Cannabis Marketing Compliance: SEO, Ads and Platform Rules

Who sets the rules for cannabis marketing

Cannabis marketing rules come from three layers, and a single web page can answer to all of them at once. The first layer is the state. Cannabis is licensed state by state, so advertising standards live in each regulator's rules: who your ads may reach, what they may show, what text they must carry. The second layer is federal law that applies to every business: the FDA on drug claims, the FTC on substantiation and endorsements, CAN-SPAM for email and the TCPA for texting. Being state-legal earns no exemption from any of them.

The third layer is private: Google, Meta, Apple, the carriers and your email platform each write their own terms, and they enforce them with suspensions instead of fines. Those rules often run stricter than the law. A post can be legal in Colorado and still get an Instagram account deleted.

The useful habit is to ask, for every asset, which of the three layers it touches. A product page touches the state (license number, warnings), the FDA and FTC (claims) and Google (search quality). A loyalty text touches the TCPA, the carriers and the state's rules on promotions. That stops the most common failure: clearing one rulebook and assuming the rest follow.

State laws on cannabis advertising

State laws on cannabis advertising are the rules most likely to reach a licensee directly, because the regulator that grants your license also enforces your marketing. There is no federal cannabis advertising standard. Each market names its own referee: the Marijuana Enforcement Division in Colorado, the Department of Cannabis Control in California, the Office of Cannabis Management in New York, the Cannabis Regulatory Agency in Michigan and the Cannabis Regulatory Commission in New Jersey.

The details differ, but the same handful of rule types repeat across markets:

• Audience composition. Several states let you advertise only where most of the audience is of age. California requires that at least 71.6 percent of the audience be reasonably expected to be 21 or older. Colorado's rules set the same 71.6 percent bar. In practice that means pulling the platform's or publisher's demographic report before a buy and saving it.
• Appeal to minors. Cartoons, mascots, toys, candy lookalikes and youth slang are banned almost everywhere. New York's rules are explicit about it, and the test is how the imagery reads, whatever the brand intended.
• License numbers. California requires the license number in advertising, and other states run versions of the same rule.
• Promotions. Limits on giveaways, discounts and promotional pricing vary widely and catch multi-state teams by surprise.
• Medical programs. Medical-only markets run tighter. Florida's Office of Medical Marijuana Use requires treatment-center advertising to be approved by the state before it runs, and content built around treatment outcomes gets the closest look.

Here's how one asset changes across three states. Take a homepage banner that reads "The sweetest gummies in town, flavors you loved as a kid." In Colorado the copy might pass, but any paid placement needs audience data behind it. In New York the childhood-candy framing has to go entirely. In California the banner needs the license number. The version that clears all three reads "Lab-tested solventless gummies for adults 21+," carries the license number in the corner and runs only in placements with documented adult audiences.

Keep one page per state: regulator, link to the current advertising rules, audience threshold, banned imagery, required text, any pre-approval step and the date someone last checked it. Work from the rule text itself, because the enforcement letter cites the regulation and never the blog post that summarized it. Our guide on handling state-by-state cannabis marketing rules walks through building that sheet. Multi-state operators should also give medical and adult-use content separate pages per state, since a sentence that is fine on a medical program page can break promotion rules on the adult-use side.

Meta cannabis ads and Instagram compliance

Meta cannabis ads compliance starts with a short answer: ads promoting THC products fail review on Facebook and Instagram, and ad accounts that keep trying get disabled. Meta's ad standards put cannabis under drugs, and its community standards on restricted goods prohibit content that attempts to buy, sell or trade it. Meta has offered a narrow certification-based path for some hemp and CBD products, but its terms change often, so a hemp brand should read the current Drugs and Pharmaceuticals ad standard in Meta's Transparency Center before planning a campaign.

The bigger risk for most dispensaries is the organic account. Meta reads "sale" broadly. Posting a menu, listing prices, writing "DM us to order" or linking a bio to an online cart can all trigger enforcement. Classifiers scan captions, images and bios, and old posts count, so an account can run clean for two years and then disappear over one story with a price in it. Appeals exist and sometimes work, slowly.

