Cannabis Advertising Compliance: What You Can and Cannot Do

Every other retailer in your city can buy its way to the top of a search result. You cannot. That single fact reshapes everything about how a dispensary has to market itself, and most of the frustration in this industry comes from teams who understand the restriction but have not accepted what follows from it.

The restriction is also badly understood. People talk about cannabis advertising as though it were one rule, enforced by one body, that will loosen when the law does. It is not one rule.

It is two separate rulebooks with different authors, different penalties and different timelines, and one of them has nothing to do with the law at all.

This module is the map: what is actually closed and why, what is open and under what conditions, which sentences create risk, where your own website quietly becomes advertising, and what to do with the channel that nobody can take away from you.

It is the fourth of six modules, and it is the one that decides whether the rest of your cannabis dispensary SEO work is an asset or a liability.

One thing before any of it: this is a practitioner’s guide, not legal advice. I am an SEO consultant, not a lawyer. Every state rule referenced here is a category of rule rather than a citation, because the specifics change and vary.

Verify against your own state regulator and your own counsel before you publish anything on the strength of it.

Why every paid channel is closed, and what that actually means

The chain is short and it is worth having straight, because almost every bad decision in this space comes from getting one link of it wrong.

Cannabis remains federally scheduled. Every major advertising platform operates nationally, writes policy to the strictest jurisdiction it works in, and bans the category in its own terms of service. That ban is a contract you agreed to when you opened the account, not a statute anybody is enforcing against you.

Three consequences follow, and each one surprises somebody every year.

• Your state legalising changes nothing about the platform. The contract is not indexed to your local law. Teams in newly legal markets routinely assume otherwise and lose an account finding out.
• Enforcement is at account level, not advert level. The rejection is not the punishment. The punishment is the account, the payment method, the domain and often every other account connected to the same people.
• There is rarely a human at the end of it. Appeals are largely automated. Compare that to a state regulator, who sends a notice, names the problem and gives you a process.

So the honest planning assumption is that paid search and paid social are permanently unavailable, and that any plan whose first line is “when the rules change” has no date on it. That sounds bleak for one paragraph and then stops being bleak, for reasons the eleventh section gets to.

Channel by channel: what is actually possible

“Cannabis cannot advertise” is too blunt to plan with. Some channels are shut by contract, some are open but governed by state law, and a few are open with no meaningful restriction at all. Those three states behave completely differently and need separating.

Working down it: the big paid platforms are closed, and no amount of account structure changes that.

Programmatic display is technically available through cannabis-specific networks, which exist, work, and are the one genuinely paid option, but they carry a fraction of the inventory and none of the intent that search does, so treat them as awareness rather than acquisition.

Organic search and the Business Profile are the only row open on both sides, which is the entire strategic argument compressed into one line, and it is the reason what growth looks like when paid search is closed to you is worth understanding as a discipline rather than as a consolation.

One distinction is worth making before you read the table, because it changes which row you are on.

Hemp-derived CBD that meets the federal definition is not treated the same way as a plant-touching cannabis licence, and some channels closed to the second are conditionally open to the first.

If your business does both, they are two marketing problems and they should not share a domain, an ad account or a payment method.

Organic social sits in an awkward middle. You can post, and accounts still get removed, sometimes for a post and sometimes for nothing anybody can identify. Build there if you like, but never build only there, because it is a rented audience that can be repossessed without notice and without an export.

Email, SMS and traditional media are open and governed by state rules rather than platform contracts, which makes them a different kind of problem: not “am I allowed” but “under what conditions, in which state, and with what wording”.

The workarounds, and where each one lands

Every dispensary marketer eventually hears one of these suggested in a meeting, usually by somebody confident, usually with a friend who is doing it and getting away with it. They are worth going through individually, because the reason each one fails is the same reason, and once you see it the whole category becomes uninteresting.

