Compliant cannabis marketing, channel by channel

Compliant cannabis marketing means clearing three rulebooks at once. Your state or province sets the advertising rules. Federal law sets the consent rules for email and text. The wireless carriers set their own content policy on top. No channel clears all three the same way, so this page takes them one at a time and ends with a setup a dispensary can run.

None of this is legal advice. Your state regulator's published rules and your own attorney decide what you may say.

Why there is no single cannabis marketing rulebook

There is no federal framework for cannabis advertising, so every legal state writes its own. Cannabis is still a Schedule I substance under federal law, according to the US Drug Enforcement Administration. No federal agency writes cannabis ad rules. State cannabis agencies filled the gap instead.

The number of rulebooks is the problem. The National Conference of State Legislatures counts 24 states, two territories and the District of Columbia with legal adult use. It also reports 41 states, three territories and the District of Columbia allowing medical use, as of 26 June 2025. A billboard that is fine in one state is a licence issue next door.

A few rules hold almost everywhere. They are the floor, not the whole job:

• Market only to adults 21 and over, or to qualifying patients
• Nothing that appeals to minors
• No false or misleading statements
• No health claims you cannot back up
• Include the warning language your state requires
• Get clear consent before you email or text

Email rules for dispensaries

Email answers to federal law first and your state's content rules second. The federal rule is CAN-SPAM, and the Federal Trade Commission sets out what it asks of a business.

Five things have to be true of every marketing email you send:

• The from line, the subject and the routing details are accurate
• The message is identified as an ad
• It carries a valid physical postal address
• It offers a clear way to opt out
• Opt-outs are honored within 10 business days

Your state rules then govern what the email may say. That covers the warnings, the claims you may not make, and who it may reach.

The practical snag is the sender. Plenty of email tools will carry cannabis email but will not carry cannabis text. Klaviyo is the common case. Klaviyo does not allow cannabis text messaging, so stores on Klaviyo can keep those flows and add the other channels beside them rather than rebuild.

Text and 10DLC: what a dispensary registers first

Text adds a third rulebook that has nothing to do with your state. It belongs to the carriers.

Two terms make the rest of this readable. A2P, short for application-to-person, means any text sent by software rather than typed on a phone. 10DLC is the system that registers a business and its message programs before carriers will carry texts from an ordinary ten-digit number.

CTIA is the United States wireless industry association. It publishes the Messaging Principles and Best Practices that carriers apply. The May 2023 edition lists the restricted content groups the trade shortens to SHAFT, for sex, hate, alcohol, firearms and tobacco (CTIA, Messaging Principles and Best Practices, May 2023). Cannabis and CBD sit in that group with tobacco. A campaign can clear registration and still be filtered on the day, so registration buys you a lane, not delivery.

Two federal rules then bind every text you send. The Federal Communications Commission changed its consent rules under the Telephone Consumer Protection Act, effective 11 April 2025. The window for honoring an opt-out dropped from 30 business days to 10. A wider rule, which makes one opt-out cover all your message programs, is now set for January 2027. Separately, a marketing call or text may not go out before 8am or after 9pm in the customer's local time (47 CFR 64.1200(c)(1)).

Consent is its own decision. Joining a loyalty program is not consent to get marketing texts. The text opt-in needs its own box and its own disclosures: your brand name, how often you send, that message and data rates apply, and how to use STOP and HELP.

Wallet push, the channel carriers do not filter

Wallet push is the one promotional channel a dispensary runs that the carriers do not sit in front of.

A wallet pass is a real Apple Wallet or Google Wallet card. It is issued through Apple's PassKit and Google's loyalty card APIs, and it installs from a web link with no app store download (Apple Developer, Wallet Passes, Google Wallet, loyalty cards). Wallet push is a notification sent to that card over Apple and Google notification rails. It is not registered under 10DLC and carriers do not filter it.

That is a narrower claim than it often sounds, and the narrowness is the point. Your state's rules on claims, warnings, audience and disclosures cover a push notification the same way they cover a billboard. Consent is still required. A customer can remove the card whenever they like. Wallet push takes one rulebook off the table, the carriers'. It does not touch the other two.

Building the stack

A compliant setup comes down to matching each message to the channel that can carry it, on one customer record.

Three habits make that setup hold. Record every opt-in with its time and its source, per channel, because the record is what you produce when asked. Hold the send window to the customer's local time, not yours. Keep the whole program on one customer record, so an opt-out on one channel is visible to the rest.

Sticky Cards runs all four of those channels itself. It reads order events from the dispensary point of sale and applies rewards inside the register. Carrier registration for your texting number is handled as part of the platform. Opt-ins are recorded with their time and source. Billing is month to month, with no setup fee and credits that do not expire. Meeting your state and provincial rules stays your job.