Posting habits that tend to survive:

• No prices, no cart links, no "DM to order," no product-in-hand consumption shots.
• A bio free of purchase language, and no link-in-bio tool that resolves to a menu.
• Content built from education, cultivation, staff and store culture, community work and events.
• A warm backup account with the same branding, ready to go live the day the main one is removed.

None of that makes an account safe. The real protection is moving followers somewhere you own: every post and the bio should offer a path to the email list on your website. Followers belong to Meta, and contacts belong to you. Our guide to Facebook and Instagram cannabis restrictions covers the posting rules and the backup-account routine in more detail.

Google's two policies: Ads and Search

Google runs two separate cannabis policies, and confusing them is the most expensive mistake in the category. Google Ads prohibits promoting recreational drugs under its Dangerous products or services policy, and that covers cannabis and THC products on Search, Shopping, YouTube and Display. Merchant Center Shopping listings hit the same wall.

The one paid opening is narrow. Google allows ads for topical, hemp-derived CBD products with 0.3 percent THC or less, from LegitScript-certified advertisers, only in the places its policy permits, and FDA-approved CBD drugs may only target California, Colorado and Puerto Rico. Ingestibles stay out. Topical sellers should read the live policy first, since the state list has changed before.

Every operator eventually hears the workaround pitch: run ads to a wellness page that redirects to the menu. Google calls that circumventing its systems, and it ends in account suspensions that are often permanent and tied to your domain and payment details.

Google Search is a different document enforced by a different team, and it has no cannabis prohibition. Dispensary menus, strain guides and CBD stores rank under the same Search Essentials and spam policies that govern recipe blogs and law firms. Licensed dispensaries can also hold a Google Business Profile under the Cannabis store category, provided the listing follows Google's guidelines for representing your business. Our guide to Google's policies on cannabis content lays the two rulebooks side by side.

The ad ban changes the budget math too. Under IRC Section 280E, plant-touching businesses can't deduct ordinary expenses like marketing while cannabis sits in Schedule I or II, so every ad dollar is spent after tax. A ranking page keeps producing after the invoice is paid. And because the bans bind every competitor equally, nobody in your market can outbid you for the top of the page. Visibility goes to whoever does the slower work on content, links and local signals.

Health claims, the FDA and the FTC

Health claims are the compliance risk that shows up most often in cannabis content, and three authorities police them. The FDA treats a product marketed to treat, cure or prevent disease as an unapproved drug, and its public warning letters to CBD sellers quote product pages, blog posts and social captions back at them, sentence by sentence. The FTC requires competent and reliable scientific evidence for any health claim and has co-signed many of those letters. State regulators bar therapeutic claims in licensee advertising on top of both.

CBD carries an extra wrinkle. The FDA's stated position on cannabis and CBD products is that CBD cannot be sold as a dietary supplement or added to conventional food, partly because it is the active ingredient in an approved drug. Soft structure-function wording like "supports a sense of calm" lowers risk but offers no formal safe harbor for CBD, since that framework belongs to supplements.

The vocabulary that draws letters: treat, cure, prevent, relieve and heal, paired with any named condition. "Helps with insomnia" is a drug claim. So is "reduces inflammation." Implied claims count the same way: a product named after a disorder, a testimonial about symptoms disappearing, a graphic of pill bottles in the trash.

What sells instead is composition. Here's a typical rewrite. Before: "Our best gummy for sleep and anxiety." After: "Indica-leaning blend, myrcene and linalool forward, 5 mg THC per piece, third-party COA linked." Nighttime shoppers still find it through strain type and terpene detail, and nothing on the page asserts a medical outcome.

