California dispensaries do share information with the government, but far less of it, and far less about you personally, than most customers assume. They report product movement to state regulators through a seed-to-sale tracking system and remit taxes based on aggregate sales. They do not routinely hand over customer names, IDs, or purchase histories. State law restricts further sharing without your consent, and law enforcement generally needs a warrant or subpoena to see customer records. A few exceptions and one serious federal risk are worth knowing about before your next visit.
What the Dispensary Collects Versus What It Reports
Every adult-use customer has to show a valid government-issued photo ID proving they are at least 21 before buying. Medical patients can purchase at 18 with an ID plus a county-issued identification card or a physician’s recommendation.1California Legislative Information. California Code Business and Professions Code BPC 26140 The law requires age verification, not retention of your ID details. Phone numbers, emails, and birthdays collected for loyalty programs are the dispensary’s own choice, not a legal mandate for walk-in sales.
Delivery orders generate more paperwork. Licensed retailers must log the trip into the state tracking system before the driver leaves, recording the driver’s name, employee ID, license number, and vehicle information.2Department of Cannabis Control. Record-Keeping/Track-and-Trace Requirements for Deliveries The focus is on the employee and vehicle rather than the customer, but the record is more detailed than an in-store sale.
Dispensaries also run continuous video surveillance at a minimum of 720p covering entrances, exits, point-of-sale areas, and all cannabis handling locations. Recordings must be kept for at least 90 days. Your visit is on camera, and that footage is available to regulators or law enforcement through proper channels.
The State Tracking System Follows Products, Not People
The California Cannabis Track-and-Trace system (CCTT) runs on METRC software and has operated statewide since January 2018.3Department of Cannabis Control. 5 Steps to Using the Track and Trace System Every licensed cannabis business uses CCTT to log inventory and product movement. The system assigns unique identifier tags to plants and packages and follows each item from cultivation through retail sale.4California Department of Food and Agriculture. Frequently Asked Questions About the California Cannabis Track-and-Trace System
Here is the point that matters for buyers. CCTT records what was sold — product type, quantity, UID — but does not collect or store customer names, IDs, or purchasing histories.4California Department of Food and Agriculture. Frequently Asked Questions About the California Cannabis Track-and-Trace System The Department of Cannabis Control publishes aggregated industry dashboards, nothing that could identify an individual buyer. There is also no centralized database linking consumer identities to purchases across dispensary locations. Enforcement of daily purchase limits sits with the individual retailer at the point of sale; no real-time system flags you for visiting multiple shops.
Taxes Are Reported in Aggregate
Retailers collect a 15% cannabis excise tax on gross receipts and remit it to the California Department of Tax and Fee Administration, along with standard sales tax.5California Department of Tax and Fee Administration. Tax Facts for Cannabis Businesses Those returns report total sales revenue and tax collected, not individual customer names or transaction-level detail. The same is true of federal income tax: dispensaries report business income, not who bought what. Granular records can surface in an audit or investigation, but even then the subject is the business’s compliance.
The Cannabis Privacy Statute
California’s cannabis-specific privacy statute, Business and Professions Code Section 26161.5, prohibits licensed cannabis businesses from disclosing a consumer’s personal information to third parties unless the disclosure is necessary to process a payment or you have given consent. It also bars dispensaries from denying you products or services because you refused to consent to sharing.6California Legislative Information. California Code BPC 26161.5
One carve-out matters for the question of government sharing: the statute does not prohibit disclosing nonpublic personal information to the State of California, or any city or county, when they are performing official duties under the cannabis licensing framework or local ordinances. Software contractors helping dispensaries process transactions or verify eligibility are also exempt, as long as they do not use your data for unrelated purposes or pass it along.6California Legislative Information. California Code BPC 26161.5 A dispensary cannot sell your data to a marketing firm, but it can hand information to state or local regulators carrying out their duties.
