Walk into a licensed dispensary and someone will check your ID before you see a menu. That much is universal. What happens next - whether a clerk glances at your card or a scanner pulls data off the barcode and files it away - depends entirely on which state you're standing in, and that gap matters more than most shoppers realize.
Why the ID Check Isn't Optional
Age verification is a licensing condition, not a courtesy. Every US adult-use state sets the purchase age at 21; Canada mostly uses 19, with Alberta at 18 and Quebec at 21. Regulators treat this as non-negotiable. California's Department of Cannabis Control (4 CCR § 15404) requires retailers to confirm age and identity before a sale. Massachusetts rules (935 CMR 500.140) say ID must be "immediately" inspected, and nobody gets past the door until age is verified. Colorado's Marijuana Enforcement Division Rule 3-405 requires a refused sale if the ID is invalid or expired. A dispensary that skips this step isn't cutting a corner - it's putting its license on the table.
ID checks also enforce daily purchase limits, which are set by the state where the sale happens, not the buyer's home state. That's a detail multi-state operators have to train staff on constantly, since a visitor from a tighter-limit state can still buy up to the local cap.
Scan or Inspect? The State-by-State Split
Illinois and Nevada require electronic scanning, full stop. Illinois law (410 ILCS 705/10-20) mandates an "electronic reader or electronic scanning device" for every sale. Nevada's Cannabis Compliance Board guidance extends that requirement to delivery, curbside and drive-through orders, with a manual backup checklist if the scanner fails. California and Colorado take a lighter approach: staff must inspect a valid ID, but no scanner is required. Colorado's Rule 3-405 only references scanners as one way a store can demonstrate good-faith effort if a minor slips through with a fake.
Here's the catch for operators: many stores scan anyway, even where it's not required, because a scanner catches security features and expired barcodes faster than a bored cashier at the end of a shift. That's a legitimate loss-prevention and compliance argument. But it also means a shopper in a "look only" state might still get scanned - which is the store's internal policy, not a legal mandate, and a fair moment to ask what the software actually retains.
What the Data Rules Actually Say
A driver's license barcode holds everything printed on the card: name, birthdate, address, license number, physical description. The real compliance question is what the point-of-sale or scanning software does with that after the sale closes. State approaches fall into roughly three buckets:
- Minimal retention: Oregon (ORS 475C.221) bars retailers from recording identifying information beyond what's needed for delivery, and bars transferring it to anyone else.
- Consent-based retention: Massachusetts and Illinois allow stores to keep more only with the customer's voluntary agreement, typically through loyalty program sign-up.
- Sharing restrictions over storage limits: California's Business and Professions Code § 26161.5 bars disclosing personal information to third parties without consent, though POS vendors are exempt if they don't reuse or retain the data themselves.
Software vendors sit in an odd spot here. A scanning platform processes sensitive identity data at scale across thousands of transactions, and a breach doesn't stay contained to one retailer. In January 2020, researchers found an unsecured cloud storage bucket tied to THSuite, a dispensary POS vendor; Security Magazine reported it exposed tens of thousands of files, including scanned IDs. That incident is a useful reminder for operators: data never collected can't be the subject of a breach notification letter. Contracts with POS and scanning vendors should spell out retention periods, encryption standards and deletion practices, not just transaction features.
What Operators and Shoppers Should Each Take Away
For dispensary operators, the compliance obligation is straightforward - know your state's scanning mandate, if one exists, and make sure loyalty program consent language matches what the law actually requires before you collect a phone number or purchase history. For software vendors, the exposure is bigger than one retailer's license; a weak data policy embedded in a scanning platform becomes every client's liability. For shoppers, a valid, unexpired government photo ID works almost everywhere, military IDs are broadly accepted, and expired cards are refused in most jurisdictions (Nevada allows a narrow exception with a second ID). Canada follows a similar logic but leans more protective: the Office of the Privacy Commissioner noted in 2018 that stores may check ID but aren't required to record it.
None of this is abstract for the industry. As more states review their cannabis retail frameworks, ID handling sits at the intersection of consumer protection, data security and licensing compliance - three areas regulators are watching closely, and three areas operators can't afford to treat as an afterthought.
