Cannabis has no federal legal market, so every ID-checking rule for dispensaries comes from state law. Here's how California and Colorado handle the door-and-register check, and why states like Michigan specifically limit what a dispensary can keep from your ID afterward.
Educational guide, not legal advice — see the disclaimer below. Last reviewed August 2026.
Recreational, adult-use cannabis — the kind sold at the dispensaries this page covers — is still a Schedule I controlled substance under the federal Controlled Substances Act. (In April 2026 the Justice Department moved FDA-approved cannabis drug products and marijuana sold under a state medical marijuana license to Schedule III; adult-use cannabis was explicitly excluded from that order and remains Schedule I, with a broader rescheduling hearing still pending as of mid-2026.) Unlike alcohol or tobacco, there's no federally legal adult-use cannabis market and no federal age-verification regulation for it — nothing like the FDA's Tobacco 21 rule exists here. Every requirement a dispensary follows — the minimum age, whether a scan is required, what a receipt has to show, what can be kept afterward — comes entirely from the state cannabis regulator: the Department of Cannabis Control in California, the Marijuana Enforcement Division in Colorado, the Cannabis Regulatory Agency in Michigan, and equivalent agencies elsewhere.
What every adult-use state agrees on, without exception, is the age floor itself.
California's Business and Professions Code § 26140 requires that before a sale, the buyer "first presents documentation that reasonably appears to be a valid government-issued identification card showing that the person is 21 years of age or older." Colorado's marijuana rules set the same 21-and-over floor for retail sales. Medical-only dispensaries in states that still run separate medical programs may admit patients as young as 18 with a valid medical card — that's a state-by-state exception, not the adult-use default.
Colorado is the clearest example of a pattern that shows up, in substance, across adult-use states: ID gets checked once to get onto the sales floor, and again before the product changes hands.
Colorado's marijuana rules require a licensee to verify a valid government-issued photo ID showing 21 or older before letting anyone into the restricted access area — the sales floor itself. California reaches the same result through its own premises-access rule: an adult-use-only retailer can't let anyone under 21 onto the licensed premises at all.
1 CCR 212-3, Rule 6-110(B); Cal. Code Regs. tit. 4, § 15400A second, independent check happens right before the transaction: Colorado requires verifying the purchaser's ID again before initiating the transfer of product. California's statute requires the same ID presentation "before" the sale is made, separate from the premises-access rule that governs who gets in the door.
1 CCR 212-3, Rule 6-110(B); Cal. Bus. & Prof. Code § 26140The practical effect is the same in both states even though the rules are structured differently: one ID check controls who's allowed on the floor, and a separate check controls who's allowed to actually buy.
This is where cannabis retail diverges from most other age-restricted categories, and it's the reason dispensary customers tend to be more privacy-conscious about a scan than, say, a bar patron. A handful of states have gone out of their way to limit what a dispensary — or its regulator — can require beyond the age check itself.
Michigan's Regulation and Taxation of Marihuana Act is explicit about it. MCL § 333.27958(3)(b) bars the state's Cannabis Regulatory Agency from adopting any rule that would require a retailer to make a customer provide identifying information beyond what's needed to determine age, or that would require the retailer to "acquire or record personal information about customers other than information typically required in a retail transaction." The state itself can't mandate a customer database — it can only require what an ordinary retail sale would already involve.
California takes a different angle on the same concern. Business and Professions Code § 26161.5 bars a licensee from disclosing a consumer's personal information to third parties without consent, except as necessary to determine and collect payment — with an explicit note that this protection is stronger than the general California privacy statute it's modeled on, because that broader statute doesn't apply to cannabis licensees on its own.
Neither law says a dispensary can't check your ID — both are squarely fine with that. What they push back on is turning the check into a permanent record of who you are. That's precisely the gap Check ID's architecture is built around: the app verifies the ID and logs that the check happened, but it doesn't retain the name, photo, date of birth, or ID number anywhere on its servers. There's no customer database to build in the first place, in a vertical where more than one state regulator has specifically said there shouldn't be one.
