Online Dispensary Marketing Services: Your Campaign Is Legal in One State and Illegal in the Next

Most guidance on marketing a dispensary online stops at the obvious wall. Google will not take your money, Meta will not take your money, so build organic. True, and by now unhelpful, because it describes a constraint every operator discovered in week one.

The interesting constraint is the one underneath, and it is numerical.

Audience composition is a threshold, not a principle

Every state that permits cannabis advertising at all attaches a percentage to it: the share of the audience that must reasonably be expected to be 21 or over. Those percentages differ, and the differences are not decorative.

California sits at 71.6 percent. Massachusetts at 85. New York and Connecticut at 90, with New York requiring reliable evidence that the threshold is met. Some states permit no advertising outside cannabis publications and age-gated platforms at all.

Run the implication for a multi-state operator. A programmatic buy that clears California by a comfortable margin fails New York outright. A campaign built to the New York standard clears everywhere and costs more to deliver, because the inventory that can prove 90 percent composition is scarcer and dearer than the inventory that can prove 71.6.

The only sane architecture is to build to the strictest market you operate in and relax outward where the rules permit, which is the opposite of how campaigns are usually assembled. Most start from the biggest market and adapt down, and every adaptation is a compliance question nobody wrote down.

There is a second-order effect worth noticing. Because the burden of proof sits with the advertiser in the strictest states, the audience data itself becomes a compliance artifact. You are not just buying placement, you are buying evidence, and the ability to produce it later is part of what you are paying for.

The word “reasonably expected” is doing enormous work

None of these thresholds can be measured directly. Nobody knows the age of everyone who saw an ad. So the standard is expectation, evidence, and reasonableness, which means the compliance question is not what happened but what you could show you believed on defensible grounds beforehand.

That reframes the whole exercise. A dispensary that ran a clean campaign and kept nothing is in a worse position than one that ran the same campaign and documented its audience assumptions. Regulators assess the reasoning, not the outcome, because the outcome is unknowable.

Your vendor can be fined even though they hold no licence

Here is the part that should interest anyone hiring for this work, and it rarely surfaces in a pitch.

Arizona Revised Statutes § 36-2859, the state’s advertising restrictions provision, makes it unlawful for an individual or entity other than a marijuana establishment or dual licensee to facilitate delivery of marijuana, to solicit or accept orders or operate a platform that does, or to operate a listing service related to the sale or delivery of marijuana, in any manner the chapter does not authorise.

It also requires that an advertising platform may host cannabis advertising only where the advertising is authorised by a licensee and legibly identifies that licensee by name and licence number. And any advertising involving direct, individualised communication must use a method of age affirmation confirming the recipient is 21 before the dialogue begins.

Then comes the part that should concentrate a vendor’s attention. Beyond any other penalty imposed by law, an individual or entity other than a marijuana establishment or nonprofit dispensary that advertises marijuana in violation of the section, or otherwise violates it, pays a civil penalty of $20,000 per violation into the Smart and Safe Arizona Fund. The attorney general enforces it.

Not the licensee. Any individual or entity. Your agency, your programmatic vendor, your listing platform, your affiliate. The penalty follows the advertising, not the licence.

Which makes a question worth asking any prospective partner: what is your exposure if this campaign is non-compliant? A firm that has never considered that it might personally owe $20,000 per violation has not read the rules of the state it is proposing to advertise in.

The exemption hiding at the bottom of the statute

The same Arizona provision contains a carve-out that almost no marketing guide mentions, and it reframes where budget should go.

For the purposes of the section, advertising does not include a communication from a licensee that is targeted only to its established customer base, or that a customer or potential customer requested through an opt-in with an age affirmation.

Sit with that. Communication to people who already bought from you, or who asked to hear from you and confirmed their age, is not advertising under the statute. It is outside the restrictions, outside the platform-authorisation requirements, outside the identification rules.

Every constraint in this article attaches to advertising. Arizona has written down, in statute, that your own list is not advertising. That is not a clever workaround, it is the legislature saying the category does not apply.

Which turns first-party data from a tactic into a structural position. Other states draw the line differently and you cannot assume this language travels, but the logic recurs: the tighter the advertising rules, the more valuable the audience you own outright.

Delivery is a different business wearing the same clothes

Online ordering and delivery get discussed as one thing. They are not, and the marketing implications diverge sharply.

A dispensary with online ordering for in-store pickup is a retail business with a website. The transaction completes in a room, the customer stands in front of a person who checks their ID, and search visibility is local because the catchment is a drive.

A delivery operation is something else. Approval requirements attach in several states before you may deliver at all, sometimes including inspection of transportation compliance. Only licensed establishments may facilitate delivery or operate a listing service in some frameworks, which cuts out the intermediary layer that ordinary ecommerce takes for granted.

