This guide covers the federal and state legal framework, what qualifies a product as compliant, licensing requirements, product-specific rules, labeling obligations, compliance risks, and payment processing for CBD businesses.
The 2018 Farm Bill created hemp CBD’s legal foundation by removing hemp from the Controlled Substances Act, but a 2026 federal “Hemp Cliff” and a new FDA enforcement policy submitted to the White House are actively narrowing what qualifies as compliant.
State rules add another layer: some states allow most hemp CBD formats with minimal licensing, while others, including Ohio and Tennessee, have restricted or reclassified entire product categories within the past six months.
Sellers must also understand how product type shapes legal exposure. Oils and topicals face the least regulatory friction, while edibles, beverages, and smokable hemp are subject to the most active state-level bans and age restrictions.
Labeling and compliance obligations apply to every seller regardless of format, covering required label elements, prohibited health claims, and the Certificate of Analysis standards that regulators and retailers now treat as baseline expectations.
Non-compliance carries real consequences: license revocation, payment account termination, and federal penalty exposure under legislation that takes effect in November 2026. Mainstream processors like Stripe and PayPal explicitly ban CBD, making a high-risk payment specialist a practical necessity for any CBD business operating in this environment.
What Is the Current Federal Legal Status of CBD in 2026?
The current federal legal status of CBD in 2026 is conditional: hemp-derived CBD remains federally legal under the 2018 Farm Bill framework, but new legislation and regulatory actions are actively reshaping compliance boundaries. The H3s below cover the Farm Bill’s original protections, the FDA’s ongoing regulatory gap, and the policy shifts that occurred between 2024 and 2026.
Is CBD Legal Under the 2018 Farm Bill?
CBD is legal under the 2018 Farm Bill when derived from hemp meeting a specific threshold. The 2018 Farm Bill (H.R. 2) removed hemp and hemp-derived products from the Controlled Substances Act by defining hemp as Cannabis sativa L. with a delta-9 THC concentration of no more than 0.3 percent on a dry weight basis, according to the U.S. Food and Drug Administration.This definition made broad categories of CBD products federally permissible overnight. However, legal analysts now warn that the 2026 federal “Hemp Cliff” redefines compliance using a total THC formula, calculated as (%THCA x 0.877) + %Delta-9 THC, potentially reclassifying many current hemp products as Schedule I substances. The 0.3% delta-9 threshold alone no longer guarantees compliance.
Did the FDA Regulate CBD After the Farm Bill?
The FDA did not establish a comprehensive CBD regulatory framework after the Farm Bill passed. While the agency acknowledged CBD’s removal from the Controlled Substances Act, it consistently maintained that CBD could not be legally marketed as a dietary supplement or food additive because it had already been approved as a drug ingredient in Epidiolex. This created a prolonged enforcement gray area, leaving sellers without clear federal guidance on product standards, labeling, or permissible health claims.Has Federal CBD Policy Changed Between 2024 and 2026?
Federal CBD policy has changed significantly between 2024 and 2026, with two major regulatory developments reshaping the landscape. In mid-March 2026, the FDA submitted a document titled “Cannabidiol (CBD) Products Compliance and Enforcement Policy” to the White House Office of Information and Regulatory Affairs (OIRA), marking the first concrete federal enforcement framework for CBD since 2018, according to Cannabisregulations.ai. Separately, on April 23, 2026, Acting Attorney General Todd Blanche stated the DEA’s downscheduling order aims to “strengthen medical research while maintaining strict federal controls” over certain products. Together, these actions signal that federal tolerance for unregulated CBD sales is narrowing considerably.What Makes a CBD Product Legal to Sell in 2026?
A CBD product’s legality depends on its source, its hemp-derived cannabinoid content, and its product format. The sections below cover how each factor applies to sellers in 2026.Does the Source of CBD Determine Its Legality?
Yes, the source of CBD determines its legality under federal law. The 2018 Farm Bill established that hemp-derived CBD is federally legal, while CBD extracted from marijuana remains a Schedule I controlled substance. Hemp is defined as Cannabis sativa L. with a delta-9 THC concentration of no more than 0.3 percent on a dry weight basis. Products derived from marijuana-sourced CBD cannot be legally sold commercially, regardless of their stated CBD content. Source verification is the foundational compliance check for any CBD seller.Does THC Content Affect Whether CBD Is Legal to Sell?
