Do Illinois Dispensaries Share Information With the Government?

Yes, Illinois dispensaries do share information with the government, and the sharing is extensive. Every sale, every inventory movement, and every financial record flows into state tracking systems that regulators can inspect at any time, and dispensary banking generates separate federal reports. At the same time, Illinois law limits who inside government can see that information, keeps most of it out of public records, and gives you specific protections — and remedies — for the personal data a dispensary collects about you.

What a Dispensary Hands Over to the State

The Cannabis Regulation and Tax Act (CRTA) requires dispensaries to keep and share a wide set of records. Under Section 15-65, dispensaries maintain business records covering assets, liabilities, monetary transactions, invoices, receipts, and supporting documents for five years.¹

Section 15-75 adds a real-time, web-based point-of-sale system. Every sale is logged with its date, the amount sold, the price, and the currency used. The Illinois Department of Financial and Professional Regulation (IDFPR) can access that system at any time. The same five-year retention applies to point-of-sale documentation and to bank deposit and withdrawal records, stored in a secure, locked location at the dispensary.¹

Section 15-110 layers on an electronic retention requirement of at least three years for operating procedures, inventory logs, bank statements, ledgers, and other documents reasonably related to dispensary operations, all made available to IDFPR on request.²

Seed-to-Sale Tracking

Every licensed cannabis business must use the state’s designated seed-to-sale tracking platform, which follows products from cultivation through final sale. Illinois transitioned from BioTrack to Metrc in 2025, with full operation required by June 17, 2025. Metrc uses RFID technology for real-time visibility into product movement.³

Each dispensary’s agent-in-charge conducts daily inventory reconciliation to confirm that the state’s tracking system matches point-of-sale records and physical product on site. Dispensaries also file an annual compilation report with income statements, balance sheets, profit-and-loss statements, cash flow, wholesale costs, and sales data. A licensed CPA must review and certify the report, and it must be filed within 60 days after the end of the calendar year.¹

Employees who sell product or adjust inventory are individually identified in the tracking system with unique API keys, creating a digital trail that links specific staff to specific transactions.³

Which Agencies Can See the Data

IDFPR’s inspection authority under Section 15-135 is broad. The department and its authorized representatives can enter any place where cannabis is held, stored, sold, or transported and inspect equipment, containers, labeling, records, financial data, sales data, pricing data, personnel data, and inventory. They can also take samples.²

Inspections can be random and unannounced. IDFPR can investigate any applicant, dispensing organization, principal officer, agent, or third-party vendor for alleged violations.⁴

The Illinois Department of Revenue (IDOR) separately monitors dispensary records for cannabis excise tax compliance, auditing whether sales are being correctly reported and taxed.⁵

Federal Reporting Through Dispensary Banks

State legalization does not switch off federal financial reporting. The Financial Crimes Enforcement Network (FinCEN) has stated that the obligation to file Suspicious Activity Reports under the Bank Secrecy Act is “unaffected by any state law that legalizes marijuana-related activity.”⁶ Financial institutions serving dispensaries file SARs on cannabis-related transactions, so dispensary deposits and transfers generate a federal paper trail that runs parallel to IDFPR and IDOR oversight.

What Is Kept Confidential

Not everything a dispensary gives the state is public. Section 55-30 of the CRTA makes most dispensary application materials, security plans, and supporting documents confidential and exempt from the Illinois Freedom of Information Act. That information can be shared only among IDFPR, the Department of Agriculture, the Department of Public Health, the Department of Revenue, Illinois State Police, and the Attorney General when performing official duties.⁷

Criminal history records submitted during licensing get stronger protection: IDFPR and the Department of Agriculture cannot disclose them to anyone except the Attorney General when enforcement requires it.⁷ Information gathered during examinations, inspections, and investigations is also treated as confidential. In practical terms, the public generally cannot FOIA a dispensary’s security procedures, financial details, or licensing application.

Medical Cannabis Patient Privacy

Medical cannabis records are protected more heavily than adult-use records. Under Section 145 of the Compassionate Use of Medical Cannabis Program Act, patient applications, registry information, designated caregiver details, and medical records submitted to the Department of Public Health are confidential and exempt from FOIA. They can be shared among the Departments of Public Health, Financial and Professional Regulation, Agriculture, and Illinois State Police only to administer the program.⁸

One provision matters especially for patients: dispensing records required under the medical program must identify cardholders and cultivation centers by registry identification numbers only, not by name or other personally identifying information.⁸ That anonymization layer does not exist for adult-use purchases.

A separate federal rule, known as Part 2 (42 CFR Part 2), protects records of anyone receiving substance use disorder diagnosis, treatment, or referral through a federally assisted program. Part 2 generally bars sharing information that identifies someone as having a substance use disorder without written consent, an emergency, or a court order. A 2024 final rule aligned Part 2 more closely with HIPAA, with a compliance deadline of February 16, 2026.⁹ Whether Part 2 covers a particular Illinois medical dispensary depends on whether it qualifies as a federally assisted substance use disorder program, which is fact-specific.