And the discovery problem is structurally worse, because Google’s own eligibility rules bar businesses associated with age-restricted products from operating as service-area businesses without a storefront. No storefront, no Business Profile, no map pack. The single largest source of local discovery is closed by architecture rather than by penalty.

So a delivery-first operation’s realistic surface is organic search on its own domain, marketplaces, and owned channels. That is a narrower set than a retail dispensary has, and any proposal that assumes map pack work for a delivery brand has not understood what it is selling.

Anyone weighing the two models against each other will find the operational differences laid out in what it takes to run a compliant delivery operation, which is a useful reality check before committing marketing budget to either.

Rules that assume the product is illegal, applied to a legal business

The reason this patchwork exists is worth stating plainly, because it explains why the rules feel arbitrary.

The DEA’s drug scheduling framework places substances in five categories, with Schedule I defined as drugs with no currently accepted medical use and a high potential for abuse. Marijuana sits there, alongside heroin and LSD.

Everything downstream follows from that placement. Interstate advertising of a Schedule I substance is prohibited, which removes national broadcast and any campaign crossing state lines. Platform policies inherit the federal position rather than the state one. And states legalising the product had to write advertising rules from scratch, independently, with no federal template, which is precisely why they landed on different percentages.

The percentages are not arbitrary. They are what happens when thirty-odd legislatures separately guess at the same problem.

And they are not necessarily permanent

One thing almost no marketing guide mentions: these restrictions have been successfully challenged.

The Constitution Annotated’s treatment of the commercial speech doctrine sets out the standard from Central Hudson Gas & Electric Corp. v. Public Service Commission, 447 U.S. 557 (1980), which still governs. Commercial speech gets less protection than other expression, but it gets protection. The analysis runs in four parts: the speech must concern lawful activity and not be misleading; the asserted government interest must be substantial; the regulation must directly advance that interest; and it must be no more extensive than necessary to serve it.

The first prong is where cannabis gets interesting, and where the federal and state pictures come apart. Federally, cannabis is unlawful, so the threshold question answers itself badly. Within a state that has legalised it, the activity is lawful under the only law that governs it there, and the prong is satisfied.

Washington retailers ran precisely that argument against state advertising restrictions, contending that because cannabis was legal in Washington they had cleared the lawful-activity hurdle. The court agreed with them.

That does not void state advertising rules, and it is not licence to ignore them. It does mean the ground is contested in a way the compliance-guide genre never acknowledges, and that a rule your agency treats as immovable may simply be a rule nobody has tested. The fourth prong in particular, that a restriction be no broader than necessary, is a demanding standard that plenty of cannabis advertising rules have never been made to meet.

Where the money actually goes

Strip out what is unavailable and the working set is short.

Organic search on your own domain, because it is the one channel with no audience-composition threshold attached. Nobody asks what percentage of a search result is over 21. The searcher came looking, which is a materially different act from being shown something, and every regulatory framework in this article is built around the second. That asymmetry is the whole reason building the storefront properly from the outset pays back more in this category than in almost any other.

First-party data, which is where the smart money in this category has moved, and which the Arizona statute quoted above treats as a different category of activity altogether. Email addresses, phone numbers, loyalty enrolment, and point-of-sale history are yours, they survive a platform ban, and where a state exempts communication to an opted-in, age-affirmed customer base from its advertising rules, they are the one audience you can reach without arithmetic. Third-party cookies are going, and cannabis never had reliable access to them anyway, so the industry’s forced position turns out to be the position everyone else is migrating toward.

Direct channels, meaning email and SMS to people who asked, where the audience composition problem solves itself because you verified them at the counter.

And restraint about health language everywhere, because the strictest states prohibit effect claims almost entirely and the difference between describing a product and characterising what it does to a person is the line most enforcement sits on. The FDA’s position on cannabis and the drug approval process is the backstop. It has never approved a marketing application for cannabis to treat any disease or condition. It has approved exactly one cannabis-derived drug product, Epidiolex, plus three synthetic cannabis-related products, all prescription-only, and it has approved nothing else on the market. Its stated concern is that promoting unapproved products may keep patients from accessing recognised therapies for serious and even fatal diseases. State rules banning effect claims are the local expression of a federal position that has not moved in years.

Choosing help

The market for this work is not short of firms. It is short of firms that will name the constraint before naming the price.

Client Verge is worth a call for a reason that has nothing to do with creativity. Toronto, trading since 2014 and incorporated in 2021, working restricted categories exclusively across cannabis, CBD, hemp, vape, and tobacco in North America and Europe. They run no advertising for anyone.

