Data centers, which enable the world’s internet use, hold more than people’s vacation photos or sensitive data. They contain rows and rows of computer servers that use “forever chemicals.”
PFAS, or per– and polyfluoroalkyl substances, are a family of thousands of synthetic chemicals that have been used since the 1940s largely to make products resistant to water and heat. The sturdy fluorine carbon bond makes the chemicals last virtually “forever” in the environment, since natural processes can’t break them down.
Studies have linked long-term exposure to even low levels of some PFAS with serious health problems, including cancer and damage to reproductive and immune systems.
But the potential impact of PFAS contamination from data centers has not received much attention.
“Unfortunately, there’s been very little analysis and disclosure of PFAS used in data centers … and considering the pace at which data centers are being built across the country, that void of information is incredibly concerning,” said Jonathan Kalmuss-Katz, senior attorney with Earthjustice.
Data centers don’t produce forever chemicals, but they are baked into much of the hardware due to their water-repellant and heat-resistant properties. Two specific carcinogenic forever chemicals, PFOA and PFOS, are banned in manufacturing so they shouldn’t be in new technology. But thousands of other PFAS, which range in durability and toxicity, are legal to use.
In data centers, these chemicals are used in two main ways: in semiconductors in computer servers and in cooling systems reserved for especially large data centers, like those that process artificial intelligence.
Claire Bencks, communications manager for the Data Center Coalition, said the estimated life cycle of computer servers averages three to four years.
Virginia and the U.S. Environmental Protection Agency don’t have strict regulations on how to dispose of the parts with forever chemicals. But, in general, data centers try to reuse or resell every piece. Amazon sourced 16% of spare parts from its reuse inventory in 2024. Google sold or reused 8.8 million components from its decommissioned hardware in 2024.
When the technology can’t be reused or resold, data centers often hire a certified recycler or use their own certified recycling teams. From there, they aim to recover every ounce of copper, aluminum or gold from these devices. What remains is smelted, and hazardous residues are stabilized so they don’t leach into the environment.
“A lot of the bigger data center companies, whether through selfish reasons or otherwise, they are [keeping] and continue to keep stuff out of landfills,” said Nick Villegas, who works at the certified recycler exIT Technologies.
For technology with PFAS, these recyclers work with specialized facilities that use advanced filtration or thermal destruction systems to break the chemicals down. However, if a company doesn’t use one of these recyclers and takes e-waste to the landfill, the lining of the landfill isn’t equipped to prevent forever chemicals from leaching. The parts that become solid waste, though, are subject to Virginia Solid Waste Management Regulations and Virginia Hazardous Waste Management Regulations.
If PFAS ends up reaching drinking water from the landfill, the Virginia Department of Environmental Quality could step in. By law, the department must find any sources of contamination when PFAS levels exceed a certain threshold in drinking water.
“The data center industry takes compliance and accountability seriously and works closely with the many local, state, regional and federal bodies responsible for permitting and project approvals, regulation in environmental, safety and other key areas, and oversight,” said Jon Hukill, director of communications with the Data Center Coalition.
The Semiconductor Research Corporation created a Sustainability and Energy Efficiency Roadmap that explores how it could replace PFAS in semiconductors with chemicals that are less toxic.
“If you want to build these data centers, it [can’t] come at the expense of public health,” Kalmuss-Katz from Earthjustice said. “If that message comes clearly from federal, state and local regulators, then these kinds of companies … that claim to be at the forefront of technological innovation will find ways to adapt and to move beyond PFAS.”
Another set of chemicals of concern in data centers is called fluorinated gases or “f-gases.” They are a stronger version of the coolants used in typical refrigerators — in data centers, they prevent servers from getting too hot. The cooling system that uses these f-gases are active in less than 5% of data centers, but at least one data center company with sites in Virginia is experimenting with them.
The U.S. does not consider f-gases to be forever chemicals. Although they have fluorine-carbon compounds, which prevent PFAS from breaking down, the extent of those compounds varies among chemicals. Based on the composition found in f-gases, the U.S. government doesn’t classify them as PFAS.
Kyle Doudrick, associate professor of environmental engineering at the University of Notre Dame, said most f-gases aren’t known to be toxic like the well-studied forever chemicals PFOA and PFOS.
But f-gases are potent greenhouse gases. For example, perfluorohexane, which is sometimes used in these cooling systems, is 10,000 times more potent than carbon dioxide.
The risk to the environment, though, might not be large. Because the refrigerants are reused and kept in a closed loop system, Doudrick isn’t too concerned about environmental contamination. Still, he said, leaks can happen.
Cassie Olszewski, media relations and reputation leader for Chemours, said in an email that “if an f-gas is unable to be recycled, it is disposed of in accordance with local regulations and using licensed waste handlers.”
Virginia allows data centers to use f-gases, particularly hydrofluorocarbons, because they are considered industrial sources.
Most forever chemicals are not considered hazardous under the Resource Conservation and Recovery Act. However, the American Innovation and Manufacturing Act, which took effect last year, requires data centers to monitor and repair any leaks.