ID Scanning Laws for Dispensaries

Scanning and PII laws from all US states with medical or recreational cannabis

Last updated August 2023

Since Colorado first legalized recreational marijuana in 2012, regulatory agencies and politicians have made keeping cannabis products out of the hands of minors a top priority through age verification legislation and regulatory frameworks.

We’ve worked with dispensaries since that time to help automate the age verification process using ID scanning, parsing, and authentication. But as more states have brought cannabis programs online, we quickly learned that not all state laws are created equal, and even within individual states, guidance may vary depending on auditor interpretations of murky laws. This is our attempt to distill 10 years of learning into an easy-to-consume guide for MSOs and dispensaries of all sizes.

This guide is not meant to constitute legal advice or take the place as legal counsel. It is simply a round-up of all available (some hard-to-find) compliance guidelines related to ID scanning, identity verification, and PII retention for dispensaries.

Which states require ID scanning for dispensary entrance or cannabis purchase?

ID scanning required for:

• Dispensaries in Illinois, Missouri, New Jersey, Nevada, and Virginia
  • Manual data entry also allowed in Hawaii
• Cultivation center entry in Maryland
• Delivery in Massachusetts
• Medical cards in Mississippi

Jump to:

Alaska | Arizona | California | Colorado | Connecticut | Delaware | Florida | Hawaii | Illinois | Maine | Maryland | Massachusetts | Michigan | Minnesota | Mississippi | Missouri | Montana | Nevada | New Mexico | New Jersey | New York | Oregon | Rhode Island | Virginia | Vermont | Washington | Washington, D.C.

Alaska

Age verification requirements

Alaska requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises. 3 AAC 306.350

Alaska is the only state to have a provision to allow infants on-site at dispensaries for the purpose of breastfeeding. 3 AAC 306.712

Electronic reading of tribal IDs

Alaska, with one of the largest native populations in the US, mentions tribal ID compliance with Title 28. Motor Vehicles § 28.15.111.

“An ID must, to the extent the department is able, be designed to allow the electronic reading and electronic display of the information.”

This language is ambiguous and provides some leeway to allow for tribes that may not have barcode printing capabilities.

Penalties/damages

Sale to a person under 21

• less than 1 oz.: misdemeanor (1 yr. and/or $10,000)
• more than 1 oz.: felony (5 yrs. and/or $50,000)

Sale to a person under 19 who is 3 years younger than the seller: felony (10 yrs. and/or $100,000). Code Section 11.71.060, et seq.

Arizona

Age verification requirements

Arizona requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Arizona has not provided any compliance guidance to dispensaries regarding ID scanning or proper identity verification. A.R.S. § 36-2851

Penalties/damages

Use of a fake ID by a minor under the age of 21 is, for a f irst violation, a petty offense, and for the second or subsequent offense, a class 3 misdemeanor.

California

In a 2019 study, the state control board found that 98% of dispensaries who were secret shopped were performing age verification at the minimum standard.

Age verification requirements

California requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

California has not provided any compliance guidance to dispensaries regarding ID scanning or proper identity verification. The only requirement is that a purchaser of cannabis products “first presents documentation that reasonably appears to be a valid government-issued identification card showing that the person is 21 years of age or older.” CHAPTER 14. Protection of Minors [26140-26140]

Data retention requirements

California has no data retention requirements but does require that dispensaries not sell their customers’ data. However, access to data for third parties (including software providers) is permissible. 26161.5.

Dispensaries are, of course, subject to the broad range of privacy and right-to-be-forgotten regulations in the CCPA.

Penalties/damages

California has a relatively well developed set of penalties for cannabis sales to minors.

Sales to individuals under the age of 14 can be punishable by up to seven years in jail. 11361

Colorado

Some Colorado IDs issued before 2022 have hologram and microprint issues which make them difficult to scan except with forensic document readers.

