up. The chemistry of leave on versus rinse off acids is where the real exposure math happens.

You're pregnant and your obstetrician has told you to skip AHAs. That guidance is more conservative than the rinse off chemistry warrants, but it's also not your call to overrule from a blog post. Skip the cleanser. Use a fragrance free cream cleanser. Read why 'hypoallergenic' on the front label isn't a medical promise while you shop.

If none of these four apply to your skin and your routine, then malic acid in a daily cleansing milk is among the safest AHA exposures you will ever give your face, full stop, regardless of what the pregnancy infographic told you last week. Quieter than a serum. Quieter than a toner. Quieter than a peel by a factor of about a thousand. And in the Clinique milk specifically, it's not even in the formula. You can rest easy. If you want the broader read on barrier tolerance and how to build a routine that stays that way, Skinventry's barrier and hydration guide walks the rest of it.

The single line verdict

Safe. Use it the way the pharmacology measured it: applied, lathered, rinsed inside a minute. The dose stays below 0.04%, the barrier stays intact, and the AHA does the small amount of work it's actually capable of doing in 45 seconds, which isn't much. If you want exfoliation, that's a different product in a different tube.

References

• FDA, Alpha Hydroxy Acids in Cosmetics, current as of 2024.
• Kraeling MEK et al. Negligible penetration of incidental amounts of alpha hydroxy acid from rinse off personal care products in human skin using an in vitro static diffusion cell model. Cutaneous and Ocular Toxicology, 2011.
• Yu RJ, Van Scott EJ et al. dl Malic acid as a component of alpha hydroxy acids: effect on biochemical mechanisms. 2019.
• FDA, Guidance for Industry: Labeling for Topically Applied Cosmetic Products Containing Alpha Hydroxy Acids, 2005.
• Incidecoder. Clinique Take The Day Off Cleansing Milk INCI; Clinique All About Clean Micellar Milk INCI.