Check ID doesn't detect fake IDs, and it isn't a certification of legal compliance — no app can promise either of those. What it does is make the two-step door-and-register check easy to run consistently, without building the customer database that states like Michigan and California specifically discourage:
Barcode, mobile driver's license, or passport/national ID via NFC — fast enough to run as a real second check at the point of sale, not just a glance at the entrance.
The date of birth encoded on the ID is checked against a 21 (or custom) cutoff — no manual math, no eyeballing a stranger's face.
Team accounts keep a record of every check — time, result, staff member — without storing the customer's name, photo, or date of birth on Check ID's servers. Documentation that can support a good-faith compliance record, without a customer-identity database sitting behind it.
Generate a Verification Activity Report (PDF or CSV) with a hosted, shareable copy that a regulator, landlord, or insurer can independently verify at checkidapp.com/verify.
21, at every adult-use dispensary. Cannabis is still a Schedule I substance under the federal Controlled Substances Act, so there's no federal legal market and no federal minimum age — the 21-and-over rule comes entirely from state adult-use law. California's Business and Professions Code 26140 requires a government-issued ID showing the buyer is 21 or older before a sale, and 4 CCR 15400 limits entry to adult-use-only premises to people 21 and up. Colorado's marijuana rules set the same floor. Medical-only dispensaries in some states allow patients as young as 18 with a valid medical card.
In Colorado, both, explicitly. 1 CCR 212-3, Rule 6-110(B) requires a licensee to verify a valid government-issued photo ID showing the person is 21 or older on two separate occasions: once before letting them into the restricted access area (the sales floor), and again before completing the sale. California reaches a similar result through two separate rules — 4 CCR 15400 restricts who can enter the premises by age, and Business and Professions Code 26140 requires ID at the point of sale — so a door check and a register check both end up required in practice.
It depends on the state, and several restrict it. Under Michigan's Regulation and Taxation of Marihuana Act, MCL 333.27958(3)(b), the state's cannabis regulator is barred from making any rule that requires a retailer to collect identifying information beyond what's needed for age verification, or to record personal information about customers beyond what's typical in an ordinary retail transaction. California's Business and Professions Code 26161.5 separately bars a cannabis licensee from disclosing a customer's personal information to third parties without consent, except as needed to process payment. Neither law bans a dispensary from checking your ID — they limit what can be demanded, retained, or shared afterward.
Where a state issues one and a venue's scanner supports it, yes — a mobile driver's license in Apple Wallet carries the same date-of-birth and ID-status data as the physical card. Acceptance varies by state and by dispensary, so it's worth carrying a physical ID as a backup. Check ID reads both the AAMVA barcode on a physical license and a mobile driver's license via NFC.
No, not for the adult-use sales this page covers. Recreational cannabis remains a Schedule I controlled substance under the federal Controlled Substances Act — a partial April 2026 rescheduling order moved only FDA-approved cannabis drug products and state-licensed medical marijuana to Schedule III, leaving adult-use cannabis where it was — so there's still no FDA- or ATF-style federal rulebook for dispensaries the way there is for tobacco or alcohol. Every rule about who has to check ID, when, and what can be retained afterward comes from the state cannabis regulator — the Department of Cannabis Control in California, the Marijuana Enforcement Division in Colorado, the Cannabis Regulatory Agency in Michigan, and their counterparts elsewhere. Requirements can differ meaningfully between states.
No state cannabis law says a scanner eliminates liability for an underage sale. What a scan log can do is document that a check happened — the time, the result, and which staff member ran it — which is documentation that can support a good-faith compliance record if a regulator or licensing board ever asks. Whether that record helps in a specific enforcement matter is a question for the dispensary's attorney, not something a scanning app can decide.
Check ID scans a customer's ID at the door or the register and keeps a no-PII log your dispensary can produce on request.