How to Handle Cookie Consent on Cannabis Sites

Two consent models, one banner

GDPR and the ePrivacy rules require opt-in consent before non-essential cookies load for EU and UK visitors. California's CCPA/CPRA works the other way: visitors opt out of the sale or sharing of personal information, and the Global Privacy Control browser signal must be honored. Colorado's privacy law likewise requires respecting universal opt-out signals. A US dispensary mostly needs the opt-out model; real European traffic means serving the opt-in variant by geolocation.

Cannabis data is heavier than retail data

A cannabis purchase trail is not a shoe purchase trail. It can surface in employment screening, it conflicts with the federal firearms purchase form's cannabis question, and it complicates immigration cases. That argues for minimization beyond any statute: first-party analytics, short retention windows, and no syncing of purchase events to ad platforms — most of which prohibit cannabis advertisers anyway, so the pixel was buying you risk and nothing else.

Consent Mode v2 if the EEA matters to you

For EEA and UK users, Google ties its advertising and measurement features to Consent Mode v2 signals, which pass the visitor's choices for ad storage and analytics storage to its tags. CBD and ancillary brands with European traffic need this wired through the consent platform; a THC retailer with no EU audience can skip it.

Pick a CMP and configure it honestly

OneTrust, Cookiebot, and Termly all do the job; configuration matters more than the logo. Scripts stay blocked until consent. Category toggles describe what actually fires. Reject is as easy as accept. GPC is honored automatically. A banner that nags, pre-ticks, or buries the decline button creates the records of a violation, kept helpfully on your own domain.

Keep the banner from sabotaging rankings

Three failure modes: a full-screen consent wall reads as an intrusive interstitial, a late-loading banner causes layout shift that drags Core Web Vitals, and an age gate stacked on a cookie wall can leave crawlers staring at overlays instead of content. Use a bottom bar, reserve its space in the layout, and make sure the age gate does not block rendering.

What this looks like in practice

A Colorado dispensary: bottom-bar CMP in opt-out mode with GPC honored, first-party analytics only, no ad pixels, a do-not-sell-or-share link in the footer, and an age gate that overlays without blocking the underlying HTML. Visitors geolocated to the EU get the opt-in banner instead. Nothing exotic — just the stricter defaults, chosen on purpose.

Frequently asked questions

Does a US dispensary site need GDPR-style opt-in consent?

Only for EU and UK visitors. US state laws such as CCPA/CPRA in California and Colorado's privacy act run on an opt-out model instead, including honoring the Global Privacy Control browser signal. Most consent platforms can serve both models by geolocation.

What is Global Privacy Control?

A browser-level signal that tells sites the visitor opts out of the sale or sharing of their data. California and Colorado both require honoring it, and a correctly configured consent platform handles it automatically.

Can a cookie banner hurt SEO?

Yes, in specific ways: a full-screen banner behaves like an intrusive interstitial, a late-loading one causes layout shift, and stacked overlays can hide content from crawlers. A bottom bar with reserved layout space avoids all three.

General information for cannabis marketers, not legal advice.