• The CBD-only account is the most common, because it feels legitimate: you genuinely do sell hemp-derived products, so you advertise those. It falls over when the landing page sits on the dispensary domain, which it always does, because nobody wants to build a second site for it. Domain and business are matched, and both accounts go.
• The separate wellness brand is the same idea with more effort. It survives longer and it fails the same way, because the payment method, the billing address, the phone number, the device and the people are shared. Platforms match on all of those. What you have built is a delayed ban with extra setup.
• Serving a compliant page to the ad reviewer and the real page to everybody else is the one that costs most, because it is cloaking. You now have a platform ban and a search problem, and the search problem is a manual action against the site itself, which is module two’s subject and takes months. One tactic, two channels lost.
• Buying an aged account adds policy circumvention on top of the original violation, which is treated more seriously than the violation itself.
• Running it through an agency’s account does not move the risk. It just means somebody else’s business dies with yours, and they will not work with you again.

The pattern underneath all five: enforcement is on the entity. Domain, payment instrument, device fingerprint, business name, the humans. Bans are effectively permanent and they follow you into whatever you open next, which is why the cheapest-looking of these options is the most expensive one on the list.

Two rulebooks, not one

This is the distinction that organises everything else in the module, and teams that know one rulebook thoroughly are usually the ones who get caught by the other.

Platform policy is fast, opaque and final. You find out because something has already gone, there is usually no warning and rarely a person to talk to, and what it costs you is the channel, permanently, along with anything attached to the same identity.

State law is slow, specific and procedural. It arrives as a notice, a complaint or an inspection. There is a named regulator, a defined process and usually an opportunity to correct. What it costs escalates from a fine through a corrective order to, at the far end, the licence the whole business runs on.

The practical consequence is that copy has to pass both, and the tests are different in kind. A sentence can be perfectly lawful in your state and still cost you a Business Profile.

A sentence can pass every platform filter and still breach a state rule about price promotion. Reviewing against one rulebook and calling it compliance review is the commonest process failure I see.

The six claim categories that create the risk

Six families of claim cause almost all the trouble: health and medical, potency as a selling point, price and inducement, appeal to minors, unsubstantiated superlatives, and testimonials used as proof.

Almost every problem sentence falls into one of those six. Learning the families is more useful than memorising rules, because the families are stable across states and platforms while the specific rules are not.

The diagram’s structure is the point. Nobody publishes “cures anxiety”. What they publish is a strain page that lists effects as though they were properties of the product, which is the same claim wearing a product-description costume.

Nobody writes “our strongest flower yet” in a headline any more; they put the THC percentage in the title tag as the reason to click, which is potency used as a selling point.

Price and inducement is the family that catches otherwise careful teams, because a first-time discount is such a normal retail thing to promote. In several states it is restricted or prohibited outright, and it is exactly the kind of copy that ends up in a title tag or a Business Profile post where it is most visible.

Appeal to minors is judged on effect rather than intention. Nobody in this industry sets out to market to under-21s, and plenty of sites carry playful product names, bright cartoon-ish illustration or candy framing that reads that way to a regulator who does not know your intentions and is not obliged to guess them.

Superlatives and testimonials round it out. “Best dispensary in the state” is unsubstantiated unless something substantiates it. And quoting a customer’s review that mentions a health benefit does not launder the claim. Republishing it on your own page makes it yours.

Where the states actually differ

Anybody operating in more than one state is operating under more than one rulebook on this side too, and the differences are not cosmetic. Six areas account for most of the variation.

Placement rules generally govern where an advert may appear, and are commonly expressed as a threshold on the proportion of the audience reasonably expected to be twenty-one or over.

The threshold itself, and how you are expected to evidence it, differ by state. It applies to media buying more than to your own website, but it also reaches things like sponsorships and event presence.

Age gating is the one with the largest gap between what regulation requires and what teams build. States differ on whether a gate is required, what it must cover and what it has to do.

What none of them require is a gate that hides your content from a crawler, which is how a compliance measure becomes a search problem, covered properly in module two.

The remaining four are shorter to state and just as variable:

• Warning statements, whose exact wording and prominence are usually prescribed.
• Licence number display, which is often mandatory and often missing.
• Discount and promotion rules, which range from unrestricted to effectively banned.
• Cross-border targeting, where marketing into a state you are not licensed in is its own category of problem.

