Is CBD legal to sell online?
Is CBD legal to sell online? Federally, yes, if it comes from hemp. The 2018 Farm Bill defined hemp by a delta-9 THC concentration of not more than 0.3 percent on a dry weight basis and removed it from the controlled substances definition. States add their own rules, and the FDA restricts CBD in food and supplements.
Is CBD legal to sell online under federal law?
Federally, hemp is not a controlled substance. The Agriculture Improvement Act of 2018 defined hemp as cannabis with a delta-9 THC concentration of not more than 0.3 percent on a dry weight basis, and removed it from the controlled substances definition. CBD derived from hemp that meets that threshold is therefore not federally scheduled. That is the starting point, not the whole answer.
The statute is public and worth reading rather than trusting anyone's summary, including ours. The act itself is Public Law 115-334, the Agriculture Improvement Act of 2018, and the hemp definition it created sits at 7 U.S.C. 1639o. Those two links are the whole federal foundation for the CBD retail industry.
What exactly did the 2018 Farm Bill change?
It moved hemp out of drug law and into agriculture law. Hemp became a crop with a federal production framework administered by the Department of Agriculture, rather than a scheduled substance. The threshold that separates hemp from marijuana is the delta-9 THC concentration of not more than 0.3 percent on a dry weight basis. Everything above that line stays federally controlled.
The production side now runs through the Department of Agriculture, which publishes its hemp program at USDA Agricultural Marketing Service. That is where growing, sampling and testing rules live. It matters to retailers because the paperwork your supplier holds is the paperwork a bank will eventually want to see attached to your file.
Note what the act did not do. It did not make every hemp product saleable everywhere, it did not give the FDA a new pathway for CBD in food, and it did not oblige any bank or payment company to serve the industry. It removed a scheduling problem and left three other questions open.
Why does the delta-9 threshold matter so much in practice?
Because the whole federal definition turns on a measurement. Hemp is not a name you can claim. It is a concentration on a dry weight basis, which means the claim is only as good as the testing behind it. That is why laboratory documentation carries so much weight with regulators, with buyers and with underwriters. Without it, nobody can tell your product from the scheduled version.
The definition itself is at 7 U.S.C. 1639o, and the sampling and testing side of the federal production framework is published by the USDA Agricultural Marketing Service. For a retailer the practical translation is simple. Keep current certificates of analysis for every product you list, from a lab you can name, and make sure the batch on the shelf matches the certificate you are holding.
Who regulates hemp retail, and at which level?
Three layers, doing different jobs. The Department of Agriculture runs the federal production framework for the crop. The FDA speaks to food, supplements and health claims. States regulate retail sale inside their own borders, usually through agriculture and health departments. No single agency signs off on an online CBD store, which is exactly why the answer feels slippery.
Knowing which layer you are dealing with saves a lot of wasted argument. A question about growing or testing the crop points at the USDA hemp program. A question about putting CBD in a drink or calling it a supplement points at the FDA. A question about whether you may sell a specific product to a customer in a specific state points at that state, and only that state can answer it.
What is the FDA position on CBD in food and supplements?
The FDA has stated that CBD may not be lawfully added to food or marketed as a dietary supplement under the current framework, and it has said a new regulatory pathway is needed. That position is separate from whether hemp is a controlled substance. A product can sit outside drug law and still be marketed in a way the FDA treats as unlawful.
The agency sets out its position on cannabis and cannabis-derived products, including cannabidiol, at fda.gov. For an online store the practical consequence is about your copy. Health claims, condition claims and anything that reads as treating a disease are the fastest route to both a regulatory letter and a declined application. We cover why on what makes CBD high risk.
What does that position mean for the words on your product pages?
It means your copy carries regulatory weight, not just marketing weight. Naming a condition, promising relief, implying a cure or describing your product as a supplement all move you toward the ground the FDA has spoken about. Underwriters read the same pages and reach the same conclusion. Write what the product is and let the customer decide what it is for.
Read your own site the way an underwriter will. Product titles, bullet lists, blog posts, customer quotes, email flows and the alt text on your images all count as your claims. The riskiest lines are usually the ones written early, by someone who never expected a bank or a regulator to read them.