How Your Personal Information Is Protected

Beyond the CRTA, dispensaries that handle nonpublic personal information about Illinois residents are “data collectors” under the Personal Information Protection Act (PIPA), with obligations in two main areas that touch customers directly.¹⁰

Breach Notification

If a dispensary suffers a data breach involving your personal information, it must notify you at no charge, in the most expedient time possible and without unreasonable delay. The notice has to include contact information for consumer reporting agencies, the FTC’s address and website, and a statement that you can place fraud alerts and security freezes on your credit files. For breaches involving login credentials rather than financial data, the notice can direct you to change your password instead.¹¹

Breaches affecting more than 500 Illinois residents must also be reported to the Attorney General, who may publicly disclose the dispensary’s name, the categories of personal information involved, and the date range of the breach.¹²

Data Disposal

When a dispensary discards materials with personal information, PIPA requires destruction thorough enough that the information cannot practically be read or reconstructed. Paper records must be shredded, burned, or pulverized; electronic media must be erased or destroyed. A dispensary that outsources disposal still bears responsibility for the contractor’s practices. Improper disposal carries civil penalties of up to $100 per affected individual, capped at $50,000 per incident, enforceable by the Attorney General.¹²

Biometric Scans

Some dispensaries use fingerprint readers, facial recognition kiosks, or palm scans. If so, the Illinois Biometric Information Privacy Act (BIPA) applies. Before collecting any biometric identifier, a dispensary must tell you in writing that it is collecting biometric data, explain the specific purpose and how long it will be stored, and get your signed written release.¹³

Dispensaries that skip those steps face liquidated damages of $1,000 per violation for negligent conduct and $5,000 per violation for intentional or reckless conduct, along with attorney’s fees, costs, and possible injunctions.¹³ A 2024 amendment treats repeated collection of the same biometric from the same person using the same method as a single violation.

What You Can Do If a Dispensary Mishandles Your Data

Illinois gives consumers several routes to relief. Under the Consumer Fraud and Deceptive Business Practices Act, any person who suffers actual damage from a violation can sue for actual economic damages, reasonable attorney’s fees, and injunctive relief.¹⁴ Because PIPA explicitly defines any PIPA violation as an unlawful practice under the Consumer Fraud Act, a breach caused by a dispensary’s negligent security practices can expose it to private suits by affected customers.¹²

BIPA offers an often stronger path. Unlike the Consumer Fraud Act, BIPA awards liquidated damages of $1,000 to $5,000 per violation whether or not the plaintiff suffered financial harm.¹³

The Attorney General also has independent enforcement authority. Section 45-5(d) of the CRTA lets the AG pursue violations of the act’s social equity, advertising, and predatory practice provisions as unlawful practices under the Consumer Fraud Act.¹⁵ On the regulatory side, IDFPR can revoke or suspend a dispensary’s license, place it on probation, issue cease-and-desist orders, refuse renewal, or impose fines of up to $20,000 per violation.¹⁶

If you believe a dispensary has mishandled your personal information, you can file a complaint with the Attorney General’s office, raise regulatory concerns with IDFPR, and — depending on the facts — pursue a private claim under the Consumer Fraud Act or BIPA.

1
Justia. Illinois Code 410 ILCS 705 – Article 15, License and Regulation of Dispensing Organizations
2
Illinois General Assembly. Illinois Code 410 ILCS 705 – Cannabis Regulation and Tax Act
3
Cannabis Regulation Oversight Office. Seed-to-Sale FAQs
4
Illinois Department of Financial and Professional Regulation. DFPR Administrative Code 1290
5
Illinois Department of Revenue. Cannabis Taxes
6
FinCEN.gov. BSA Expectations Regarding Marijuana-Related Businesses
7
Illinois General Assembly. Illinois Code 410 ILCS 705 – Cannabis Regulation and Tax Act, Confidentiality
8
Illinois General Assembly. Illinois Code 410 ILCS 130 – Compassionate Use of Medical Cannabis Program Act
9
U.S. Department of Health and Human Services. Understanding Confidentiality of Substance Use Disorder Patient Records or Part 2
10
Illinois General Assembly. Illinois Code 815 ILCS 530 – Personal Information Protection Act
11
Illinois General Assembly. Illinois Code 815 ILCS 530/10 – Notice of Breach
12
Illinois General Assembly. Illinois Code 815 ILCS 530 – Personal Information Protection Act
13
Justia. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act
14
Illinois General Assembly. Illinois Code 815 ILCS 505/10a
15
Illinois General Assembly. Illinois Code 410 ILCS 705/45-5 – License Suspension, Revocation, Other Penalties
16
Justia. Illinois Code 410 ILCS 705 – Article 45, Enforcement and Immunities