01
Communications law
Federal and state communications rules may govern consent, telemarketing, automated messages, revocation, do-not-contact obligations, customer rights, timing, and records.
Table of Contents
- What is cannabis SMS compliance?
- Compliance includes four separate rule systems.
- A practical dispensary texting compliance framework.
- A customer phone number is not automatically SMS consent.
- 10DLC establishes sender identity and messaging use case.
- Age controls must continue beyond the signup form.
- Review the audience, message, offer, and destination together.
- Opt-outs should be enforced across the entire customer account.
- Compliance safeguards built around dispensary messaging.
- Cannabis SMS compliance FAQ
- Compliance starts before the customer enters the audience.
The direct answer
Cannabis SMS compliance is the operating system a dispensary uses to obtain and document permission, verify customer eligibility, register its messaging traffic, review campaign content, honor opt-outs, maintain records, and monitor every message program.
Dispensary texting compliance is not created by one disclaimer, age gate, registration approval, or STOP line. The consent, sender, customer, message type, cannabis offer, linked page, carrier route, store location, and operational workflow must work together.
Permission
Consent should support the sender and type of message being delivered
Eligibility
Age, location, customer state, store, and jurisdiction must be evaluated
Infrastructure
The sender and use case should use registered, supported messaging routes
Operations
Opt-outs, approvals, records, replies, complaints, and delivery must be managed
Legal disclaimer
Blackleaf provides messaging tools and operational safeguards, not legal advice. Cannabis, advertising, privacy, and communications requirements vary by jurisdiction, customer, license type, message, and campaign. Work with qualified counsel to determine which requirements apply to your organization.
01
Definition
What is cannabis SMS compliance?
Compliance governs the customer journey from the original signup through every campaign, automation, reply, opt-out, and future message.
Cannabis SMS compliance is the coordinated process used to determine who may receive a message, what may be sent, which sender and route may deliver it, and how the business proves that the program operated correctly.
It includes customer consent, TCPA analysis, state cannabis advertising requirements, age and audience controls, sender identification, 10DLC or other route registration, carrier policy, platform requirements, STOP and HELP handling, privacy, campaign approval, and recordkeeping.
Compliance should be evaluated before the audience is imported or the message is written. Adding required language at the end cannot repair an audience that was never eligible to receive the campaign.
Working definition
Dispensary texting compliance is a documented operating framework that connects consent, customer eligibility, sender registration, campaign content, cannabis advertising rules, opt-out enforcement, internal approval, carrier requirements, and reporting.
02
Four layers
Compliance includes four separate rule systems.
A campaign may satisfy one layer and still fail another.
02
Cannabis advertising law
State and local cannabis rules may govern customer age, audience composition, warnings, products, offers, license identification, geographic scope, claims, and youth appeal.
03
Carrier requirements
Carriers and messaging ecosystem participants may evaluate registration, sender identity, consent evidence, opt-outs, complaints, reputation, volume, links, content, and traffic patterns.
04
Platform policy
A messaging provider may impose stricter requirements than the law or decline to support cannabis traffic entirely. A licensed business is not automatically permitted on every platform.
Registration is not legal approval.
Registering a sender or campaign does not determine whether the customer consent, cannabis offer, age control, linked page, advertising content, or business practice complies with every applicable law.
03
Compliance framework
A practical dispensary texting compliance framework.
Apply this sequence to every campaign, automation, customer list, store, integration, and new messaging use case.
Step 01
Identify the sender and jurisdictions
Determine which licensed entity, brand, store, or program is sending and where the business, store, and recipients are located.
Step 02
Classify the message
Decide whether the communication is promotional, transactional, conversational, lifecycle marketing, internal, or mixed.
Step 03
Verify consent and eligibility
Confirm that the customer record supports the sender, message type, frequency, automation, age requirement, store, and jurisdiction.
Step 04
Confirm the messaging route
Use a registered and supported 10DLC, toll-free, short-code, or other messaging route that permits the business and declared use case.
Step 05
Review the message and destination
Evaluate sender identification, offer terms, warnings, claims, products, images, links, age controls, geographic implications, and landing-page content.
Step 06
Apply suppression and frequency controls
Exclude opted-out customers, recent purchasers where appropriate, wrong-store customers, ineligible customers, complaints, open service issues, and overlapping workflows.
Step 07
Document approval and store readiness
Record who approved the audience, message, offer, schedule, inventory, customer-service ownership, redemption process, and final launch.
