CBD legality by state: the 2026 shipping table

Hemp law in the United States is a federal floor with 51 state ceilings, and in 2026 both layers are moving. The table below is the rule set this store runs at checkout: one row for every state and the District of Columbia, for each of four product lanes, with the statute, the age floor, the reviewed date and a confidence grade. It is built from statute text and state agency pages, not from retailer blogs, and every row carries the URL it rests on.

What are the four product lanes in the table?

Lane A1 covers CBD, CBG and CBN products, including pet products, that test non-detect for THC at a stated limit of quantitation. No state bans this category outright, but a growing number require a license, registration or endorsement before a seller may ship to residents, and two states restrict ingestible forms, which is why many A1 rows read "gate".

Lane A2 is full-spectrum. A full-spectrum tincture carries real milligrams of THC per bottle, and that single fact decides its status in roughly half the states. States that cap THC per serving or per package, states that reserve any detectable THC for licensed cannabis retailers, and states that ban online hemp sales all land this lane in "exclude".

Lane B is THCa flower and hemp-derived delta-9 edibles and beverages. Both are intoxicating, both are measured by total THC in a majority of states, and both lose federal hemp status on December 11, 2026 unless Congress acts (P.L. 119-103, sec. 2019). Lane C is bulk isolate and distillate sold business to business, which the federal definition handles as an intermediate product rather than a final product.

What do ship, gate and exclude mean?

"Ship" rows still enforce the age floor, 18 for non-detect products and 21 for anything with THC, because the floor is a store policy rather than a state-by-state calculation. "Gate" does two jobs. For intoxicating products it is the only non-exclude status, because every state with a framework for these products sets 21 as the age and most of them require an in-person ID check or an adult signature at delivery. For non-intoxicating products it flags a licensing or registration step: Oregon's vendor license, New York's retail license, Iowa's registration, Hawaii's certificate of registration. A "gate" row with confidence "todo" means the research found no verified statute and counsel review is scheduled before go-live.

"Exclude" is never set on a hunch. Every exclude row names a statute, rule, public act or agency advisory, and the confidence field records whether the citation is primary text ("statute"), a law-firm or agency summary ("secondary"), or a placeholder ("todo") that keeps the exclusion in place until counsel confirms it. The one todo exclusion is Mississippi, which the law-firm trackers list but whose 2025 bill died in conference.

What happens federally on November 12 and December 11, 2026?

The mechanism is narrow and worth reading closely. Section 781 of P.L. 119-37, enacted November 12, 2025, rewrote the hemp definition in 7 U.S.C. 1639o with an effective date 365 days out (Cornell LII). Section 2019 of the September 2, 2026 continuing resolution did not move that date. It said the amendments "shall only apply with respect to products described in paragraphs (1)(C)(ii)(I) and (1)(C)(iv)(I)" until December 11, 2026. Those two paragraphs are the clauses about cannabinoids the plant cannot make.

So the November date reaches HHC, THC-O, THC-JD and similar converted molecules. This store applies the same cutoff to delta-8, THCP and every other converted cannabinoid, because the second exclusion clause, for cannabinoids "synthesized or manufactured outside the plant", arrives four weeks later and the risk of guessing wrong is not worth four weeks of sales. Vicente LLP's October 13, 2026 reading describes the same two-stage rollout: synthetic cannabinoid restrictions on November 12, the total THC standard and per-container cap on December 11 (Vicente LLP).

The December date is the one that changes the table. Every A2 row is marked with it, and on that day every A2 row becomes an exclude unless Congress passes a delay or a framework in the lame-duck session. The table does not pre-set those rows to exclude, because the statute has already been delayed once and the status field should describe the law in force on the reviewed date, not a forecast. The companion explainer, the 2026 federal hemp rule, walks through the statute clause by clause.

Why are Washington and California different for CBD?

Washington goes one step further on product form. The LCB's position, reflected in the state's food rules, is that hemp-derived CBD is not allowed as a food ingredient, with cannabis health and beauty aids exempt under RCW 69.50.575 (WSLCB). That is why the Washington A1 row reads "gate" with a formats_excluded field: topicals ship, ingestible CBD does not, and anything with detectable THC belongs to the licensed system. The Washington A2, B and C rows are all excludes.

California permits non-detect ingestibles, so its A1 row ships with a note: ingestible products must be isolate or broad-spectrum with no detectable THC, and no inhalable hemp product of any kind may be sold. The DCC page also previews the end state: "Starting January 1, 2028, intoxicating hemp must be manufactured, tested and sold just like" licensed cannabis (DCC). Full-spectrum, THCa and bulk are excludes in California today.

Why are Idaho and Arkansas listed as zero-THC states?

In both states the practical test is the certificate of analysis. A COA that reports "ND" at a limit of quantitation of 0.05% can still hide 0.5 mg of THC in a 1 g sample, so the store asks suppliers for the LOQ in milligrams per container and ships only lots whose non-detect result holds at that resolution. Non-detect broad-spectrum and isolate products ship to both states; anything with a measurable THC line does not.

