Arizona dispensaries do share some information with the government, but for recreational customers that sharing is narrower than most buyers assume: the state receives aggregate sales figures and tax revenue, not a line-item record of who bought what. Medical marijuana patients are tracked more closely because dispensaries have to verify allotments, but a confidentiality statute keeps those records tied to a registry number rather than a name. Whether Arizona dispensaries share information with the government in a way that identifies you personally depends on which program you buy under and whether law enforcement has gone through a court to get at the dispensary’s own records.
What the Dispensary Collects at the Counter
Every licensed dispensary in the state checks a government-issued ID before completing a sale. Proposition 207 directs the Arizona Department of Health Services to adopt rules specifying which forms of ID dispensaries can accept to confirm a buyer is at least 21.1Arizona Legislature. Arizona Code 36-2854 – Rules, Licensing, Early Applicants, Fees, Civil Penalty, Legal Actions For recreational buyers, that ID check is usually the extent of the personal information the dispensary needs. The sale itself generates an internal business record showing product, quantity, price, and time, which the dispensary keeps for inventory, tax reporting, and compliance inspections.
Medical patients hand over more. The dispensary pulls details from your registry identification card, verifies that you are within the 2.5-ounce per 14-day limit, and logs the sale against your card in the state’s licensing system. That logging is a legal requirement, not a courtesy, because the state has to know you stayed inside your allotment.
What Actually Reaches the State
Seed-to-Sale Tracking
Arizona law requires every licensed marijuana establishment to maintain a system that tracks cannabis products through cultivation, manufacturing, and sale, including plant propagation, processing, transfers between licensed facilities, and waste disposal.1Arizona Legislature. Arizona Code 36-2854 – Rules, Licensing, Early Applicants, Fees, Civil Penalty, Legal Actions Each entry has to carry a transactional stamp to prevent tampering.
One detail that distinguishes Arizona from many other legal states: there is no single third-party vendor like METRC that pulls every transaction into a centralized state database in real time. Each licensee procures and maintains its own compliant tracking system, and ADHS inspects those records during site visits. The product tracking data lives at the dispensary, and the state reaches it by looking at it there, not by receiving a continuous feed.
MLMS for Medical Marijuana
ADHS runs the Marijuana Licensing Management System, which covers both medical and adult-use licensing. For medical sales specifically, dispensaries use MLMS to search patient and caregiver cards and log sale amounts against each allotment.2Arizona Department of Health Services. Marijuana Licensing Management System Handbook That means ADHS has direct visibility into medical dispensing in a way it does not have for recreational sales. The records in MLMS, however, identify patients by registry identification number rather than by name.
Tax Reporting
Dispensaries report and remit two layers of tax to the Arizona Department of Revenue. The first is the 16% excise tax on adult-use marijuana, calculated on the net sale price to the final customer.3Arizona Legislature. Arizona Code 42-5452 – Levy and Rate of Tax, Effect of Federal Excise Tax Medical marijuana dispensed to registered patients and caregivers is exempt from this excise. The second layer is the Transaction Privilege Tax, which covers retail sales generally.4Arizona Department of Revenue. Filing Requirements – Adult Use Marijuana Both are filed through AZTaxes.gov.
Tax filings carry aggregate sales figures and categories. ADOR sees revenue, not customers.
Medical Patient Confidentiality
A.R.S. § 36-2810 gives the medical marijuana program a strong privacy backbone. Patient and caregiver applications and their supporting documents, dispensary applications and physical addresses, and the names and identifying information of anyone issued a registry card are all confidential and exempt from public disclosure.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
Three operational rules in the statute matter in practice:
- Dispensing records a dispensary is required to maintain must identify cardholders by registry identification number only; they cannot contain names or other personally identifying information.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
- Except for public health research, protected information cannot be combined or linked with any other list or database, and cannot be used for any purpose not authorized by the medical marijuana chapter.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
- ADHS hard drives or other storage media no longer in use that contain cardholder information must be physically destroyed, and an ADHS employee has to sign a statement confirming it.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
These protections cover records held by ADHS for the medical program. Recreational purchases do not generate the same category of state-held records in the first place, so the privacy question is structurally different: there is less data in state hands because the state collects less of it.
When Law Enforcement Can Reach Dispensary Records
The confidentiality rules have carve-outs. Under § 36-2810, ADHS employees can notify law enforcement about falsified or fraudulent information submitted to the agency, but only after the employee and their supervisor both agree the circumstances warrant it. ADHS can also report apparent criminal violations of the medical marijuana chapter under the same two-person agreement requirement.5Arizona Legislature. Arizona Code 36-2810 – Confidentiality
Outside those narrow agency-initiated disclosures, police and prosecutors reach dispensary records the way they reach any business records: by warrant or valid subpoena. The confidentiality statute limits what ADHS voluntarily hands over. It does not shield a dispensary from a judicial order directed at the dispensary itself. If you become part of a criminal investigation, a judge can order the dispensary to produce transaction records that include your purchases.
The registry-number-only rule still provides a practical buffer for medical patients. Dispensing records obtained from a dispensary identify patients by number, and connecting a number to a name requires a separate request to ADHS that runs into the confidentiality restrictions.
Federal Access and Banking Reports
Cannabis remains a controlled substance under federal law, which creates a second channel to think about. Nothing in Proposition 207 or the medical marijuana act requires or authorizes Arizona to forward purchase records to the DEA, FBI, or any other federal agency, and the state does not do so voluntarily. Federal authorities can still pursue dispensary records through a federal grand jury subpoena or a warrant from a federal court. In practice, federal enforcement has not focused on individual consumers buying legal amounts under state law, but the legal authority is there.
The more routine federal visibility runs through the banking system. Financial institutions that serve marijuana-related businesses must file Suspicious Activity Reports with the Financial Crimes Enforcement Network, and FinCEN guidance sorts those filings into categories depending on whether the bank believes the business is complying with state law, whether federal enforcement priorities appear implicated, and whether the bank is terminating the relationship.6Financial Crimes Enforcement Network. BSA Expectations Regarding Marijuana-Related Businesses These reports target the dispensary as a business. Your individual debit card swipe does not generate a standalone SAR naming you. Federal regulators get a view of dispensary revenue flows, not an itemized customer list.
The Practical Bottom Line
For a recreational purchase, no government entity routinely receives your name tied to a specific product, the strains or items you selected, how often you visit, or how much you spend per trip. The dispensary checks your ID and completes the sale. ADHS can inspect the dispensary’s seed-to-sale system, but that system tracks products moving through the supply chain, not consumers moving through their buying habits. ADOR sees tax revenue in aggregate.
For a medical purchase, ADHS sees more through MLMS, but what it sees is a registry number buying against an allotment. The link between that number and your real identity exists inside ADHS, and the confidentiality statute controls who can cross it.
Your dispensary visit is not invisible, though. The dispensary itself holds your data in its point-of-sale and compliance systems, and a breach there could expose customer information. Arizona has breach notification requirements like other states, but those obligations run after the fact. If dispensary privacy matters to you, paying with cash and asking the dispensary about its own data retention policies are the most direct steps available.