Do Dispensaries Share Information with the Government?

With the growing legalization of cannabis in the United States, privacy concerns have become a key topic for many consumers. The U.S. legal cannabis market reached a value of $33.6 billion in 2023. Projections indicate that revenue will increase to $76.39 billion by 2030. With millions of Americans using both medical and recreational cannabis, it’s important to understand how dispensaries handle and share personal information and whether it’s passed on to government agencies.

Dispensaries collect certain personal information, such as identification cards and medical marijuana certifications, to comply with state regulations, but the extent to which this information is shared with the government varies depending on the state’s laws. This blog will explore the regulatory requirements dispensaries face, how they manage customer data, and what protections are in place to safeguard your privacy.

If you’re a cannabis consumer, understanding how dispensaries handle your personal information is essential to securing your privacy and staying informed about regulatory compliance in this rapidly growing industry.

The Collection of Personal Information at Dispensaries

When visiting a dispensary in states that have legalized medical or recreational cannabis, customers are generally required to present a government-issued identification card. For recreational cannabis, the minimum legal age is typically 21 years, while medical marijuana users must present a state-issued medical marijuana card to verify their eligibility. This ID verification process guarantees that the dispensary complies with state laws regarding purchase eligibility.

The information collected by dispensaries often includes:

• Full Name
• Date of Birth
• State Identification Number (from a driver’s license or state ID)
• Medical Marijuana Card Number (for medical users)

Dispensaries collect this information to comply with state regulations aimed at preventing unauthorized sales, monitoring purchase limits, and providing only qualified individuals with access to marijuana products. However, concerns have been raised regarding whether this personal information is shared with state governments or even with the federal government, especially given that cannabis remains illegal under federal law.

Is This Information Shared with the Government?

In most states, the personal information collected by dispensaries is used primarily for verification and compliance with state laws. In states like California, dispensaries are legally required to verify age and eligibility but are generally prohibited from sharing personal data with third parties or the federal government without customer consent​. The same is true for Colorado, where dispensaries must track the amount of cannabis purchased but do not report personal details directly to the government. 

States with medical marijuana programs may maintain medical registries, but these databases are generally kept confidential and only accessible to state health departments and law enforcement under specific conditions, such as checking for eligibility or investigating illegal activity. Even in these cases, the federal government does not have direct access to these records.

Dispensaries also use seed-to-sale tracking systems, like Metrc, which monitor cannabis from cultivation to sale. However, this tracking typically involves inventory control rather than personal customer information, focusing on making sure the cannabis remains in the legal market​.

Federal Government Involvement

Despite the growing number of states legalizing cannabis, marijuana remains classified as a Schedule I controlled substance under the Controlled Substances Act (CSA). This classification means that, according to federal law, marijuana is considered to have a high potential for abuse and no accepted medical use, even though many states have legalized it for both medical and recreational purposes. 

The federal government does not currently require states or dispensaries to share customer information related to marijuana purchases. The focus of federal enforcement has shifted over time, particularly following the issuance of the Cole Memorandum in 2013, which directed federal law enforcement to prioritize large-scale illegal activities rather than individual consumers in states where marijuana is legal. Although the Cole Memo was rescinded in 2018, federal enforcement still typically targets significant illegal operations, such as drug trafficking, rather than pursuing individual marijuana users or state-licensed dispensaries.

Additionally, federal benefits such as healthcare, employment with federal agencies, or housing assistance could be affected due to the federal classification of marijuana. For example, federal employees are subject to drug-free workplace policies; therefore, medical marijuana use could impact employment opportunities in some cases.

The Importance of Medical Marijuana Registries

In states where medical marijuana is legal, patients must register with the state’s medical marijuana program to obtain a card, which permits individuals with qualifying conditions to purchase cannabis for medical purposes. The process involves submitting personal data, but rest assured, this information is typically kept confidential and is not shared with federal authorities.

Key points about medical marijuana registries:

• Confidentiality: Personal data collected during registration is securely stored and is accessible only to authorized state personnel or law enforcement when necessary.
• State-Specific Programs: Each state runs its own medical marijuana program, such as that of Missouri’s Department of Health and Senior Services, which maintains a secure database of registered patients.
• Cross-State Limitations: Patients should note that out-of-state medical marijuana cards may not be recognized in other states. Federal protections do not extend to medical marijuana users, meaning federal agencies may not honor these cards.

While medical marijuana registries help provide legal access to cannabis, patients should remain cautious when traveling or interacting with federal agencies, as the federal government does not provide protections for medical cannabis use.

Purchase Limits and Regulatory Compliance

In states that have legalized cannabis, dispensaries must follow strict purchase limits set by state law to maintain regulatory compliance. These limits dictate how much cannabis an individual can buy within a specific time frame, usually within a day. For example, these legal purchase limits are outlined in the California Health and Safety Code:

Adults aged 21 and over can legally possess and purchase up to:

• 28.5 grams of cannabis in the form of dried flower (about one ounce).
• 8 grams of concentrated cannabis (including concentrates in products).

Medical marijuana patients with a valid physician’s recommendation may possess and purchase up to:

• 8 ounces of dried cannabis per day.

Dispensaries are required to track purchases to make certain these limits are not exceeded. In California, this tracking is typically done through a point of sale platform, such as IndicaOnline’s POS system, which records transactions and maintains dispensary compliance with the state’s rules.

Protecting Personal Information

Dispensaries are legally required to protect the personal information of their customers, especially as the cannabis industry grows and the need for data security becomes increasingly important. Dispensaries often handle sensitive data, including identification numbers and medical marijuana card details, which must be protected from breaches and unauthorized access.

For instance, in Illinois, dispensaries are required by the Compassionate Use of Medical Cannabis Program Act to adopt stringent security protocols similar to those mandated by HIPAA (The Health Insurance Portability and Accountability Act). This includes using encryption to safeguard patient data, conducting regular security risk assessments, and implementing administrative, technical, and physical controls to prevent unauthorized access.

Similarly, Nevada enforces strict security and storage protocols for cannabis establishments. Dispensaries in Nevada must secure all sensitive data and inventory with encrypted systems and store it within locked, restricted-access areas to prevent unauthorized entry or theft. These measures are designed not only to comply with state laws but also to protect personal customer data from being shared inadvertently with unauthorized parties or the government. The legal frameworks in states like Illinois and Nevada help maintain the privacy of individuals who purchase cannabis, whether for medical or recreational use.

Are Dispensaries Sharing Your Information?

In summary, while dispensaries do collect personal information for verification purposes and compliance with state law, this data is not typically shared with the federal government. State governments may have access to some transaction data, particularly related to the amount of cannabis sold, but customer information is usually protected under strict privacy laws.

However, consumers should always be mindful of the legal gray areas between state and federal marijuana laws, particularly when traveling or interacting with federal agencies. As the cannabis industry continues to grow, maintaining transparency over how dispensaries handle and share customer information will be crucial for protecting consumer privacy and establishing trust.

Protecting Consumer Privacy in the Growing Cannabis Industry

While dispensaries do collect personal information—such as IDs and medical marijuana card numbers—for verification and compliance with state laws, this data is not typically shared with the federal government. However, consumers should be aware of the ongoing conflict between state and federal laws. While marijuana may be legal in your state, it remains illegal under federal law, which creates potential risks when traveling or interacting with federal agencies. For instance, transporting cannabis across state lines, even between states where marijuana is legal, can lead to federal penalties.

​As the cannabis industry grows, transparency about how dispensaries manage and protect customer information will be essential to fostering consumer trust and protecting privacy in compliance with evolving state regulations.