Alaska belongs in the same conversation even though it is not a zero-THC statute. The Division of Agriculture's advisory is blunt: "Products containing delta-9-THC may not be sold to a consumer in Alaska" (Alaska Division of Agriculture). Alaska measures delta-9 post-decarboxylation, so THCa counts, and every processed product for human or animal consumption, including topicals and pet products, needs a Division endorsement under 11 AAC 40.400 before sale. The Alaska A1 row is therefore a gate, not a ship.

Which states require a registration or license before a CBD order ships?

Oregon is the clearest case because the OLCC wrote the online rule down. Registry rules took effect January 1, 2026, and the agency's bulletin states that compliance actions begin June 1, 2026, that the requirements apply to products "sold online", and that "This includes online retailers operating in other states selling products to Oregon consumers" (OLCC Bulletin HE2025-01). Topicals are exempt from the registry; everything ingestible, including pet products, is not.

New York requires a Cannabinoid Hemp Retail License for retailers and distributors (NY OCM). West Virginia requires every hemp product distributed in the state to be registered annually at $200 per product, and states that "All retail facilities, including online domains and websites, are required to register" at $100 per establishment (WVDA). Kentucky requires out-of-state processors and manufacturers to file an annual registration, in force since January 1, 2024 (902 KAR 45:190). Hawaii's interim rules, effective January 28, 2026, add a certificate of registration for retailers, distributors and online operators (Hawaii DOH).

Iowa's rule requires a retailer to register at least 30 days before selling to purchasers located in Iowa (641 IAC 156.2). Louisiana requires product approval and permits for every consumable hemp product (La. R.S. 3:1483). Georgia, Texas, Virginia, Minnesota and Michigan carry gate rows for licensing reasons documented in the table.

Why does New Jersey block online CBD sales?

The prohibition is written around "any hemp-derived product", not around intoxicating products, and the FAQ does not carve out non-detect CBD. A literal reading reaches zero-THC isolate. Until counsel clears a narrower reading, the store excludes every lane for New Jersey except bulk, and the bulk row carries a note that the online ban may reach business-to-business sales too.

New Jersey's THC rules also matter for the A2 lane. The FAQ states that hemp products exceeding 0.4 mg of total THC per container fall outside the hemp definition as of April 13, 2026, that products with any detectable THC may not be sold to anyone under 21, and that intoxicating hemp beverages are capped at 5 mg per serving and 10 mg per container through licensed channels until November 13, 2026 (NJ CRC).

What are the rules in Texas?

Three more Texas facts shape the rows. The Texas Supreme Court upheld the ban on manufacturing smokable hemp in Health and Safety Code 443.204(4), while a lower-court injunction still allows retail sale of smokable products made elsewhere (Texas DSHS). Delta-8 THC products become scheduled controlled substances in Texas effective July 31, 2026. And the DSHS FAQ, as summarized in the search record, applies the retail registration to online retailers located outside Texas that sell to Texas consumers.

Put together, the Texas A1 row is a gate with a registration note, the A2 row ships with 21+ verification subject to the same registration question, and the B row is an exclude: smokable hemp manufacturing is banned, delta-8 is scheduled, the rules are in flux and the registration cost is high. Vicente LLP also reports a stricter DSHS testing standard for total THC inclusive of THCa from 2026 (Vicente LLP), which would end THCa flower sales in the state regardless of the injunction.

How do the Virginia and Colorado ratio rules work?

Virginia's change is why its A2 row moved to exclude. A 30 mL full-spectrum tincture at 1,000 mg CBD typically holds 20 to 30 mg of THC, which is 10 to 15 times the 2 mg package cap. Under the old 25:1 rule that tincture qualified because its ratio was 40:1 or better; under the flat cap it does not. Virginia also requires a Hemp Product Retail Facility Registration for anyone offering regulated hemp products, which keeps the A1 row at gate.

Colorado's SB 23-271 takes the other approach. The statute bars selling a hemp product in a container of more than 5 servings when the product exceeds 1.25 mg of THC per serving and its CBD-to-THC ratio is below 20:1, with tinctures and no-THC products carved out (Colorado General Assembly). A CBD-dominant tincture at 0.8 mg THC per 1 mL serving and a 40:1 ratio passes, so Colorado's A2 row ships with a per-SKU ratio check in the note. Intoxicating products that fail the test belong to the licensed marijuana market, which is why Colorado's B row is an exclude.

Which states cap THC per package or per serving?