Age verification requirements

Colorado requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

The Colorado Department of Revenue requires that all dispensaries undergo “MED Training” in order to receive a Responsible Vendor designation, which is focused on preventing sales to minors, as well as acceptable forms of identification. MED Rules M 408 & R 407

Regarding marijuana delivery, manifests for each cannabis delivery must include name, date of birth, and drivers’ license or ID number. The licensee must verify that these items match the recipient upon delivery. Delivery Transport Manifest Requirements [3-615(G)(5)]

Data retention requirements

Colorado allows for budtenders to record information related to daily maximums and looping. Colorado requires that cameras record budtenders verifying the ID of each customer.

Penalties/damages

Colorado dispensaries caught skipping identity checks are eligible for fines ranging from $10,000 to $100,000 as well as loss of license. Colorado dispensaries caught selling cannabis products to persons under the age of 21 can lose their license, and individual budtenders can be charged with felonies.

Connecticut

Age verification requirements

Connecticut does not currently provide any guidance for ID verification in retail environments because brick-andmortar sales are not expected until the end of 2023, though cannabis delivery is currently legal.

Connecticut guidelines require that dispensaries take commercially and technologically reasonable measures to verify the identity and address of each consumer prior to drop-off. The courier must confirm that the recipient is of-age, and if the identity of the purchaser is in question they must return immediately to the dispensary.

Data retention requirements

Data necessary for purpose of identity verification may be retained by an electronic data intermediary but not sold or transferred. Connecticut broadly allows for cannabis sellers to capture photos and/or copies of identity documents for storage.

Penalties/damages

Distribution of marijuana by a person 18 years or older to a person under 18 is punishable by an additional 2 years imprisonment, on top of any other sentence imposed.

There is an exception to this rule if the distributor is less than 2 years older than the minor.

Delaware

Age verification requirements

Prior to initiating a sale to an individual, an employee of the retail marijuana store making the sale shall verify that the purchaser has a valid government-issued photo identification card showing that the individual is 21 years of age or older.

Affirmative defense

If an individual under 21 years of age presents a fraudulent proof of age, any action relying on the fraudulent proof of age is not grounds for the revocation or suspension of any license issued under this section. This means if a minor uses a fake ID with a photo for purchase of cannabis in Delaware, it shall be an affirmative defense and the dispensary is not liable for an illegal sale. § 1313. Verifying the age of marijuana consumers

PII & data privacy

To protect individual privacy, the Commissioner may not require a consumer to provide a retail marijuana store with personal information other than government-issued identification to determine the consumer’s age and a retail marijuana store may not be required to acquire and record personal information about consumers.

Penalties/damages

Penalties range from between 8 and 25 years in prison with fines at the court’s discretion.

Florida

Age verification requirements

Currently, Florida is restricted to medical only cannabis purchases. You must be 18 or older with a valid Florida medical marijuana card. Medical cards from other states will not be accepted. You must be able to prove residency or seasonal residency.

Smart and Safe Florida filed new legislation to vote on recreational cannabis in Florida on the 2024 ballot.

Penalties/damages

Penalties vary depending on the amount of the drug possessed or sold. Fines can range from $1,000 – $50,000 and there are options for jail time involved ranging from 1-50 years depending on the severity of the crime.

Hawaii

Age verification requirements

If you are planning on acquiring medical cannabis from a dispensary, you must have 1) your valid 329 card, and 2) valid state ID, valid state driver’s license, or valid passport on your person to gain entry.

Hawaii requires a photo ID and presentation of a Hawaii MMJ card for medical cannabis purchase.

Data retention

Dispensaries must retain records for a minimum of six years, including compliance with dispensing limitations for each patient, and logs of entry and exit for the facility. ID scanning can remove manual entry of this data.

Illinois

Age verification requirements

Illinois requires digital ID scanning for cannabis purchase. IDs must be scanned to determine purchase limits because limits differ for in-state and out-of-state residents.