When Regulators and Police Can Reach the Records
The Department of Cannabis Control can inspect any licensed dispensary without prior notice. Inspectors review METRC records, premises diagrams, security systems, and video surveillance to confirm compliance. Licensed businesses must keep records for at least seven years, including sales invoices, receipts, bank statements, tax records, personnel files, and contracts, and must produce them on demand in hard copy or electronic form.7Cornell Law Institute. Cal Code Regs Tit 4, 15037 – General Record Retention The rule aims at business compliance rather than consumer surveillance, but if a dispensary has voluntarily collected customer data for its loyalty program, that data sits inside records the DCC can access during an inspection.
Police and federal agents cannot simply walk in and pull customer records. Access requires a subpoena or search warrant, typically tied to an active investigation. California state agencies have historically pushed back against federal subpoenas for cannabis business records, citing state privacy law and demanding that the requesting agency explain the relevance of what it wants. Cannabis remains federally illegal, so a targeted federal investigation with a proper warrant could still compel production of whatever records a dispensary holds, but federal agencies have not pursued mass data collection from California retailers.
Medical Patients Get Stronger Privacy
If you hold a Medical Marijuana Identification Card or use a physician’s recommendation, your information gets an extra layer of protection. Health and Safety Code Section 11362.713 classifies patient information as “medical information” under California’s Confidentiality of Medical Information Act, which restricts disclosure without authorization. Providers administering the program must also comply with HIPAA.8California Department of Public Health. Medical Marijuana Identification Card Program FAQs
The state’s Medical Marijuana Application System was built with privacy at its core. It contains no personally identifiable information. The only data stored is a unique user identification number, and queries return only whether the card is valid or invalid.8California Department of Public Health. Medical Marijuana Identification Card Program FAQs A dispensary can confirm your card is legitimate without the state system revealing who you are.
The Federal Firearm Risk
Even though California dispensaries do not share customer purchase data with federal agencies, one federal rule applies to you independently of what any database contains. Under 18 U.S.C. Section 922(g)(3), anyone who is an unlawful user of or addicted to a controlled substance is prohibited from possessing, purchasing, or receiving a firearm.9Office of the Law Revision Counsel. 18 USC 922 – Unlawful Acts Cannabis is still a Schedule I controlled substance federally, regardless of California law.
When you buy a firearm from a licensed dealer, ATF Form 4473 asks whether you are an unlawful user of marijuana or any other controlled substance, with an explicit warning that marijuana possession remains unlawful under federal law even in states where it has been legalized. Answering “no” when you are a regular cannabis user is a federal felony. The federal NICS background check system does not have access to California dispensary records or CCTT data, and the state’s medical database stores no identifying information.8California Department of Public Health. Medical Marijuana Identification Card Program FAQs The legal prohibition exists whether or not the government can prove your use through dispensary records, and the false-statement charge on Form 4473 is independent.
What You Can Do About Your Own Data
The California Consumer Privacy Act gives you the right to know what personal information a business collects, to request deletion, and to opt out of its sale or sharing. The CCPA applies to for-profit businesses operating in California that meet any one of three thresholds: gross annual revenue over $25 million, buying or selling the personal information of 100,000 or more California residents or households, or deriving at least half of annual revenue from selling personal information.10State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Many larger dispensary chains clear the revenue threshold; if yours does, you can submit a formal request to see your data and demand it be deleted. Smaller single-location shops may fall below all three thresholds, in which case the CCPA does not apply, though BPC 26161.5 still binds them.
Beyond formal rights, your own choices at the counter shape how much data exists in the first place. Skipping the loyalty program sign-up means a dispensary verifies your age and sells to you without logging a profile. Paying cash avoids a card-side record, and because federal banking restrictions push much of the industry toward cash anyway, debit or cashless-ATM transactions typically appear on bank statements as generic ATM withdrawals rather than cannabis purchases. Unlike a pharmacy visit that generates insurance records and prescription database entries, a cash purchase at a dispensary that does not require sign-up leaves very little footprint outside that store’s own records.