Step 08
Monitor and preserve records
Review delivery, filtering, replies, opt-outs, complaints, customer issues, purchase outcomes, and the records needed to explain what occurred.
04
Consent
A customer phone number is not automatically SMS consent.
The customer action and disclosure should support the messages the dispensary intends to send.
What the customer should understand
- The dispensary, brand, or program that will send
- The types of messages the customer may receive
- Whether messages are recurring or automated
- Expected or variable message frequency
- How the customer can obtain help
- How the customer can stop future messages
- Where applicable terms and privacy information are located
- Whether consent is required as a condition of purchase
What the dispensary should be able to prove
- The customer’s phone number
- The date and time of the opt-in
- The signup source, form, keyword, store, or transaction
- The disclosure presented to the customer
- The sender and program covered by the permission
- The applicable terms and privacy version
- Age affirmation or verification information where appropriate
- Later opt-out, suppression, or re-opt-in activity
Loyalty enrollment and promotional SMS permission are not automatically identical.
A customer may join a rewards program, provide a phone number for an order, or create an ecommerce account without knowingly agreeing to recurring promotional messages.
05
Registration
10DLC establishes sender identity and messaging use case.
Registration should describe the real business, customer relationship, opt-in flow, traffic type, message samples, and destinations.
| Registration element | What it should represent | Common problem |
|---|---|---|
| Business identity | The legal business, tax information, address, website, contacts, and operating brand. | Registration information does not match the actual sender or licensed operator. |
| Campaign use case | The promotional, transactional, customer-care, mixed, or other traffic that will be sent. | The live traffic is materially different from the campaign that was registered. |
| Opt-in flow | The actual form, keyword, POS process, disclosure, confirmation, terms, and privacy experience. | A compliant sample is submitted while customers are collected through another process. |
| Message samples | Representative sender identification, cannabis context, links, frequency, HELP, and opt-out behavior. | Samples avoid the language, links, industry, or offer style used in production. |
| Assigned numbers | The sending numbers associated with the approved brand and campaign. | Traffic is sent through an unassociated, unsupported, or incorrectly configured sender. |
| Live traffic | Content, volume, links, audience, and behavior consistent with the approved program. | The route changes from order updates to full-list promotions without proper alignment. |
10DLC does not replace TCPA or state cannabis advertising review.
Registration is one part of the carrier and sender-identity framework. Customer consent, age eligibility, cannabis content, offers, linked pages, opt-outs, and legal requirements still need separate review.
06
Age and audience
Age controls must continue beyond the signup form.
The appropriate control depends on the jurisdiction, license type, medical or adult-use program, customer, and destination.
Confirm eligibility before enrollment
Apply the approved age-affirmation or verification method before adding a customer to cannabis promotional messaging where required.
Preserve the method and result
Retain the relevant date, source, method, result, and program context without collecting more sensitive information than necessary.
Protect linked campaign content
Review offer pages, menus, product pages, loyalty destinations, review flows, and other pages reached from the message.
Do not assume one universal threshold
Medical and adult-use programs may have different customer eligibility requirements depending on the jurisdiction.
Match the customer to an eligible location
Exclude customers who cannot legally or practically use the promoted store, delivery zone, offer, product, or program.
Understand the difference
A customer clicking an age-confirmation button is not the same as verifying identity or age using stronger evidence.
07
Campaign review
Review the audience, message, offer, and destination together.
A clean SMS body does not repair a prohibited offer or noncompliant landing page.
| Review area | Questions to answer before launch |
|---|---|
| Sender identity | Will the customer clearly recognize the dispensary, brand, store, or program responsible for the message? |
| Audience | Does every recipient have appropriate consent, age eligibility, store relevance, jurisdiction, and campaign qualification? |
| Offer | Are the benefit, expiration, inventory, exclusions, redemption rules, pricing, and customer eligibility accurate? |
| Cannabis content | Are products, warnings, claims, youth-appeal rules, license information, and advertising restrictions addressed? |
| Links | Does the domain match the sender, avoid unnecessary redirects, use the correct store, and lead to approved content? |
| Timing and frequency | Is the send appropriate for the customer’s local time and recent communication history? |
| Store readiness | Are inventory, staffing, fulfillment, employee instructions, customer support, and redemption procedures ready? |
| Opt-out and replies | Will STOP, reasonable revocation language, HELP, complaints, and customer questions be handled correctly? |
Carrier-safe language is not the same as legal compliance.
Carriers may still filter lawful messages, and a delivered message may still violate a legal, cannabis, privacy, consent, or advertising requirement.