A state-by-state breakdown of where the rules diverge is the right starting point, and the right way to use it is as a list of questions to verify with your regulator rather than as an answer.

Write down what you find, per state, with the date you found it. Rules in this industry move. An undated compliance note is a liability pretending to be a control.

Where advertising rules touch your SEO work

Here is the part that connects this module to every other one. Compliance is usually treated as a marketing-department concern about campaigns. In practice the highest-risk copy on a dispensary’s estate is written by whoever is doing SEO, at speed, in fields nobody reviews.

Title tags sit at the top of that list for a reason. They are written under time pressure, often fifty at once, rarely reviewed by anyone but their author, and they are read by more people than any other copy you produce.

A title tag is an advertisement in every sense a regulator cares about, and the fifty-five characters that make a good one are exactly the characters where a potency number or a discount is most tempting.

The Business Profile description and posts are the other end of the same problem, with an additional platform layer on top: promotional language there is one of the recognised triggers for a cannabis listing being pulled, which module one covers.

So that copy has to pass state law, platform policy, and a suspension risk assessment, and it is usually written by whoever had five minutes.

The two surfaces nobody reviews

Two more get missed entirely. Image alt text is copy, it is indexed, and I have never once seen it included in a compliance review.

And structured data is a claim in machine-readable form, which is worth knowing before you mark up your menu, because Product markup on cannabis items is ineligible by policy and adds risk while returning no rich result at all.

Email and SMS: regulated three times over

These get grouped together in most marketing plans and they should not be, because one of them has a gatekeeper and the other does not.

Consent law comes first and applies regardless of industry: express written consent, records that prove it, a working opt-out on every send. Cannabis rules layer on top, typically requiring that the list is age-verified and adding constraints on what may be promoted and what warning text must accompany it.

The layer that only applies to SMS

The third layer is the one that catches people, and it applies to SMS only. Carriers sit between you and the handset, they require campaign registration, and cannabis is a prohibited category for most of them.

So a dispensary can have flawless consent records, full state compliance, and still find that messages simply stop arriving, with no notification, because the campaign was filtered.

Which makes email quietly the strongest owned channel available here. Nobody sits between you and the inbox.

It is the one audience that cannot be repossessed by a platform, taken by an algorithm change, or filtered by a carrier, and the only one you actually own.

Building it should not be a phase four activity, which is where it usually ends up.

Reviews, creators and the testimonial problem

Third-party voices feel like a way around the restriction on your own voice. They are not, and the rules governing them are less intuitive than the ones governing your own copy.

The rule for creators is simpler than people expect and applied more loosely than it should be.

If anything of value passed from you to them, whether product, payment, a discount or a repost that grows their following, the relationship has to be disclosed clearly, in the post, where the audience will see it. Not in a bio.

Not below a fold. And what the creator claims about effects is not insulated from you by the fact that they said it.

Reviews split three ways. Asking every customer, consistently, on a schedule, is fine and is a genuine ranking input. Incentivising reviews is a platform violation, it is detectable, and the penalty lands on the profile that carries your map pack visibility.

And selecting a review that mentions a health benefit and republishing it on your own site converts somebody else’s sentence into your claim.

The fix here is a one-page brief every creator signs before anything is posted: the disclosure wording, the claims that may not be made, the requirement that their audience is age-appropriate, and who approves the post before it goes live. Two hours to write, reusable indefinitely, and it moves the conversation from trust to process.

Review sentences, not pages

Compliance review as most teams run it is a page-by-page exercise done under deadline, and it scales exactly as badly as templated content does. There is a better unit, and it comes straight out of module three.

Any phrase that appears on more than one page is a reusable sentence, and it is the correct unit of compliance risk, because it multiplies.

Collect them all in one place: the boilerplate intro, the compliance block, the promotional line in the footer, the description that goes in every Business Profile, the standard FAQ answers. Then check each one against each state you trade in, once, and record the date.

What that buys you works in both directions. Reviewing fifty pages finds the same sentence fifty times and fixes it fifty times. Reviewing the library finds it once and fixes it everywhere.

And when a state changes a rule, the job is to edit one row and republish rather than to search a site for a phrase you half remember writing three years ago.