Hawaii's interim rules set 1 mg per serving and 5 mg per container for gummies, tablets and capsules, 0.5 mg per container for beverages, and 3 mg per serving and 85 mg per 1 oz container for oil-based tinctures sold to adults 21 and older (Hawaii DOH). Rhode Island's pamphlet sets 1 mg per serving and 5 mg per package. New York's Part 114 sets 1 mg per serving and 10 mg per package for orally consumed products. Iowa sets 4 mg per serving and 10 mg per container. Montana's revenue guidance sets 0.5 mg per serving and 2.0 mg per package. Each of those states is an A2 exclude.

Two states cap without excluding. Louisiana allows 5 mg per serving and 40 mg per package for edibles, and for tinctures a 1 mL serving at no more than 1 mg of total THC in a package of no more than 1 oz (La. R.S. 3:1483); a typical full-spectrum tincture fits, so Louisiana is a gate for product approval rather than an exclude. New Mexico's rule, effective January 28, 2026, limits finished products to 2.0 mg of total THC per serving and 20 mg per package, with tinctures allowed up to 100 mg per package (NMED), so New Mexico's A2 row ships with a per-serving check.

Where do THCa flower and hemp THC drinks stand?

The total THC states are the quiet half of the exclusion list. Michigan's Cannabis Regulatory Agency states that THC "is defined to include THCA" under MCL 333.27953 and that cannabis with THC above 0.3% is marijuana sold only by licensees (Michigan CRA). South Dakota computes total delta-9 THC from THC plus THCA (SDCL 38-35-1). Wyoming measures hemp "when using post-decarboxylation" testing and bars any synthetic substance (Wyoming SF0032). Florida applies a total delta-9 formula through its hemp rule. High-THCa flower fails all of them.

The licensing states are the loud half. Arizona's Attorney General told retailers that "Only licensed and regulated dispensaries can sell marijuana products" and set enforcement for April 24, 2025 (Arizona AG). The District's ABCA reports 62 unlicensed businesses padlocked since July 15, 2024 (DC ABCA). Louisiana's health department "shall not approve" floral hemp material for retail sale or any inhalable product (La. R.S. 3:1483). Georgia bans retail hemp flower, Illinois reclassifies intoxicating hemp as cannabis on November 12, 2026, and Missouri's HB 2641 does the same on a date tied to the federal rollout (Vicente LLP).

The 9 gate states are Delaware, Nebraska, North Carolina, Pennsylvania, South Carolina, West Virginia, Wisconsin, Maine and New Hampshire. The first 7 carry "todo" confidence because bills were pending or defeated and no statute was verified. Maine and New Hampshire carry statute confidence: Maine sets 21 as the age for potentially intoxicating hemp products (7 M.R.S. 2231), and New Hampshire's RSA 439-A:4 adds THCA to its prohibition only from January 1, 2027 (NH RSA 439-A:4). All 9 close on December 11, 2026 under federal law.

What about pet products?

That federal position is why pet products on this site are labeled and marketed as non-detect THC products, never as feed, and never with outcome language. At the state level, pet products ride the A1 row of the destination state. Oregon's registry covers "cannabinoid hemp products intended for human or animal use" (OLCC Bulletin HE2025-01), Alaska's advisory says its endorsement rule "also applies to pet products" (Alaska Division of Agriculture), and Hawaii's registration reaches products "for use by humans or animals". Massachusetts bars animal feed containing hemp under its agriculture policy, so the Massachusetts A1 row excludes ingestibles for people and pets alike.

Why does the store verify age and use adult signature?

A checkbox cannot satisfy those rules. Texas requires "a valid proof of government-issued identification prior to purchase", Kentucky requires retailers to verify age for adult-use cannabinoid products (902 KAR 45:190), and Oregon labels any item with about 1 mg of THC in the container "For use only by adults 21 and older" (OLCC). The store runs third-party identity verification at checkout for every order containing detectable THC and sets 21 as the floor for the whole A2, B and C lanes rather than maintaining a 50-state age matrix that no state requires to be lower.

Adult signature at delivery closes the loop. Identity verification proves the buyer's age; the carrier's adult-signature service proves an adult received the parcel. The carrier's hemp policy requires it, and the store applies it to every gate row and every A2 row. Orders that fail verification are cancelled and refunded before anything ships.

How is this table maintained?

The review cycle has three parts. First, a statute pass: each "statute" row is re-read against the cited primary text, and each "secondary" row is upgraded to primary text when the agency or legislature page can be fetched directly. Second, a counsel pass: every "todo" row, every state with a pending bill named in the notes, and the open questions flagged in the research (Arizona's handling of trace-THC CBD, Missouri's November 12 versus December 11 date, the scope of New Jersey's online ban, state feed rules for pet products) go to outside counsel before the row changes status. Third, a federal pass: on November 12 and December 11, 2026 the table is republished with a new reviewed date, and any lane that loses federal status flips to exclude in every state on the same day.

This table encodes one store's risk tolerance, one supplier's COA resolution and one carrier's policy. Use the citations, read the statute, and ask counsel licensed in the destination state. If a row looks wrong, the contact page accepts corrections and every correction is logged with its review date.