A dispensing organization shall use an electronic reader or electronic scanning device to scan a purchaser’s government-issued identification. 410 ILCS 705/10-20

In addition to state issued IDs, drivers’ licenses, and passports, Illinois dispensaries must accept draft cards and military IDs.

Data retention requirements

Dispensaries are not allowed to store any information parsed from the ID. All PII must be flushed immediately after determining eligibility.

Penalties/damages

According to Illinois Law, as long as an ID was scanned and determined to be legitimate, neither the dispensary nor the budtender is legally responsible for underage sales unless either party knew the documentation to be false.

Instead, according to the Liquor Control Act of 1934, the individual who presented the fraudulent ID would be subject to a misdemeanor. LRB101 04919 RLC 61359

Maine

Upon launch, Maine regulations only allowed for sale of cannabis to Maine residents. However, this requirement has since been lifted.

Age verification requirements

Maine requires dispensary customers to show a federal, state, or tribal ID before entry into the dispensary premises.

In Maine, individuals under the age of 21 may enter into controlled lobby areas while their ID is scanned. This lobby area must be physically separated from the rest of the dispensary.

Data retention requirements

It remains unclear exactly what PII retention laws are in place in Maine, but dispensaries statewide are partnered with Metrc. Metrc is a POS and tracking system that touts a seed-to-sale tracking process. The sale tracking includes verifying customers age by using a government issued ID, and verifying a sale will not exceed transaction limits.

Penalties/damages

Engaging in a deliberate pattern of 2 or more instances of marketing or selling marijuana plants, marijuana or marijuana products to individuals who are younger than 21 years old can result in fines of up to $100,000, $50,000 or $10,000 based on the number of offenses.

Penalties can also be imposed for any licensee that allows anyone without a valid individual identification card to engage in any marijuana-related activity.

Maryland

Age verification requirements for cannabis purchase

A person may purchase cannabis or cannabis products from a licensed dispensary if they display a government-issued photo ID at the point-of-sale that demonstrates they are 21 years or older.

Dispensaries must post signage indicating that creation of a customer profile is optional, and may not save any customer data without express consent. COMAR 14.17.12.02C

Age verification requirements for cannabis grow facilities

When a visitor is admitted to a non-public area of the premises of a licensee, a registered grow agent shall:

1. Log the visitor in and out
2. Retain a log with a photocopy of the visitor’s government issued IDs
3. The licensee shall maintain a log of all visitors to non-public areas for 2 years

Additionally, dispensary agents are required under regulations to deny sales to any consumer whose purchase patterns may reasonably be used for resale or product diversion.

While this text does not specifically require ID scanning, ID scanning is the easiest method to capture visitor information for the log, and capture a photocopy of their identification.

Massachusetts

Age verification requirements

Massachusetts requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises and at the time of purchase.

All budtenders and dispensary owners must undergo training in checking identification and spotting fraudulent identification.

For cannabis delivery, Massachusetts requires that age verification occur either in-person at the dispensary, or through a commission-approved electronic means.

Affirmative defense

As long as the dispensary and budtender check the ID and exercise “due care” they will not receive any legal consequences for underage sales.

Data retention requirements

A Marijuana Establishment may not acquire or record personal information about Consumers other than information typically required in a retail transaction. Retention of any additional information requires written consent of the consumer.

Penalties/damages

Sale to persons under 21 can result in immediate arrest & up to 1 year in jail, and/or fine up to $2,000.

Sales to minors under 18 is a felony of up to 5 years in prison. 94C, § 32I

Michigan

Age verification requirements

Michigan requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Marijuana delivery must be to the place of residence listed on the purchaser’s ID card as the time of purchase, or a smoking lounge or consumption facility The manifest must include a confirmation that the purchaser’s ID was checked. R 420.201 to R420.215

Michigan has rather flexible dispensary laws and is the only state which allows for “cannabis food trucks” and the concept of mobile dispensaries.

Data retention requirements

No PII may be collected other than “what is typically required in a retail transaction.” However, there are no limits on data storage or transfer.