Yes, THC content directly affects whether CBD is legal to sell. Federal law caps delta-9 THC at 0.3 percent on a dry weight basis for hemp-derived products. Legal analysts warn that the 2026 federal “Hemp Cliff” applies a total THC formula, calculated as (%THCA x 0.877) + %Delta-9 THC, which could reclassify many currently compliant products as Schedule I substances. Products exceeding these thresholds lose their hemp classification and cannot be legally sold. Sellers should treat total THC testing, not just delta-9 testing, as a non-negotiable compliance step.Does the Type of CBD Product Affect Its Legal Status?
Yes, the type of CBD product affects its legal status, particularly at the state level. Ohio Senate Bill 56, effective March 20, 2026, bans most hemp-derived cannabis products and specifically targets THC-infused drinks. In Tennessee, effective January 1, 2026, regulatory oversight of hemp-derived cannabinoid products transferred from the Department of Agriculture to the Tennessee Alcoholic Beverage Commission, signaling tighter controls on ingestible formats. Topicals and isolates generally face fewer restrictions, while edibles, beverages, and smokable hemp face the most regulatory scrutiny across states.Is Selling CBD Legal in Every U.S. State in 2026?
Selling CBD is not legal under uniform rules in every U.S. state in 2026. State laws vary widely, covering which product types are permitted, age restrictions, licensing requirements, and outright bans on certain formats. The sections below outline which states fully allow sales, which impose restrictions, and which ban specific product types.
Which States Fully Allow the Sale of Hemp-Derived CBD?
The states that fully allow the sale of hemp-derived CBD are those that have adopted federal hemp definitions without adding significant restrictions of their own. Most states in this category permit CBD oils, topicals, and capsules without a dedicated hemp retail license, provided products meet the 0.3% delta-9 THC threshold. However, even in permissive states, payment infrastructure presents a practical barrier. According to cannabisregulations.ai, Square permits hemp CBD sales in most U.S. states but requires a separate application and has been reported to hold merchant funds during compliance reviews, creating operational friction for otherwise compliant sellers.Which States Have Restrictions on Selling CBD Products?
The states with restrictions on selling CBD products include California and Tennessee, among others. California and Connecticut require customers to be at least 21 years old to purchase edible or drinkable CBD products. In Tennessee, effective January 1, 2026, regulatory oversight of hemp-derived cannabinoid products transferred from the Department of Agriculture to the Tennessee Alcoholic Beverage Commission, adding a new licensing layer for sellers of consumable products.Which States Ban Certain CBD Product Types Entirely?
The states that ban certain CBD product types entirely include Ohio and Texas. Ohio Senate Bill 56, effective March 20, 2026, bans most hemp-derived cannabis products and specifically targets Hemp and CBD-infused drinks. Texas prohibits the sale of consumable hemp products to persons under 21 and requires manufacturers, sellers, and distributors to register with the Texas Department of State Health Services. Given how rapidly state laws are shifting in 2026, sellers should treat state compliance as a living checklist, not a one-time review.What Licenses or Permits Do You Need to Sell CBD Legally?
The licenses and permits required to sell CBD legally depend on your sales channel, state, and product type. The following sections cover online seller requirements, state retail licensing, and FDA registration for supplement sellers.Do You Need a License to Sell CBD Online in 2026?
Yes, you need a license to sell CBD online in 2026, though the specific requirements vary by state rather than a single federal mandate. No universal federal online seller’s license exists for hemp CBD; instead, most states require hemp retailer registration or a business license that explicitly covers hemp-derived products. Sellers must also verify that their products comply with destination-state laws, since shipping CBD to a state that bans certain product types creates legal exposure. On April 23, 2026, the DEA downscheduled marijuana in FDA-approved drug products and state-licensed medical products from Schedule I to Schedule III, a shift that reinforces how rapidly the regulatory landscape is moving and why state-by-state licensing verification is essential before selling online.Do You Need a State Retail License to Sell CBD In-Store?
Yes, you need a state retail license to sell CBD in-store, and requirements differ significantly across states. Texas is a clear example: Texas regulations require businesses that manufacture, sell, or distribute consumable hemp products (CHPs) to register or obtain a license from the Texas Department of State Health Services (DSHS), and sales to persons under 21 are prohibited. Other states operate similarly, with dedicated hemp retail permits separate from a standard business license. Verifying your state’s specific hemp retailer registration process before opening is non-negotiable.Do You Need FDA Registration to Sell CBD as a Supplement?
