Citric Acid
In plain terms
The sour acid in citrus fruit, used to adjust pH, bind metals, and add tartness. It is also a normal part of the body's own energy cycle.
What the evidence shows
Citric acid is the sour-tasting acid in citrus fruit and a normal step in the energy cycle that runs in every living cell, which is the main reason it reads as low-concern. Food and cosmetic regulators line up behind it: the European Food Safety Authority found no safety concern at use levels, the FAO/WHO committee sets no numeric daily limit, the FDA treats it as generally recognized as safe, and the cosmetic review panel found no irritation or sensitization at the levels used on skin. Two smaller points are worth knowing. Almost all commercial citric acid is grown by fermenting sugar with a mold, Aspergillus niger, rather than squeezed from fruit, and a small case report has raised whether that manufactured form might provoke inflammation in a few mold-sensitive people; it rests on four patients and has not been repeated, so it stays an open question, not an established effect. And in a strong leave-on exfoliant, citric acid acts as an alpha hydroxy acid that can briefly raise sun sensitivity, which is why those products carry a sun-alert; at the low levels used to adjust pH, that does not apply.
On the label
Listed as citric acid or E330; the label will not say so, but commercial citric acid is almost always made by fermentation, not pressed from fruit. At exfoliating strengths it falls under the FDA's alpha-hydroxy-acid sunburn-alert guidance; as a simple pH adjuster, which is its usual job, that does not apply.