Do state rules change the answer where I sell?
Yes, and this is where most sellers get caught. States regulate hemp products under their own laws, and they differ on which product forms are allowed, what testing and labeling is required, what age limits apply and how intoxicating hemp derivatives are treated. We do not publish a state-by-state table we cannot keep accurate. Check your state agriculture or health department directly.
We are deliberately not listing state rules here. A stale table on a payments site is worse than no table, because someone builds a shipping policy on it. What we will say is what to check: whether your product form is permitted, what testing and labeling your state requires, what minimum age applies to sales, and how your state treats intoxicating hemp derivatives. Your state agriculture department and state health department publish those answers, and a lawyer in your state can confirm them for your specific product line.
How does shipping across state lines change your obligations?
It widens them. A storefront answers to one state. An online store answers to every state it accepts an order from, so the strictest state on your shipping map sets your real operating limit. Decide which states you will ship to before you launch, wire that decision into checkout, and keep the list somewhere you will actually maintain it.
Build the answer before you build the checkout, and wire age verification to match. Two practical habits help. Keep your restricted-state list in one place rather than scattered across the theme and the shipping app, and put a date on it so you know when it was last reviewed. Underwriters like seeing that a seller has a process, not just an opinion.
What does legality have to do with getting a merchant account?
Legality gets you in the door. It does not get you approved. A bank underwrites the whole file: what you sell, how you describe it, your lab documentation, your refund policy and your chargeback history. Sellers with a perfectly legal product get declined regularly for how the website makes claims, not for the product itself.
Aggregators skip the underwriting entirely and exclude the category instead, which is why sellers keep getting shut off by platforms they never spoke to. That mechanic is explained on why PayPal bans CBD, and the alternative is on high risk processing.
What should an online CBD store have in place before applying?
Have current certificates of analysis from an accredited lab for the products you sell, labeling that matches the contents, a refund policy a customer can actually find, clear age gating, and marketing copy that avoids disease and treatment claims. That package answers most of what underwriting is going to ask before it asks.
With that in hand, the account itself is straightforward. Finished consumer goods usually route through a CBD merchant account, while flower, biomass and wholesale supply sit better on a hemp merchant account. The checkout connects through a CBD payment gateway, so your customer's experience does not change.
What else do online sellers ask about this?
Is CBD legal to sell in every state?
No, and we will not pretend otherwise. Federal law removed hemp from the controlled substances definition, but states set their own retail rules and some restrict particular product forms. Your state agriculture and health departments publish the current position, and a lawyer in your state can apply it to your product line.
Does the 0.3 percent threshold apply to the plant or the finished product?
The federal definition is written as a delta-9 THC concentration on a dry weight basis. How that measurement is applied to a finished consumer product, and what testing method proves it, is handled differently by different state programs. Rely on your certificates of analysis and legal advice in your state, not on a rule of thumb.
Can I sell CBD gummies or drinks online?
Products of that kind sit directly against the FDA position that CBD may not be lawfully added to food or marketed as a dietary supplement. Plenty of stores sell them anyway. Understand that you are choosing a regulatory risk, and expect underwriters to ask about it.
Are delta-8 and other converted cannabinoids treated the same as CBD?
Not by states and not by payment providers. Many states treat intoxicating hemp derivatives under separate rules, and processors often list them separately from plain CBD. We are not going to state a settled federal position here, because there is not one we can source.
Do I need a license to sell CBD online?
The federal hemp framework licenses producers of the crop, not retailers. Whether you need a state or local registration to sell finished products depends entirely on your state and sometimes your city. Check before you launch rather than after your first order.
Does age verification matter for a CBD store?
Yes, on two fronts. Several states set minimum ages for hemp product sales, and underwriters read age gating as a sign of a store that takes compliance seriously. It is cheap to add and it removes an easy reason to decline your file.
Will a bank ask which states I ship to?
Expect it. A sponsor bank is underwriting an account that has to stay compliant for years, so it wants to know your shipping footprint and whether you have a process for keeping up with changes. Having a clear answer already written down puts you ahead of most applications.
Get the payment side right from the start
Tell us what you sell and which states you ship to. A Rooted Payments specialist walks you through what a sponsor bank needs to see.