Minnesota

We are currently awaiting updated guidelines from the Minnesota.

Mississippi

Age verification requirements

Retailers are required to check the patient’s Registry Identification Card, which is stored digitally on the patient’s phone.

Before a dispensary may sell cannabis products they must verify the validity of the patient card by scanning the card, and then check against the purchase limits. Chapter 22 Dispensing Cannabis Products 100

Data storage and sharing

Licensees must report medical cannabis dispensing information every 24 hours to the state, which includes details on the patient and the amount of product purchased.

Missouri

Age verification requirements

Consumers are required to present a valid government-issued photo ID when purchasing adult-use products at a dispensary.

Starting May 3, 2023, the Missouri Division of Cannabis Regulation requires dispensaries to scan patient and caregiver medical marijuana ID cards at the time of purchase.

For a dispensary licensee to be in compliance with this rule, a licensee must use a barcode scanner to record the department-issued identification card information into the statewide track and trace system at the time of the sales transaction. 19 CSR 100-1.180(2)(D)2

Penalties/damages

A person commits the offense of delivery of a controlled substance if he or she knowingly permits a minor to purchase or transport illegally obtained controlled substances. The delivery or sale of 35 grams of less of marijuana or synthetic cannabinoid is a class E felony.

Montana

Age verification requirements

Montana requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Data retention requirments

Per House Bill 701, the state’s legalization framework bill, a dispensary can only keep PII from a scanned ID for 180 days. Furthermore, dispensaries are not permitted to share that information with the state, or transfer/sell it to a third party.

Penalties/damages

Distribution of any amount, with or without compensation, from an adult to a minor is punishable by a mandatory minimum 2 years imprisonment and/or a f ine up to $50,000. Penalties increase with each offense.

Nevada

Age verification requirements

Nevada has the most stringent requirements of any state for ID validation. Nevada requires digital ID scanning for cannabis purchase. Nevada requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Nevada ID scanning must be performed by a device that, at minimum:

• can read 2D barcodes
• can perform hologram checks
• can perform 2-light checks
• has MRZ reading capabilities

These additional requirements were put in place due to Nevada’s high volume of sales to out-of-state visitors, as well as the state’s desire to set the standard for dispensary age restriction.

These scanning requirements apply to in-dispensary purchases as well as purchases made via delivery.

Penalties/damages

Currently, for the first offense of selling cannabis to a minor, the penalties are a $25,000 fine and/or a 20 day revocation of the selling license.

New Mexico

Age verification requirements

New Mexico requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary Premises.

New Mexico has not provided any compliance guidance to dispensaries regarding ID scanning or proper identity verification.

New Jersey

Age verification requirements

New Jersey requires digital ID scanning for cannabis purchase. New Jersey requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Data retention requirements

Cannabis retailer personnel shall log that the examination of photographic identification and confirmation of legal age pursuant to (a) above occurred in a record, and the cannabis retailer shall maintain such record and it shall be available for inspection by the Commission.

Audit logs of scans must be retained with no PII except for date of birth (other non-identifiable PII may be deemed acceptable to retain). These audit logs will be delivered to the New Jersey Cannabis Control Board at regular intervals to be determined.

No other information from an ID may be saved. Dispensaries may not save a copy of the ID.

Penalties/damages

Sales or attempted sales to a minor under 21 are listed as a Category II violation. The penalties for a Category II violation are:

• First offense: $500,000 fine
• Second offense: Suspension of license
• Third offense: Revocation of license

New York

Age verification requirements

New York will require dispensary customers to show a federal, state, or tribal ID before entry to the dispensary Premises. City of New York IDs (IDNYC) must be accepted.

Cannabis can be sold to an individual who has a minor present with them.

New York has a currently proposed bill that would allow for biometric scanning in lieu of showing an ID for the purchase of alcohol and tobacco. It is unclear if this resolution would be extended to include cannabis products.

