The 2018 Farm Bill made hemp federally legal. It did not make every state agree.
This piece is a working reference for any CBD or hemp-derived-cannabinoid brand that ships to US customers. It’s organised by tier — strictest to most permissive — and cites state regulator sources where available so it’s defensible when a customer or compliance counsel asks where the line is.
We update this quarterly. The May 2026 version reflects the most recent state legislative cycle and the FDA’s late-2025 enforcement letters.
Tier 1: Strictest — broad bans on THC-adjacent hemp products
Idaho. Hemp-derived products must contain 0.0% THC (no detectable amount, not the federal 0.3% threshold). Most hemp-derived CBD products that pass federal compliance fail Idaho. Effective ban on isolate-only.
South Dakota. State has aggressive enforcement on hemp-derived products. Recreational and medical cannabis legal but tightly regulated; hemp-derived delta-8 and delta-9 face the same restrictions as recreational cannabis.
Hawaii. Hemp-derived ingestible products tightly regulated under state DOH. CBD topical generally allowed; ingestibles face additional registration burden.
Alaska. Banned delta-8 effective 2024. Hemp-derived delta-9 also restricted.
Tier 2: Banned delta-8 specifically (broader CBD allowed)
The following states have explicit delta-8 bans as of mid-2026: Arkansas, Colorado, Connecticut, Delaware, Idaho, Iowa, Kentucky, Mississippi, Montana, New York, North Dakota, Oregon, Rhode Island, Utah, Vermont. Several more states have delta-8 in legal gray zones (administrative restrictions short of full ban): Maryland, Washington, West Virginia, Michigan, Tennessee.
In each of these states, broad-spectrum and isolate CBD remain legal. Hemp-derived delta-9 (≤0.3% by weight) is permitted in some, restricted in others — research per-state before shipping.
Tier 3: Restricted hemp-derived delta-9
Hemp-derived delta-9 THC is the newer regulatory target. As of May 2026, the following states have either banned it outright or imposed restrictions that effectively block sale: California, Colorado, Hawaii, Idaho, Iowa, Massachusetts (effective dose limits), Minnesota (effective dose limits), Montana, Nevada, Oregon, Rhode Island, South Dakota, Utah, Vermont, Washington (effective dose limits).
Massachusetts and Minnesota have novel approaches: hemp-derived THC is legal but capped at low per-serving milligram limits (5mg in MA, varies in MN), which lets compliant gummies stay on the market while heavier “intoxicating hemp” products are filtered out.
Tier 4: Permissive — major CBD-friendly markets
Texas. Hemp-derived CBD broadly permitted. Some restrictions on smokable hemp products. Sales to minors restricted by retailer policy in many counties.
Florida. Hemp-derived CBD permitted. State Department of Agriculture (FDACS) registration required for processors. 21+ age restriction on certain products.
Colorado. Permissive on CBD; restrictive on hemp-derived delta-8 (banned 2022) and hemp-derived delta-9 (regulatory restrictions make it effectively unavailable in retail). Permissive on CBD-only.
California. Permissive on CBD. AB 45 (2021) cleared hemp-derived CBD ingestibles. AB 2223 (2024) tightened hemp-derived THC rules, effectively restricting it.
New York. Permissive on CBD. Cannabis Conservation Act restricts delta-8. Hemp-derived delta-9 in legal gray zone.
Age restrictions
Federal floor: no age restriction on pure CBD; 21+ for any THC-containing product (including hemp-derived delta-9 above trace levels).
State variations:
- Texas: 21+ on smokable hemp.
- Florida: 21+ on certain THC-containing hemp products.
- New York: 21+ on Adult-Use cannabis dispensary products and most hemp-derived THC.
- Most other CBD-permissive states: retailer discretion, with 21+ becoming industry default.
Shipping carriers
USPS, UPS and FedEx ship hemp-derived CBD federally. Some carriers refuse delta-8 or hemp-derived delta-9 at the carrier level. Spec-out per product before launch.
PACT Act registration is required for sellers of vape products (CBD vape included). The PACT Act does not apply to non-vape CBD ingestibles.
What this means for SEO
Three implications for CBD-brand site architecture:
1. State-restriction copy on product pages. Every product page should display a state-availability indicator pulled from a structured data store, not a generic disclaimer. AI engines extract structured availability into recommendation answers; static disclaimers don’t get extracted.
2. State-by-state landing pages. Per-state SEO is high-intent — “is CBD legal in Texas” type queries fire AI Overviews and convert. We typically deploy 50 state-restriction pages for clients with national reach.
3. Quarterly content refresh. State law moves. The page that ranks today loses authority if it cites 2024 rules in 2026. We update quarterly; clients with internal teams should match.
How we use this map
Every GreenRank Pro client gets a per-state shipping/legality matrix at engagement start. The matrix drives the structured-data store, the state-by-state landing pages, and the compliance copy on product pages. It also drives the do-not-target list for paid acquisition (where applicable).
If you need this as a reference table for your own brand, email Marcus. We send the spreadsheet. It’s the same one we use internally.