Industry guide
Dispensary ID verification: the 21-and-over rule, and the privacy rules layered on top
By Apparent Logic, LLC · Updated October 5, 2026
Legal sources last checked September 2026 · How we review sources
General information, not legal advice. Laws and permit conditions vary; ask your lawyer or regulator what applies. Check ID is a tool for your staff, not a guarantee of compliance or a legal defense. No system can catch every fake ID. Staff must inspect the document and its holder and make the final decision.
For adult-use cannabis dispensaries and their customers in California, Colorado and Michigan. As of September 2026, adult-use cannabis is still in Schedule I under federal law (91 FR 22714), so the 21-and-over rule comes from state law, and local rules can add more.
At a glance
- In California, Colorado and Michigan, adult-use buyers must be 21 or older and show a government-issued photo ID (Cal. 4 CCR § 15404; Colo. 1 CCR 212-3, Rule 6-110(B); Mich. Admin. Code R 420.505(1)(c)).
- Colorado’s rules call for an ID check before a customer enters the sales area and another before the sale starts (Rule 6-110(B)).
- Michigan limits what its cannabis regulator can require dispensaries to collect or record (MCL 333.27958(3)(b)). California limits what a licensee can share with third parties without the customer’s consent (Bus. & Prof. Code § 26161.5).
What the law says
Federal law
An order effective April 28, 2026 moved FDA-approved drug products containing marijuana, and marijuana covered by a state medical marijuana license, to Schedule III (91 FR 22714). Unlike tobacco, which has a federal ID-check rule for retailers (21 CFR 1140.14), adult-use cannabis has no federal age-verification rule.
California
An adult-use licensee may not sell unless the buyer “first presents documentation that reasonably appears to be a valid government-issued identification card showing that the person is 21 years of age or older” (Bus. & Prof. Code § 26140(a)(4)). The Department of Cannabis Control’s rules limit adult-use-only premises to people 21 and older (4 CCR § 15400(a)). Staff must confirm a customer’s age and identity before letting them into the retail area (§ 15402(a)) and before an adult-use sale (§ 15404(a)). Unlike Colorado’s, these rules don’t say the checks must happen on separate occasions. A medical licensee may sell to people 18 and older with a government ID plus a county medical card or a doctor’s recommendation (Bus. & Prof. Code § 26140(c)).
A licensee may not share a customer’s personal information with a third party without the customer’s consent, except as needed for payment. The section doesn’t bar disclosure to the State of California or a city or county “to perform official duties” under the state’s cannabis law or a local ordinance (Bus. & Prof. Code § 26161.5(a)).
Colorado
Colorado’s rules bar retail marijuana sales to anyone under 21 (1 CCR 212-3, Rule 6-110(A)). Rule 6-110(B) says “Licensees must verify on two separate occasions that a Person is 21 years of age or older”: before the person enters the Restricted Access Area, and before starting the sale.
Michigan
Michigan’s sales rule calls for a government-issued photo ID showing the buyer is 21 or older (Mich. Admin. Code R 420.505(1)(c)). The state’s cannabis law says the Cannabis Regulatory Agency may not adopt a rule requiring customers to give identifying information beyond ID to determine age, or requiring retailers to “acquire or record personal information about customers other than information typically required in a retail transaction” (MCL 333.27958(3)(b)). The limit applies to rules the agency writes.
What it means at the counter
California’s rules speak of confirming identity “by inspecting a valid form of identification.” A barcode scan reads the data encoded on a card, not the front of the card or the person holding it.
Where Check ID fits
On iPhone and iPad, Check ID reads the barcode on US and Canadian driver’s licenses and ID cards, compares the birth and expiry dates with your rules, such as a minimum age of 21, and shows a clear result, such as Verified, Underage or Expired ID. Your staff make the call. It can’t tell whether a card is genuine: a well-made fake can carry a valid barcode.
A scan record never keeps the name, date of birth, address, ID number or a picture of the ID. It keeps the result, the age in whole years, the issuing state or country and document type, and when and how the ID was scanned. Personal scan history covers 7 days on your device or in your own iCloud. Check ID for Teams also records the venue, the device and which staff member ran each check, and keeps records for two years by default; the owner can choose from 30 days to about ten years. Security & data sets out what each plan keeps, including repeat-entry codes and guest lists. Whether any of this suits your situation is a question for your lawyer or regulator.
Frequently asked questions
Do dispensaries have to check ID at the door, or just at checkout?
It depends on the state. Colorado’s rules require a check before a customer enters the sales area and another before the sale starts (1 CCR 212-3, Rule 6-110(B)). California’s require confirming age and identity at both points, without saying whether one check can cover both (4 CCR §§ 15402(a), 15404(a)).
Can a dispensary keep a copy of my ID or scan data?
The cannabis laws in this guide don’t directly say. Michigan’s limits what its regulator can require dispensaries to collect or record (MCL 333.27958(3)(b)). California’s limits what a licensee can share with third parties (Bus. & Prof. Code § 26161.5). Separately, California’s ID-scanning law says a business that scans a California DMV license or ID card may not keep or use that information except for the purposes it lists (Civ. Code § 1798.90.1(a)(3); see our California guide). None of these laws bans a dispensary from checking ID.
Does a mobile driver’s license work at a dispensary?
It depends on the state’s rules and the store. Colorado’s rules accept a valid and verified digital ID (1 CCR 212-3, Rule 3-405(C)). California’s list of acceptable IDs doesn’t mention digital IDs (4 CCR § 15404(c)).
Does an ID scanner protect a dispensary if it sells to a minor?
No app can promise that, and Check ID isn’t insurance. Colorado says a sale to a minor who shows a fraudulent ID isn’t grounds to suspend or revoke the store’s license if the store shows that the fake was one of the ID types the rules accept and that, during that sale, staff inspected the ID, compared it to the person, and also used an ID book issued within the past three years, an electronic scanner, ID-checking software or another device for inspecting IDs, or other ID security features (C.R.S. 44-10-601(3)(b)(I); 1 CCR 212-3, Rule 3-405(B)(1)). A scan alone doesn’t meet that test. Whether a record helps in a given case is a question for your attorney.
Sources
- Cal. Bus. & Prof. Code § 26140 and § 26161.5, and Cal. Civ. Code § 1798.90.1, retrieved September 2026.
- California Department of Cannabis Control regulations, 4 CCR §§ 15400–15404, retrieved September 2026.
- 1 CCR 212-3, Colorado Marijuana Rules (Rules 3-405 and 6-110) and C.R.S. 44-10-601 (2026 edition), retrieved September 2026.
- Mich. Comp. Laws § 333.27958 and Mich. Admin. Code R 420.505, retrieved September 2026.
- U.S. Department of Justice final order, 91 FR 22714 (April 28, 2026), and 21 CFR 1140.14, retrieved September 2026.