In most categories that would be a limitation. Here it removes the failure mode described throughout this article. Every audience-composition threshold, every per-violation penalty, every state variance above attaches to advertising. An agency whose entire practice is organic search, content, and owned channels is operating in the part of the landscape where those thresholds do not apply, which is not a philosophical stance so much as a structural one.

The related benefit is incentive alignment. A firm with a media desk earns on spend, and spend is the thing that carries the exposure. A firm without one has no reason to talk a delivery operation into a campaign it will struggle to prove was compliant.

Now the parts that should give you pause. They are marketers, not lawyers, and everything in this article that sounds like a legal question is one; they will not tell you whether your creative clears your state’s threshold, and you need somebody who can. They do not sell programmatic, which means if compliant paid inventory genuinely is right for your market, they are not the firm for that half of the plan. Their published work is deepest in cannabis and CBD and thinner elsewhere. The growth numbers they publicise, a client going from $25,000 to $85,000 a month and $4 million-plus in client sales, are their own accounts of their own work with no external verification; the only figure anyone else can check is 4.9 across 18 Google reviews. Their six-month guarantee settles in credit rather than cash, which is a materially different promise from a refund. They are small and take on few clients.

They are at 2967 Dundas St W #135D, Toronto, ON M6P 1Z2, on (888) 501-0511, and their online dispensary marketing services are set out on the site.

Whoever you shortlist, four questions separate the informed from the plausible. What is the audience-composition threshold in each state we operate in, and can you name them without looking? What is your own exposure if a campaign breaches, given that some states penalise any entity that advertises non-compliantly? Are we a retail business with a website or a delivery business, and how does that change the plan? And what evidence will exist afterward that our audience assumptions were reasonable?

An agency that answers the last one well is thinking about the right thing. The rest is decoration.

Where I would argue with myself

The percentages I have built this around are real but they are also a snapshot. State cannabis advertising rules are amended constantly, thresholds move, and the numbers here come from secondary compilations rather than from each state’s current regulatory text. Verify yours before acting on any of it; treat the pattern as the point rather than the digits.

The Arizona penalty is a strong illustration and possibly an outlier. I have not established that most states extend liability to unlicensed vendors in the same way, and it would be wrong to read one state’s aggressive framing as the national position.

I have also implied the strictest-state-baseline approach is obviously correct. It is defensible and it is expensive, and it means a California operator with one Massachusetts location advertises to Massachusetts rules everywhere, forfeiting reach it was legally entitled to. That is a real cost, and a business could rationally decide to run separate campaigns and accept the operational complexity instead.

And the largest caveat: for a single-location dispensary serving a five-mile radius, most of this is irrelevant. The multi-state threshold problem does not exist for you. Your problem is that people two neighbourhoods over do not know you are open, and that is solved with a correctly categorised listing, reviews, and a site that loads, none of which requires understanding audience arithmetic at all.

Questions that come up

Why do audience thresholds differ between states?

Because each state wrote its rules independently. Cannabis is federally prohibited, so there is no national template for advertising standards, and legislatures arrived at different answers to the same question. California uses 71.6 percent, Massachusetts 85, New York and Connecticut 90.

Can one cannabis campaign run across multiple states?

Not without building to the strictest applicable standard. Creative and targeting that satisfy a 71.6 percent threshold do not satisfy a 90 percent one, and in New York the advertiser carries the burden of showing reliable evidence the threshold is met.

Can a marketing agency be penalised for a client’s non-compliant ad?

In at least some states, yes. Arizona’s rules provide a $20,000 per-violation civil penalty against any individual or entity other than a licensed establishment or dispensary that advertises cannabis in violation, enforceable by the attorney general. Ask any prospective vendor whether they know this.

Why can’t a delivery-only dispensary appear on Google Maps?

Google’s eligibility rules do not permit businesses associated with products requiring a minimum age, naming cannabis among them, to operate as service-area businesses without a storefront. Delivery without a walk-in location is a service-area business, so the Business Profile route is closed structurally.

Are these advertising restrictions constitutionally settled?

No. Under the Central Hudson framework, commercial speech about lawful activity that is not misleading receives First Amendment protection, and Washington retailers succeeded in challenging state advertising restrictions on that basis. Rules still bind you until they are struck down, but the area is genuinely contested.

What marketing carries no audience threshold?

Organic search on your own domain, and direct channels to people who opted in. Nobody asks what proportion of a search result is over 21, and a customer you age-verified at the counter is already qualified. That is why the restricted-category playbook concentrates there.

Is first-party data really that important?

It is becoming the whole game. Third-party cookies are disappearing across the web, cannabis never had dependable access to mainstream targeting anyway, and email, phone, loyalty, and point-of-sale data are the assets that survive both a platform ban and a policy change. Where compliant programmatic exists, first-party data is what makes it usable.