The FDA closed its investigation into an E. coli O157:H7 outbreak on September 10, 2026, and for the first time told the public the source was romaine lettuce. The outbreak had sat on FDA's public tracking table since July 1 listed as "Not Yet Identified." The CDC had already pinned the outbreak on romaine and declared it over back on July 29. FDA counted fourteen confirmed cases; it didn't say how many states had cases, patient ages, hospitalization counts, or whether anyone developed kidney failure. It named no grower, no processor, no brand. FDA's stated reason: the lettuce was already past its shelf life and off the market by the time investigators tracked it down.

1. Name Them (Bill Marler, STOP Foodborne Illness)

Food-safety advocates say once traceback lands on a company, FDA should just say who it is — expired product or not.

FDA has named companies in this exact situation eight times before. Seattle food-safety attorney Bill Marler represents foodborne-illness victims. He compiled eight prior outbreaks — from 2006 Dole spinach to 2022 FreshKampo strawberries — where FDA or CDC named the grower, processor, or brand even though the product was already off shelves.

Marler says the shelf-life excuse doesn't hold up. "A best-by date protects no one by the time a file closes," he wrote on September 10. He also points out FDA has given a different excuse almost every year: no "actionable information" in 2019, product might be frozen in 2025, shelf life in 2026.

Marler wants a fixed rule, not case-by-case discretion. "When traceback converges on a single grower or processor, FDA should name it, whether or not product remains on the market," he wrote. His reasoning: "A name is not a punishment. It is the only thing that lets a consumer, a buyer, a regulator or a juror connect this outbreak to the last one."

STOP Foodborne Illness is pushing the same fight through regulation. The victim-advocacy nonprofit filed a citizen petition on February 5, 2026, asking FDA to stop treating company names as confidential commercial information and to disclose them even without a recall.

2. But the Name Is Protected Info, FDA Says

FDA treats a grower's name as commercial data shielded by law, tied to its recall system rather than to whether an outbreak is officially over.

FDA's legal position is that trace-back names count as confidential commercial information. FDA spokesperson Peter Cassell said in a 2024 case that this category — exempt from public disclosure under the Freedom of Information Act and federal regulation — has long covered "raw material supplier lists, finished product customer lists, trace back information, etc."

FDA says its public warning tool is the recall, not after-the-fact naming. Cassell said the agency "publicizes recall notices, including pictures of affected products, and uses social media accounts to reach consumers as swiftly as possible." In this outbreak, there was no recall to issue — the lettuce was already gone.

This is FDA's standing policy, not a one-off call. FDA has applied the confidential-commercial-information framework across multiple outbreaks and administrations whenever a case doesn't trigger a recall.

Where This Lands

Marler's case rests on FDA's own paper trail: eight outbreaks where it named names under the identical "product's already gone" circumstance, and a rationale that's changed shape every cycle. FDA's case rests on a legal category — confidential commercial information — that it has invoked consistently for years. That category is tied to its recall system, not to whether the public still has time to act. STOP Foodborne Illness's petition, filed in February, is still waiting on an FDA answer.

Sources