Sweep the whole page along with the description. Meta titles, alt text, category names, FAQ copy, schema markup and customer reviews have all served as evidence of intended use. Educational content about cannabinoid research can still live on your site when it sits in a separate section, attributes findings to the studies and avoids internal links that turn an article into an implied claim for a specific product. Our guide on avoiding health claims in cannabis content includes more before-and-after rewrites. Google judges health-adjacent pages under its strictest quality standards, so the same claim discipline that keeps regulators away also protects rankings.

Age gates and marketing to minors

Age gates are the standard way cannabis sites show regulators they take reasonable steps to keep marketing away from minors. No single federal statute requires one. The duty comes from state marketing rules, adult-use sites gate at 21, and medical menus often gate at 18 for cardholders, depending on the program.

The compliance side is easy. The SEO side is where operators get hurt. A gate built as a redirect, where every URL bounces to /verify until a cookie is set, means Googlebot can only ever fetch the gate page, and the rest of the site drops out of the index. Google's guidance on intrusive interstitials exempts legally required age gates from its interstitial penalty, and it spells out the fix: overlay the content with the gate and never redirect requests to a separate page. For content behind a mandatory adult age gate, Google even recommends letting verified Googlebot requests through without triggering the gate.

So build it as an in-page overlay. Serve the complete HTML, cover it with a modal asking for age confirmation and store the answer in a cookie so returning visitors skip it. Custom builds are where this usually goes wrong.

A dispensary that rebuilds its gate as a separate page usually sees it in Search Console within weeks, as pages fall out of the index one crawl at a time until only the homepage ranks. Switching to an overlay, removing the redirects and resubmitting the key URLs fixes it without changing the compliance posture at all. Our guide to age-verification requirements for cannabis sites covers the build in more depth.

Two more points belong here. The website checkbox is marketing compliance, and the real age check happens at pickup or the delivery door. And never store a birth date a visitor enters to fail the gate: collecting personal information from children under 13 falls under COPPA, which no cannabis site should go near.

Required warnings and license numbers

Required warnings and disclaimers hurt rankings only when they crowd the top of a page or replace real content. Start with the short list of what you actually owe. California's Proposition 65 lists both cannabis smoke and delta-9 THC, so pages selling to California customers carry the warning on the product page or before checkout completes. CBD brands that make structure-function statements carry the standard FDA disclaimer. State regulators publish required warning language for ads, and California wants the license number in advertising. A 21+ notice is standard everywhere. Anything beyond what a rule requires is clutter you volunteered for.

Placement matters for both sides. Google separates main content from boilerplate, so a compact disclaimer strip repeated in the footer reads like a copyright line. Problems start when statutory text sits above the H1, gets wedged between the first heading and the first paragraph, or repeats in the middle of articles, because that dilutes the page exactly where relevance gets judged. Content first, statutory text in a consistent low position, one instance per rule.

A California edibles page set up well opens with the product name, a plain description, dosage and a linked certificate of analysis. The Prop 65 warning sits near the add-to-cart button. The FDA disclaimer appears once in the footer because the brand also sells CBD softgels. The 21+ line rides in the top bar. Keep warnings as real text, never images, and feed label data and page data from one product record so potency on the page always matches the package.

Email, SMS and push notification rules

Email, SMS and push are where cannabis gets to act like normal retail, and each channel has its own rules. Email runs under CAN-SPAM, which applies to any commercial email regardless of what you sell: truthful from-name and subject line, a physical postal address in every send, a working unsubscribe and opt-outs honored within ten business days. Google and Yahoo add their own bulk-sender requirements, including SPF, DKIM and DMARC authentication, one-click unsubscribe and a low spam-complaint rate.

The bigger email risk is your platform. Mainstream senders like Mailchimp and Klaviyo restrict cannabis businesses in their acceptable-use policies, and enforcement tends to arrive as a sudden suspension that takes automations and send history with it. Cannabis-built platforms such as Springbig and Alpine IQ exist for this reason. Collect a 21+ attestation at signup and export the list on a schedule.