Yes, you need FDA registration to sell CBD as a dietary supplement, with important limitations. The FDA does not currently recognize CBD as a lawful dietary supplement ingredient, meaning no CBD product can be legally marketed under the standard dietary supplement pathway without further regulatory action. Sellers operating as food facility manufacturers must register with the FDA under the Food Safety Modernization Act (FSMA), but this registration does not grant approval to sell CBD supplements. In mid-March 2026, the FDA submitted its “Cannabidiol (CBD) Products Compliance and Enforcement Policy” to the White House OIRA, representing the first concrete federal enforcement framework since 2018. Until that policy is finalized, selling CBD as a supplement carries significant compliance risk, making professional legal review essential before launching any supplement product line.What CBD Products Are Legal to Sell Commercially in 2026?
CBD products legal to sell commercially in 2026 span several categories, each with distinct regulatory requirements. The following sections cover oils and tinctures, edibles and beverages, topicals and cosmetics, and pet products.
Are CBD Oils and Tinctures Legal to Sell?
CBD oils and tinctures are legal to sell commercially in 2026, provided the hemp-derived CBD contains no more than 0.3% delta-9 THC on a dry weight basis, as established by the 2018 Farm Bill. These products represent the most straightforward category for compliance, as they are widely accepted across most U.S. states. Sellers must still verify state-specific licensing requirements, maintain Certificates of Analysis from accredited labs, and avoid any disease treatment claims on labeling. Of all CBD product types, oils and tinctures carry the fewest regulatory complications, making them the safest commercial entry point.Are CBD Edibles and Beverages Legal to Sell?
CBD edibles and beverages are legal to sell in many states, but this category faces the most active legal restrictions in 2026. Ohio Senate Bill 56, effective March 20, 2026, specifically bans most hemp-derived cannabis products and targets THC-infused drinks. California and Connecticut require customers to be at least 21 years old to purchase edible or drinkable CBD products, according to Cova Software. Sellers in this category must verify restrictions state by state before distribution, as the regulatory landscape is shifting rapidly.Are CBD Topicals and Cosmetics Legal to Sell?
CBD topicals and cosmetics are legal to sell commercially in 2026 and are among the least restricted CBD product categories at the federal level. These products do not enter the bloodstream through ingestion, which reduces regulatory scrutiny compared to edibles or ingestible supplements. FDA rules still prohibit labeling that implies the product can diagnose, treat, cure, or prevent any disease. Topicals typically qualify for lower high-risk payment processing rates, making them financially advantageous for merchants managing compliance costs.Are CBD Pet Products Legal to Sell?
CBD pet products are legal to sell in many U.S. states in 2026, though federal regulatory clarity remains limited. The FDA has not approved any CBD-based animal products, which means sellers cannot make disease treatment claims on pet product labels, just as with human products. State-level rules vary widely, and some states apply the same age-verification and licensing requirements to pet products as to human consumables. Retailers should obtain batch-specific Certificates of Analysis and confirm state registration requirements before listing CBD pet products commercially.What Labeling and Compliance Rules Apply to CBD Sellers?
CBD labeling and compliance rules cover required label elements, third-party lab testing, and prohibited health claims. The following sections break down each requirement CBD sellers must meet to stay compliant in 2026.What Must Be on a CBD Product Label to Be Compliant?
A compliant CBD product label must include the product name, net weight, ingredient list, CBD content per serving, manufacturer name and address, batch or lot number, and a clear disclaimer that the FDA has not evaluated the product. Many states also require a scannable QR code linking directly to a batch-specific Certificate of Analysis (COA) that matches the lot number on the package. FDA rules prohibit CBD labels from stating or implying that the product can diagnose, treat, cure, or prevent any disease, as CBD products cannot be marketed as drugs without FDA approval.
Are Third-Party Lab Reports Required to Sell CBD Legally?
Third-party lab reports are not universally required by federal law, but most states either mandate them or treat their absence as a compliance red flag. A Certificate of Analysis from an independent, accredited laboratory confirms cannabinoid potency and verifies the absence of pesticides, heavy metals, and solvents. Many state retailers and e-commerce platforms now require a current COA before they will stock or list a product. For CBD sellers, third-party testing is the single most effective way to demonstrate product integrity and avoid regulatory action.What Health Claims Are Prohibited on CBD Product Labels?
Prohibited health claims on CBD product labels include any language stating or implying that the product treats, cures, prevents, or mitigates a specific disease or condition. According to the FTC, any health-related claim for CBD must be supported by competent and reliable scientific evidence, which generally requires rigorous, well-controlled human clinical studies. Common violations include phrases such as “relieves anxiety,” “treats inflammation,” or “cures chronic pain.” Structure/function claims framed carefully (for example, “supports a sense of calm”) may be permissible, but sellers should review each claim against both FDA and FTC standards before printing.What Are the Risks of Selling CBD Without Proper Compliance?
