Arizona dispensaries do share some information with government agencies, but for recreational purchases that sharing does not include your name tied to what you bought. The state’s rules focus on tracking cannabis products through the supply chain and collecting taxes, not on logging individual customer purchases. Medical marijuana patients are tracked more closely, but a state confidentiality statute keeps their identities behind registry ID numbers. The gap between what regulators require and what they actually learn about you is smaller than most customers assume.
What the Dispensary Collects at the Counter
Every Arizona dispensary checks your government-issued ID before ringing up a sale. Under Proposition 207, the Arizona Department of Health Services adopts rules specifying which forms of ID dispensaries can accept to verify that buyers are at least 21.1Arizona Legislature. Arizona Code 36-2854 – Rules, Licensing, Early Applicants, Fees, Civil Penalty, Legal Actions Staff scan or visually inspect your ID, confirm your age, and process the transaction. For a recreational buyer, that is usually the extent of the personal information exchanged.
Medical patients hand over more. Dispensaries record details from your registry identification card, verify your allotment (you cannot purchase more than 2.5 ounces in any 14-day period), and log the transaction in the state’s licensing system to make sure you stay within your legal limits.
Both recreational and medical sales also generate internal business records: product, quantity, price, date, and time. Dispensaries keep these for inventory, tax reporting, and compliance with ADHS inspections, which happen at least once a year and without notice.1Arizona Legislature. Arizona Code 36-2854 – Rules, Licensing, Early Applicants, Fees, Civil Penalty, Legal Actions
What Actually Reaches State Agencies
Seed-to-Sale Product Tracking
Arizona law requires every licensed marijuana establishment to run a system that tracks cannabis at all points of cultivation, manufacturing, and sale, including plant propagation, processing, transfers between licensees, and waste disposal.1Arizona Legislature. Arizona Code 36-2854 – Rules, Licensing, Early Applicants, Fees, Civil Penalty, Legal Actions Every entry carries a transactional stamp identifying who made it and when.
An important structural point: Arizona does not contract with a third-party statewide vendor like METRC. Each licensee procures and maintains its own compliant tracking system. ADHS can inspect these records during site visits, but the data lives with the dispensary, not in a centralized state database that ingests every transaction in real time. The system also tracks products, not consumers.
The MLMS System for Medical Sales
ADHS operates the Marijuana Licensing Management System, which handles both medical and adult-use licensing. For medical marijuana, dispensaries use MLMS to look up patient and caregiver cards and log sale amounts against each card’s allotment.2Arizona Department of Health Services. Marijuana Licensing Management System Handbook Because MLMS ties medical sales to a patient’s registry card, ADHS has visibility into medical dispensing data that simply does not exist for recreational sales. The records in MLMS identify patients by registry identification number rather than by name, a distinction the confidentiality statute reinforces.
Tax Filings
Dispensaries report and remit two taxes to the Arizona Department of Revenue. The first is a 16% excise tax on adult-use marijuana sales, calculated on the net sale price to the final customer; medical marijuana dispensed to registered patients and caregivers is exempt.3Arizona Legislature. Arizona Code 42-5452 – Levy and Rate of Tax, Effect of Federal Excise Tax The second is the state’s Transaction Privilege Tax on retail sales.4Arizona Department of Revenue. Filing Requirements – Adult Use Marijuana Both are filed through AZTaxes.gov on the TPT return.
The privacy point is straightforward: these filings contain aggregate sales figures and categories. The Department of Revenue sees revenue numbers, not customer names or itemized purchases.
Medical Patient Confidentiality
Arizona’s medical marijuana confidentiality statute, A.R.S. § 36-2810, treats several categories of ADHS-held records as confidential and exempt from public disclosure: patient and caregiver applications and their supporting documents, dispensary applications and physical addresses, and the names and identifying information of anyone issued a registry card.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
Three provisions matter most in practice:
- Any dispensing records a dispensary must maintain identify cardholders by registry number only, and cannot contain names or other personally identifying information.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
- Except for public health research, protected information cannot be combined or linked with any other list or database, and cannot be used for any purpose not authorized by the medical marijuana chapter.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
- Department storage media that hold cardholder information and are no longer in use must be physically destroyed, with a signed statement from an ADHS employee confirming the destruction.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
These protections apply to ADHS records for the medical program specifically. Recreational adult-use purchases do not create the same kind of state-held records to begin with, so the privacy question there is structurally different: less data is collected, so less needs protecting.
When Law Enforcement Can Reach Your Records
The confidentiality rules are not absolute. Under § 36-2810, ADHS employees may notify law enforcement about falsified or fraudulent submissions to the department, but only if the employee and their supervisor both agree the circumstances warrant it. ADHS can also report apparent criminal violations of the medical marijuana chapter under the same two-person agreement requirement.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
Beyond those narrow disclosures, law enforcement can pursue dispensary records through standard legal process. A court-issued warrant or valid subpoena can compel a dispensary to produce business records, just as it can for any other business. The confidentiality statute restricts what ADHS voluntarily discloses; it does not shield the dispensary itself from judicial process. If you are involved in a criminal investigation, a judge can order the dispensary to turn over transaction records that include your purchases.
The registry-number-only rule for medical records adds a practical buffer. Even if investigators obtain dispensing records from a dispensary, those records identify patients by registry number. Connecting a number to a real person requires a separate request to ADHS, which the confidentiality restrictions govern.
Federal Agencies and the Banking System
Cannabis remains a controlled substance under federal law, and that creates real if indirect exposure for dispensary customers. Arizona does not voluntarily share dispensary customer data with federal agencies. Nothing in Proposition 207 or the medical marijuana act requires or authorizes the state to forward purchase records to the DEA, FBI, or any other federal entity. Federal authorities have their own tools, though: a federal grand jury subpoena or a warrant from a federal court can reach dispensary records the same way it can reach records at any other business. In practice, federal authorities have not pursued individual consumers buying legal amounts under state law, but the legal authority exists.
The more routine federal visibility runs through banks. Because cannabis is federally illegal, financial institutions that serve marijuana-related businesses must file Suspicious Activity Reports with the Financial Crimes Enforcement Network.6Financial Crimes Enforcement Network. BSA Expectations Regarding Marijuana-Related Businesses These SARs focus on the dispensary as a business, not on individual customers buying an eighth of flower. Your personal debit card transaction at a dispensary does not generate a standalone SAR naming you. Federal regulators do gain visibility into dispensary revenue flows in aggregate, but not into itemized customer purchases.
What the Government Does Not See
Pull it all together and here is what no government entity routinely receives for a recreational purchase: your name linked to a specific product, the strains or items you chose, how often you visit, or how much you spend per trip. The dispensary checks your ID at the door and processes the sale, but it is not required to report that a named customer bought a particular edible on a particular Tuesday. ADHS sees aggregate market data and can inspect a dispensary’s seed-to-sale system during a compliance visit, but that system tracks products through the supply chain, not customers through their habits.
For medical patients, ADHS sees more through MLMS, but what it sees is a registry number purchasing against an allotment. The link between the number and a real identity exists inside ADHS, and the confidentiality statute sharply limits who can use it and why.
None of this makes your dispensary visit invisible. The dispensary itself holds your data in its point-of-sale and compliance systems, and a breach there could expose customer information. Arizona has breach notification laws like every other state, but the obligation runs from the dispensary to you after the fact, not from the government preventing the breach in the first place. If dispensary privacy matters to you, paying in cash rather than by card and asking the dispensary about its own data retention policies are the most practical steps available.