Understanding Age-Verification Requirements for Cannabis Sites

What the rules actually require

There is no single federal age-gate statute for cannabis websites. The requirements live in state marketing regulations. Adult-use states set the floor at 21, and regulators such as the Colorado Marijuana Enforcement Division (MED), the Michigan Cannabis Regulatory Agency (CRA), and the California Department of Cannabis Control (DCC) require licensees to take reasonable steps to keep marketing away from minors. An age-affirmation prompt on the website is the standard way operators satisfy that. Medical programs are looser: most register patients at 18, and menus serving cardholders often gate accordingly. Read the marketing chapter of your own state's rules, because the wording differs state to state.

Where age gates quietly kill SEO

The compliance side is easy. The SEO side is where operators get hurt. A gate built as a redirect — every URL bounces to /age-check until a cookie is set — means Googlebot never reaches the real pages, and they drop out of the index. A gate that serves an empty shell and only injects content after the visitor clicks through does the same damage. Serving crawlers one experience and humans another creates cloaking exposure under Google's spam policies. The gate has to treat every visitor the same.

The implementation that survives both

Serve the complete HTML to everyone, then cover it with a CSS/JS modal overlay that asks for the age confirmation. Store the answer in a cookie or localStorage so returning visitors skip the prompt. No separate URL, no redirect, no conditional rendering. Google's interstitial guidance carves out legally required gates like age verification, so an overlay done this way costs you nothing in rankings. Menu platforms like Dutchie and Jane handle this correctly out of the box; custom builds are where it usually goes wrong.

What this looks like in practice

A dispensary site I audited had rebuilt its age gate as a separate page: every URL 302-redirected to /verify until the visitor clicked through. Within weeks, Search Console showed pages falling out of the index one crawl at a time, until only the homepage still ranked. The fix took an afternoon. The gate became an overlay, the redirects were removed, and the pages were resubmitted for crawling. Rankings returned as Google re-fetched the site. Nothing about the compliance posture changed; only the plumbing did.

Verification past the homepage

The website checkbox is a marketing-compliance step, not identity verification. The real check happens at pickup or the delivery door, where an ID gets scanned. Age touches other channels too: SMS loyalty programs need a 21+ confirmation at opt-in on top of TCPA consent, and ecommerce checkouts usually collect a date of birth. Treat the age gate as one layer in a stack rather than the thing that makes you compliant.

Frequently asked questions

Do cannabis websites legally have to age-gate?

In most licensed states, yes in effect. Regulators such as the Colorado MED and California DCC require licensees to keep marketing away from minors, and an age-affirmation prompt is the accepted way to meet that on a website. The exact requirement sits in your state's marketing regulations, so read that chapter rather than copying another site.

Does an age gate hurt SEO?

Only if it is built wrong. A redirect-style gate, or one that hides content until the visitor clicks through, will drop pages from Google's index. An overlay on top of fully served HTML does not, and Google's interstitial guidance explicitly makes room for legally required gates like age verification.

Should medical menus gate at 18 or 21?

Match your license type and state program. Most medical programs register patients at 18, while adult-use sales are 21+ everywhere. Dual-license operators typically gate the whole site at 21 and handle medical-patient age at account signup, which is simpler to maintain than two gates.

General information for cannabis marketers, not legal advice.