Texting hits two walls. The first is consent. The Telephone Consumer Protection Act and the FCC's implementing rule require prior express written consent for marketing texts. In practice that means a signup disclosure naming the program, frequency and message-and-data rates, a box the customer ticks themselves, stored proof of each opt-in and STOP honored the moment it arrives. Statutory damages run $500 per message and up to $1,500 for willful violations, and that per-message math is why cannabis brands get named in class actions.

The second wall is carrier content rules. CTIA messaging guidelines treat cannabis as disallowed content because it is federally illegal, and the major carriers filter accordingly, state license or not. Campaigns get rejected at registration and messages with dispensary links or obvious product terms get silently dropped. That wall kills more dispensary SMS programs than the TCPA does, and it is why cannabis loyalty platforms with compliant routing exist. Write deal texts without product names or bare links, keep SMS enrollment as its own labeled consent step and never let SMS be the only way you can reach a customer.

Push notifications skip the carriers and answer to the app stores instead, with consent handled as an OS-level opt-in the user can revoke in one tap. Our guide to cannabis SMS and push notification rules covers the consent flow step by step.

App store rules for dispensary apps

App store rules for cannabis split sharply between Apple and Google. Apple's App Review Guidelines bar facilitating the sale of controlled substances in guideline 1.4.3, with an exception for licensed or otherwise legal cannabis dispensaries. Section 5.1.1(ix) adds that apps in legal cannabis must be submitted by the legal entity providing the service and that apps facilitating legal cannabis sales must be geo-restricted to the corresponding legal jurisdiction. Apps that encourage consumption, or aim at minors, get rejected.

Google Play is stricter. Its inappropriate content policy bans apps that facilitate the sale of marijuana regardless of legality, and its examples include an in-app shopping cart, help arranging delivery or pickup, and the sale of THC products. Android dispensary apps therefore tend to stick to loyalty, education and store information and keep ordering on the mobile website. Have your developer and counsel read the current Play wording before you design any ordering flow into an Android build.

Every constraint above argues for the mobile website. It faces no review queue and no store-imposed cart rules, and every page is indexable, which an app screen never is. Build the app when there is a real retention case. Our guide to app store rules for cannabis businesses covers review and geofencing in more detail.

Reviews, influencers and affiliate disclosures

Reviews, influencer posts and affiliate pages all fall under the FTC's Endorsement Guides, which treat a paid or incentivized recommendation as a material connection that has to be disclosed. A free product, a discount or a giveaway entry in exchange for a review counts. The FTC's rule on consumer reviews and testimonials goes further and prohibits fake reviews, bought reviews, undisclosed insider reviews and suppressing honest negative ones.

Google is stricter still on its own surfaces. Its review policy bans incentives of any kind and bans gating, meaning surveying customers first and sending only happy ones to leave a public review. Ask every customer the same way and offer nothing in return for a Google review.

Testimonials also carry claims risk. A republished customer quote becomes your claim, so a five-star review saying a tincture fixed someone's arthritis, featured on the product page, reads as you claiming it treats arthritis. Moderate disease claims out of product-page reviews under written guidelines, and never promote the medical ones in widgets or quote graphics.

For influencers and affiliates, the disclosure has to sit where the reader sees it before any link: under the H1, in plain words, and at the start of a social caption, never buried in a hashtag pile or a footer policy page. Write the disclosure requirement and age-restricted audience settings into every influencer brief. And remember that repeating a merchant's disease claim on a comparison page makes it yours.

Keeping a cannabis site in Google's index

Keeping a cannabis site in Google's index is mostly about avoiding the same mistakes any site can make, because Google does not remove sites for the subject. When a cannabis site disappears from search, the cause is something it did or something done to it. Three spam-policy traps come up constantly in this industry, partly because the paid channels are closed and shortcuts look tempting:

• Doorway pages. Dozens of near-identical "dispensary near [city]" pages for towns the store doesn't serve. One deep page per real store, with real photos, parking notes and staff, beats 150 city-swap pages.
• Scaled content abuse. Hundreds of unreviewed AI-generated strain or city posts with little added value.
• Link spam. Paid guest posts and link networks bought to shortcut authority.