The risks of selling CBD without proper compliance include license revocation, payment account termination, and federal penalties. The sections below cover business license exposure, payment processor consequences, and the fines CBD sellers may face in 2026.Can You Lose Your Business License for Non-Compliant CBD Sales?
Yes, you can lose your business license for non-compliant CBD sales. State regulators treat unlicensed or out-of-compliance CBD operations as grounds for suspension or revocation of retail, manufacturing, and distribution permits. States with formal licensing frameworks, such as Texas, which requires registration through the Department of State Health Services, enforce these rules actively. Selling to minors, carrying non-compliant products, or operating without required state registration all create direct exposure to license loss. For CBD businesses, losing licensure typically means an immediate halt to all operations, making compliance maintenance a core business priority, not an optional one.Can Payment Processors Drop You for CBD Compliance Violations?
Yes, payment processors can drop you for CBD compliance violations. According to Cannabisregulations.ai, Square permits hemp CBD sales in most U.S. states but requires a separate application and has been reported to hold merchant funds during compliance reviews. Mainstream processors like Stripe, Shopify Payments, and PayPal explicitly prohibit CBD sales, often triggering sudden account freezes and held funds. Any compliance gap, such as non-compliant labeling or selling a newly restricted product type, gives processors cause to terminate accounts without notice. For CBD merchants, this is one of the most immediate operational risks: a frozen account can halt all revenue while funds remain inaccessible for weeks or months.What Fines or Penalties Can CBD Sellers Face in 2026?
The fines and penalties CBD sellers can face in 2026 include civil enforcement actions, product seizures, and federal reclassification exposure. According to the Texas State Law Library, Section 781 of H.R. 5371, signed November 12, 2025, redefines hemp to exclude products with “intoxicating levels” of Hemp and CBD, with the ban taking effect November 12, 2026. Sellers carrying products that fall outside this redefined threshold after that date risk federal violations, which carry significantly heavier penalties than state-level infractions. FTC enforcement for unsubstantiated health claims and FDA warning letters add further financial and reputational exposure. In 2026, the penalty landscape is more consequential than in any prior year, and sellers operating without current legal guidance are taking on compounding risk.How Can CBD Businesses Accept Payments Legally in 2026?
CBD businesses can accept payments legally in 2026 by working with processors specifically approved for high-risk merchants. The sections below cover why mainstream processors refuse CBD accounts and how a high-risk payment processor helps sellers stay compliant.Why Do Mainstream Processors Reject CBD Merchants?
Mainstream processors reject CBD merchants because they classify hemp and CBD sales as high-risk due to regulatory uncertainty and chargeback exposure. Stripe, Shopify Payments, and PayPal explicitly prohibit CBD sales on their platforms, often resulting in sudden account freezes and held funds with no warning.The core problem is federal ambiguity: even fully compliant hemp-derived CBD occupies a gray zone that major processors are unwilling to underwrite. Square permits hemp CBD sales in most states but requires a separate application and has been reported to hold merchant funds during compliance reviews. For CBD businesses, relying on mainstream processors is not a strategy but a liability.
Can a High-Risk Payment Processor Help CBD Sellers Stay Compliant?
Yes, a high-risk payment processor can help CBD sellers stay compliant by combining dedicated underwriting for hemp products with ongoing compliance support. According to BeastMetrics, high-risk merchant accounts for CBD typically carry a rolling reserve of 5% to 10% of monthly volume held for 90 to 180 days, with processing fees ranging from 4% to 8%. Market analysis also indicates that topicals and isolates generally qualify for lower rates, while smokable hemp and edibles sit at the higher end.2Accept specializes in exactly this environment. 2Accept provides CBD businesses with compliant payment processing, FDA compliance reviews, website marketing screening, and dedicated payment experts available by phone, with accounts set up in as little as 48 hours.
What Are the Key Takeaways About Selling CBD Legally in 2026?
The key takeaways about selling CBD legally in 2026 center on three practical priorities: source compliance, state-by-state awareness, and payment infrastructure.- Product compliance requires staying within the 0.3% delta-9 THC threshold, avoiding prohibited health claims on labels, and maintaining batch-specific Certificates of Analysis.
- State regulations vary significantly; rules around age restrictions, licensing, and product categories differ by state and continue to evolve.
- Payment processing requires a high-risk specialist. Mainstream processors will terminate accounts without notice, making a purpose-built hemp and CBD merchant account essential for uninterrupted revenue.