08
Enforcement and records
Opt-outs should be enforced across the entire customer account.
Customers should not need to know which campaign, automation, store, list, or integration produced the message.
Honor the customer’s intent
- Support standard opt-out keywords
- Recognize reasonable plain-language requests
- Suppress future covered messaging promptly
- Apply suppression across campaigns and automations
- Keep confirmation messages non-promotional
- Require a new affirmative action before re-opt-in
- Provide a working HELP or support response
Preserve what occurred
- Consent source, disclosure, date, and time
- Age-control method and result where applicable
- Campaign audience and suppression rules
- Final message, image, link, and landing page
- Approval, schedule, estimate, and sender
- Delivery, replies, filtering, and opt-outs
- Complaints, escalation, and resolution
Define record-retention periods with counsel.
Appropriate periods may depend on communications law, state law, privacy requirements, provider agreements, license obligations, litigation risk, and the organization’s internal policy.
09
Blackleaf
Compliance safeguards built around dispensary messaging.
Blackleaf helps teams operationalize the controls that generic messaging platforms often leave disconnected.
Organize business identity, campaign use case, customer opt-in, representative samples, links, and sending-number setup.
Build messaging audiences using documented customer permission, store data, customer behavior, purchase activity, and approved segmentation.
Suppress opted-out customers and prevent covered campaigns and automations from continuing after consent is withdrawn.
Route appropriate campaign details to branded landing pages with configurable age controls and campaign information.
Review audiences, schedules, estimates, message content, links, and campaign configuration before launch.
Monitor sending results, filtering signals, opt-outs, replies, clicks, customer activity, and campaign performance.
Software cannot replace legal and operational judgment.
Blackleaf can enforce configured safeguards and provide clearer workflows, but the dispensary remains responsible for its customers, offers, store operations, legal requirements, campaign approvals, and business decisions.
10
FAQ
Cannabis SMS compliance FAQ
What is cannabis SMS compliance?
Cannabis SMS compliance is the coordinated process of managing customer consent, age and audience eligibility, sender registration, message content, cannabis advertising requirements, opt-outs, carrier policies, platform rules, internal approval, and records.
Can dispensaries legally send text messages?
Yes, when the dispensary has appropriate permission, uses a supported messaging route, honors customer opt-outs, and follows the communications, cannabis, advertising, privacy, age, and carrier requirements that apply.
Does joining a dispensary loyalty program provide SMS consent?
Not automatically. The customer action and disclosure should clearly explain whether loyalty enrollment also includes recurring promotional text messages.
Does a dispensary need 10DLC registration?
Business texting sent through ten-digit long-code routes commonly requires brand and campaign registration. Other sender types may have their own verification and registration requirements.
Does 10DLC make a cannabis campaign compliant?
No. Registration addresses sender identity and messaging use case. Consent, age controls, cannabis advertising, privacy, offers, opt-outs, and legal review remain separate.
What happens when a customer replies STOP?
The customer should be suppressed from future covered messages, and the suppression should apply across campaigns, automations, stores, lists, employee tools, and connected systems using that permission.
Do dispensary texts need age verification?
The correct age control depends on the jurisdiction, license, adult-use or medical program, customer, message, signup method, and linked destination. A basic age gate is not the same as stronger age verification.
Why are compliant cannabis text messages still blocked?
Legal compliance does not guarantee carrier delivery. Messages may be filtered because of unsupported routes, registration, complaints, sender reputation, traffic volume, links, content patterns, or platform policy.
Can a dispensary add a promotion to an order-ready message?
Adding unrelated promotional content can change how the message is classified and may require different consent, registration, review, and frequency controls.
What consent records should dispensaries keep?
Preserve the phone number, sender, disclosure, source, date, time, terms, privacy version, age-control result where appropriate, confirmation, and later opt-out or re-opt-in activity.
Is Blackleaf a substitute for legal counsel?
No. Blackleaf provides messaging infrastructure and compliance safeguards. Qualified counsel should determine how federal, state, local, cannabis, privacy, and advertising requirements apply to the dispensary.
How should a dispensary audit its SMS compliance?
Review customer consent, age eligibility, sender registration, use-case alignment, message classification, offers, linked pages, opt-outs, customer-level frequency, campaign approvals, delivery, complaints, and stored evidence.
Build compliance into every send
Compliance starts before the customer enters the audience.
Document permission, verify eligibility, register the sender, classify the message, review the campaign and destination, apply suppression, confirm store readiness, and preserve the final record.