California dispensaries do share information with the government, but almost none of it identifies you. Licensed retailers report product movement to the state’s track-and-trace system and file sales tax returns with aggregate revenue figures. Neither channel carries customer names, IDs, or individual purchase histories. Law enforcement can reach whatever records a dispensary keeps internally, but generally only with a subpoena or warrant. A cannabis-specific privacy statute limits what dispensaries can pass to third parties, with a carve-out for state and local regulators doing official work.
What the Dispensary Collects When You Buy
Every adult-use customer has to show a valid government-issued photo ID proving they are at least 21. Medical patients can buy at 18 with a valid ID plus a county-issued card or a physician’s recommendation.1California Legislative Information. California Code Business and Professions Code BPC 26140 The law requires the check, not a recording of your ID details.
Anything beyond that check is the dispensary’s own choice. Many collect phone numbers, emails, and birthdays for loyalty programs or marketing. That is voluntary data collection, not a legal reporting requirement, and it becomes relevant later because whatever the dispensary holds is what an inspector or a subpoena can reach.
Delivery orders leave a fuller paper trail. Retailers running deliveries have to log the driver’s name, employee ID, license number, and vehicle information into the state’s tracking system before the driver leaves.2Department of Cannabis Control. Record-Keeping/Track-and-Trace Requirements for Deliveries The record focuses on the employee and vehicle, not on building a profile of you, though the trip itself is documented.
Your visit is also on camera. Dispensaries must run continuous video surveillance at 720p or better covering entrances, exits, points of sale, and cannabis handling areas, and keep the recordings for at least 90 days. That footage is available to regulators or police if requested through proper channels.
The State’s Track-and-Trace System Follows Products, Not People
The California Cannabis Track-and-Trace system (CCTT), built on METRC software, has operated statewide since January 2018.3Department of Cannabis Control. 5 Steps to Using the Track and Trace System Every licensed business uses it. Unique identifier tags follow plants and packages from cultivation through processing, distribution, and final retail sale.4California Department of Food and Agriculture. Frequently Asked Questions About the California Cannabis Track-and-Trace System
CCTT records what was sold: product type, quantity, and UID. It does not collect or store customer names, ID information, or purchase histories.4California Department of Food and Agriculture. Frequently Asked Questions About the California Cannabis Track-and-Trace System The Department of Cannabis Control publishes aggregated dashboards for industry-wide licensing, harvest, and sales figures. Nothing in that data identifies individual buyers.
Tax Filings Use Aggregate Numbers
Cannabis retailers collect a 15% excise tax on gross receipts and remit it to the California Department of Tax and Fee Administration.5California Department of Tax and Fee Administration. Tax Facts for Cannabis Businesses They also collect standard sales tax. Returns report total revenue and tax collected. They do not include customer names or transaction-level detail.
The same applies to federal filings with the IRS: dispensaries report business income, not who bought what. An audit could pull more granular business records, but the focus there is the business’s compliance rather than building a customer database.
What Regulators Can See During an Inspection
The Department of Cannabis Control can inspect any licensed dispensary without notice. Inspectors review METRC records, premises diagrams, security systems, and video. Licensed businesses must retain records for at least seven years, including sales invoices, receipts, bank statements, tax records, personnel files, and contracts.6Cornell Law Institute. Cal Code Regs Tit 4, 15037 – General Record Retention
Those records must be producible on demand in hard copy or electronic form.6Cornell Law Institute. Cal Code Regs Tit 4, 15037 – General Record Retention The rule targets business compliance, not consumer surveillance. But if a dispensary has been collecting customer information voluntarily, that data sits in records the DCC can examine.
Police and Federal Agencies Need a Warrant or Subpoena
Officers cannot walk in and pull customer records. Access requires a subpoena or search warrant, usually tied to an active criminal investigation. California state agencies have historically pushed back against federal subpoenas for cannabis business records, invoking state privacy law and asking the requesting agency to explain relevance.
This matters because cannabis is still federally illegal. In practice, federal agencies have not pursued mass data collection from California dispensaries, and the state framework is built to keep customer information out of routine reporting. A targeted federal investigation with a valid warrant could still compel production of whatever a dispensary holds.