Store-specific copy is different: it only ever publishes in one state, so it only needs checking against the state it will publish in, at draft, before it goes anywhere near the publishing gate. A minute per page, and it catches the categories people forget rather than the ones they remember.

What organic gives you that paid never did

Everything so far has been constraint. This is the section where the constraint turns into the argument, and it is worth making properly to an owner rather than as a slogan, because it is genuinely true and it is genuinely counter-intuitive.

In ordinary retail, paid and organic compete for the same budget, and paid usually wins the argument because it starts producing immediately. Organic looks like the worse decision for the first quarter, which is exactly as long as most patience lasts.

The thing paid never does is accumulate: the day the budget stops, the traffic stops, and nothing was built.

In cannabis that comparison does not exist, because nobody has the option. Your competitor down the road cannot outbid you into the map pack. A better-funded chain opening in your metro cannot buy the top of “dispensary near me”.

The ceiling on this channel is effort, not budget, which is a description of a competitive position almost no other retail category gets to work in.

Say that plainly to an owner and it lands, because it reframes the restriction as a moat.

The catch, and it is worth being honest about it in the same breath, is that the early months genuinely do look like nothing is happening, which is why the case studies state the measurement window on every figure, and why setting that expectation in the first conversation is not optional.

Answer engines, and an accident in your favour

One more surface, and it is the one changing fastest. Increasingly a search does not return ten links but a synthesised answer with a handful of citations, and what gets cited is not what has the best marketing copy.

Compare the two panels honestly. “The best selection in the city at unbeatable prices, with the strongest products to help you unwind” breaks three rules at once. It is also completely unusable to a machine assembling an answer, because there is not one checkable fact in it.

“Open until 11pm seven days, free parking behind the store, licensed retailer, licence number on the door” makes no claim at all, which is why it is compliant. And it answers four questions somebody actually asked, which is why it gets quoted.

That is a real and slightly funny accident. The restriction that takes away your best persuasive language pushes you towards specific, factual, verifiable sentences, and that is precisely the writing that surfaces in an answer. Cannabis sites that take compliance seriously end up better prepared for this surface than most retail sites, without having planned for it.

Two things follow practically. Structure matters: a question as a heading with the answer directly beneath it is liftable in a way a flowing paragraph is not.

And density of fact matters more than length, which is why whether an answer engine can actually lift your page is a different question from whether the page reads well, and worth checking separately.

The first ninety days

None of this is useful as a set of principles. Here is the order I would put it in for a dispensary that has never done any of it, and the order matters more than the effort at every stage.

1. Weeks one and two, read what is live. Every title tag and meta description. The Business Profile description and every post on it. The copy the menu platform supplies, which you did not write and are still responsible for. Anything an influencer has ever posted about the store. This fortnight is the part that gets skipped, and it is the only part that tells you what problem you actually have.
2. Weeks three and four, fix and write it down. Rewrite what fails. Build the sentence library. One approved wording per state, with a date on every entry. The writing-down is the deliverable, not the rewriting. The rewriting is a one-off, the library is what stops it recurring.
3. Weeks five to eight, build the channel. Location pages on the system from module three. The questions customers actually ask at the counter, answered on pages of their own. Reviews requested on a schedule you can keep. An email list you own, started now rather than later.
4. Weeks nine to twelve, make it repeat. The compliance check moves into the publishing gate so it happens automatically rather than when somebody remembers. The rules get re-read quarterly. Measurement moves from rank positions to organic sessions and profile actions. And one named person owns it, because a process owned by everybody is owned by nobody.

The summary is short. You cannot buy attention in this industry, which is a restriction for one quarter and an advantage for every quarter after it, because it applies to everyone you compete with.

What you can do is be the most accurate, most specific, most findable answer to the searches happening within a few miles of your door, and do it without writing a sentence that costs you a channel or a licence.

If putting that programme in place is more than the team can absorb, that is what the organic programme we run for dispensaries covers, and the free audit will tell you which of the four phases above you are actually starting from.

The next module deals with using AI to produce this volume of work without producing the template problem all over again.