Self-inflicted problems are more common than penalties. A staging noindex tag that ships to production, a leftover robots.txt Disallow, a redirect-style age gate or a hacked WordPress install with stale plugins can each pull pages out quietly. Patching and two-factor logins count as index protection.

Search Console is the early-warning system. The Manual actions report shows whether a reviewer has penalized the site, and recovery runs through fixing the issue, documenting the cleanup and filing a reconsideration request. The Pages report shows what is in or out of the index and why. Check both after every deploy. Health-adjacent pages also sit in Google's YMYL territory, where named authors with real cannabis experience and citations to actual research hold up through core updates far better than confident claims.

A compliance workflow that scales

A cannabis compliance workflow turns the rules above into a routine that works no matter who writes the page. Content comes from many hands: an in-house marketer, freelancers, an agency, whoever updates the menu. The knowledge has to live in the process.

• A one-page checklist per state. Required warning text, license number placement, audience thresholds, banned claims and imagery, promo limits and the date of the rules it reflects. If it runs past a page, nobody uses it. Have counsel review it once, then let writers run with it.
• A claims blocklist. Build it from FDA warning letters and your states' rules: disease names, cure-treat-prevent verbs, outcome promises, anything with minor appeal. Writers check drafts against it before review, and it gets refreshed quarterly.
• One named reviewer per market. Brief, draft, compliance pass, publish. Nothing ships around the reviewer, and real gray areas go to counsel.
• Templates for the risky parts. Age-gate copy, warning blocks and disclaimers live as versioned, pre-approved boilerplate, so a state's new warning text means one file changes.
• Review dates. Quarterly re-review for money pages and claim-adjacent content, annual for the archive, and immediately when a regulator amends its rules. Statute-tied pages like state legality explainers get a visible last-reviewed date.

Here's how it plays out. A writer files "Best strains for anxiety relief." The checklist flags the condition claim, and the piece ships as a guide to calming terpene profiles: linalool, myrcene, lineage and lab results. The same week, the check catches an email draft with a THC percentage in the subject line. Ten minutes of review, two problems that never reached a customer.

None of this replaces legal advice. When a specific question gets murky, spend the hour with a cannabis attorney licensed in that state. If you want an outside read on where your site stands today, from health claims and age gates to index problems and disclosures, our cannabis SEO audit covers it page by page.

Frequently asked questions

Can a cannabis business run ads on Facebook or Instagram?

Not for THC products. Meta's ad standards reject cannabis ads, and accounts that keep submitting them get disabled. Meta has offered a narrow certification-based path for some hemp and CBD products, so hemp brands should read the current policy. Organic posts are allowed as long as they avoid prices, menu links and ordering language.

Does Google ban cannabis websites from search results?

No. Google Ads prohibits cannabis promotion, but Google Search has no cannabis prohibition. Cannabis sites rank under the same quality and spam policies as every other site, and licensed dispensaries can hold Google Business Profiles. Sites lose rankings through spam-policy violations, hacked pages or technical mistakes like a leftover noindex tag.

Which state laws apply to cannabis advertising?

Each state's cannabis regulator writes its own advertising rules, so the laws of every state where an ad runs or a page targets customers apply. Common rules cover audience age thresholds, bans on imagery that appeals to minors, license numbers in ads, promotion limits and, in some medical programs, state pre-approval. Read the current rule text and check specific questions with a cannabis attorney licensed in that state.

Can CBD products be advertised on Google?

Only in a narrow case. Google allows ads for topical, hemp-derived CBD products with 0.3 percent THC or less from LegitScript-certified advertisers in the places its policy permits, so check the policy page before you plan a campaign. Ingestible CBD and THC products stay excluded.

Does an age gate hurt SEO?

Not when it is built as an overlay on top of the full page. Google exempts legally required age gates from its interstitial guidance. Redirecting every URL to a separate verification page is what causes damage, because Googlebot can then only fetch that one page and the rest of the site falls out of the index.