The Cannabis Privacy Statute: BPC 26161.5
Business and Professions Code Section 26161.5 bars licensed cannabis businesses from disclosing a consumer’s personal information to third parties unless disclosure is necessary to process a payment or you have consented. It also bars them from denying you products or services because you refused to share your information.7California Legislative Information. California Code BPC 26161.5
The carve-out matters. The statute does not prohibit disclosing nonpublic personal information to the State of California, or a city or county, when those agencies are performing official duties under the cannabis licensing framework or local ordinances. Your dispensary cannot sell your data to a marketer or hand it to another business without permission, but it can provide information to state or local regulators carrying out their official responsibilities. Software contractors that help process transactions or verify eligibility are also exempt, as long as they do not use your data for unrelated purposes or pass it along.7California Legislative Information. California Code BPC 26161.5
Your CCPA Rights
The California Consumer Privacy Act lets consumers ask what personal information a business collects, request deletion, and opt out of the sale or sharing of that information. The CCPA applies to for-profit businesses in California meeting any one of these thresholds: gross annual revenue above $25 million, handling personal information of 100,000 or more California residents or households, or deriving at least half their annual revenue from selling personal information.8State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Many larger chains hit the revenue threshold. If yours does, you can submit a formal request asking what data it holds about you and demand deletion. A smaller single-location shop may fall under all three thresholds, in which case the CCPA does not apply, though BPC 26161.5 still does.
Extra Protection for Medical Patients
If you hold a medical marijuana identification card or use a physician’s recommendation, additional rules apply. Health and Safety Code Section 11362.713 classifies all patient information as medical information under California’s Confidentiality of Medical Information Act, which restricts disclosure without authorization. Program administrators must also comply with HIPAA.9California Department of Public Health. Medical Marijuana Identification Card Program FAQs
The state’s Medical Marijuana Application System is built around minimal data. It stores no names, addresses, or Social Security numbers, only a unique user ID number. When queried, it returns only whether the card is valid.9California Department of Public Health. Medical Marijuana Identification Card Program FAQs A dispensary can confirm your card is legitimate without the state ever revealing who you are.
Can the State See Purchases Across Different Dispensaries?
No. California has no centralized database linking individual consumer identities to purchases across dispensary locations. CCTT tracks products through the supply chain, not the end buyer.4California Department of Food and Agriculture. Frequently Asked Questions About the California Cannabis Track-and-Trace System Enforcement of daily purchase limits happens at the register, dispensary by dispensary. Nothing flags you in real time if you visit multiple shops.
Cash Purchases Leave Little Financial Trail
Because cannabis remains illegal federally, most dispensaries have limited or no access to traditional banking. Many transactions are cash, so there is no credit card statement showing what you bought and no bank-side record tying your name to a dispensary through federally regulated payment networks. Some shops accept debit cards or use cashless ATM workarounds, which typically appear on statements as generic ATM withdrawals rather than cannabis purchases.
A cash purchase at a dispensary that does not require loyalty sign-up leaves little financial footprint beyond the dispensary’s own internal records.
One Federal Boundary Worth Knowing
Cannabis privacy at the state level does not shield you from a federal firearm rule. Under 18 U.S.C. Section 922(g)(3), an unlawful user of or person addicted to a controlled substance is prohibited from possessing, purchasing, or receiving a firearm.10Office of the Law Revision Counsel. 18 USC 922 – Unlawful Acts Cannabis is still a Schedule I controlled substance federally, regardless of California law.
ATF Form 4473, filled out when you buy a gun from a licensed dealer, asks whether you are an unlawful user of marijuana or any other controlled substance. It warns that marijuana use remains unlawful under federal law even in states that have legalized it. Answering “no” as a regular cannabis user is a federal felony. The federal NICS background check does not currently pull California dispensary records or CCTT data, and the medical marijuana database stores no personally identifiable information.9California Department of Public Health. Medical Marijuana Identification Card Program FAQs The legal prohibition exists whether or not the government can prove your use through dispensary records, and lying on Form 4473 carries its own criminal penalty.