Data retention requirements

A licensee cannot retain a customer’s personal information for marketing and advertising purposes unless a customer consents to the information being retained for this reason.

Penalties/damages

Sales to individuals under 21 are considered Class A misdemeanor, while sales to individuals under 18 are considered Class E felonies.

Oregon

Age verification requirements

Oregon requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises.

Notably, Oregon specifically disallows the use of digital IDs and mobile drivers’ licenses for the purchase of cannabis products.

The Oregon Liquor and Cannabis Commission may adopt rules establishing the circumstances under which the commission may require a marijuana retailer that holds a license issued under to use an age verification scanner or any other equipment used to verify a person’s age for the purpose of ensuring that the marijuana retailer does not sell marijuana items to a person under 21 years of age. 475C.109 [Formerly 475B.119]

Data retention requirements

Information obtained from the scan of an ID may not be retained after verifying a person’s age and may not be used for any purpose other than verifying a person’s age.

Penalties/damages

Sale, delivery, possession with intent to sell or deliver to a person under age 21 is subject to a civil penalty of up to $1,000.

Rhode Island

Age verification requirements

Rhode Island has recently legalized recreational cannabis.

Adults 21 and up are allowed to possess recreational cannabis both in public and at home, within limitations.

Rhode Island has not provided any compliance guidance to dispensaries regarding ID scanning or proper identity verification.

Virginia

Age verification requirements

Virginia has yet to open recreational sales, but the language in the bill that passed states that prior to the sale of the product, the dispensary must verify that the purchaser is at least 21 years of age through a commercially available database that is regularly used by businesses or governmental entities for the purpose of age and identity verification.

Vermont

Age verification requirements

Vermont requires dispensary customers to show a federal, state, or tribal ID before entry to the dispensary premises and at the time of purchase.

The only reference they make to age verification workflow is that “The Cannabis Establishment is responsible for ensuring compliance with age limitations.” 2.2.13

Data retention requirements

The cannabis retailer may now acquire or record any information other than information typically required by a retail transaction.

Penalties/damages

The first violation in the immediately preceding 3 years, a corrective action plan, an administrative penalty of not more than $15,000, and/or a suspension for not more than 20 days of a license or Cannabis Establishment identification card. Penalties escalate to $20,000 and license suspension for a second and third violation.

Washington

Age verification requirements

Washington does not have any state law requiring that an ID is shown before cannabis purchase. The only laws are that cannabis cannot be sold to anyone under 21 (other than medical patients).

Cannabis vending at medical marijuana facilities is legal, but the machines can only be held inside approved dispensaries and a store employee must check the user’s medical marijuana license before purchase.

At recreational marijuana shops, Washington state law dictates that the machine can also only be operated by an employee and must be installed behind the counter.

Penalties/damages

Businesses cited for Sale to a Minor face a 10-day suspension or $2,500 fine.

A second violation within three years requires a 30-day suspension with no monetary option. Businesses who receive three public safety violations within three years face license cancellation.

The state reserves the right to classify sales to a minor as a Class-C Felony, and the budtender is not immune from individual prosecution.

Washington, D.C.

Age verification requirements

Washington D.C. currently does not have retail cannabis sales, though recreational marijuana is legal.

The Washington D.C. Cannabis Control board recommends a blended approach that combines ID scanning technology with physical examination of the ID.

About us

IDScan.net is an AI-powered identity verification platform. We power ID scanning, age verification, and fake detection for more than 1,000 dispensaries in the US and Canada.

Not only do we offer the only solution approved by the Nevada Department of Taxation’s Cannabis Regulatory Control Board, but we have purpose-built our system to meet the unique needs of dispensaries across the country.

Whether you’re a high traffic MSO, a small dispensary looking to stay compliant, or a cannabis delivery service, we have cannabis dispensary ID scanning experts on the team who can discuss your use case, state-level compliance guidelines, and find a solution to fit your needs.