If you sell CBD gummies in Texas and hemp beverages in New York, you don’t get to print one label and ship it everywhere. Federal law sets a floor for what a hemp or CBD label must say, but each state layers on its own rules for THC limits, warning statements, QR codes, and child-resistant packaging — and getting it wrong can mean a product pulled from shelves.
This guide walks through the federal baseline every hemp-derived product needs, the areas where states diverge the most, and the mistakes that trip up brands moving into new markets.
Quick Answer
Every hemp-derived CBD product needs a federal-baseline label (product identity, net quantity, ingredients, cannabinoid content, responsible party name/address, batch number). On top of that, most states add their own requirements — commonly a QR code linking to a Certificate of Analysis (COA), specific warning language, THC potency limits, and child-resistant packaging for anything that looks like food or candy. There is no single national CBD label law, so compliance is really ‘federal baseline + state overlay,’ and you have to check the overlay for every state you sell into.
The Federal Baseline: What Every Label Needs Before You Even Look at State Law
Under the 2018 Farm Bill, hemp is legally defined as cannabis containing no more than 0.3% delta-9 THC on a dry-weight basis, which is what allows CBD and other hemp-derived cannabinoids to be sold outside the Controlled Substances Act. But the FDA has not created a specific pathway for CBD as a dietary supplement or food additive, which is why so many labels carry a disclaimer that the product ‘has not been evaluated by the FDA.’
In practice, a defensible baseline label includes: the product’s identity and intended use, net quantity of contents, a full ingredient list, total CBD (or total cannabinoid) content stated in milligrams, the name and address of the responsible party (manufacturer or distributor), a batch or lot number for traceability, an expiration or ‘best by’ date, and a way to access the product’s COA — usually a scannable QR code. Required compliance text is typically expected to be legible at 6pt or larger, and mandated warning statements often need a minimum letter height around 1/16 inch.
Watch the calendar: a new federal law is set to take effect November 12, 2026, capping raw hemp material at 0.3% total THC (including THCA, not just delta-9) on a dry-weight basis, and capping finished consumer products at 0.4 milligrams of total THC per container. That closes the so-called ‘hemp loophole’ that let high-THCA or delta-8 products market themselves as compliant hemp, and it will force many brands to reformulate or resize containers well before the effective date.
Where States Add Their Own Rules
States regulate hemp and CBD sold within their borders on top of the federal floor, and this is where most compliance headaches start. Several states — including New York — require a QR code on every hemp product label linking to lab results, not just a general reference to ‘available upon request.’ Others set their own maximum THC-per-serving or per-container limits that are stricter than the federal number, or require specific warning language about pregnancy, drug testing, or operating machinery.
Child-resistant packaging is one of the most commonly missed requirements, especially for edibles. States that require child-resistant packaging for cannabis or hemp products include Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Florida, Hawaii, Illinois, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nevada, New Hampshire, New Mexico, New York, Oklahoma, Oregon, Pennsylvania, South Dakota, Washington, and West Virginia — and the packaging generally needs independent lab certification (from a certifier such as Intertek or SGS) to prove it actually meets the federal Poison Prevention Packaging Act standard, not just a manufacturer’s claim.
Texas is a useful example of how fast rules move and how steep the compliance cost can get: sellers of consumable hemp products need an active retail registration through the Texas Department of State Health Services’ Consumable Hemp Program, and DSHS lists the annual retail registration fee at $5,000 per location (roughly $5,150 once the required online processing fee is added) — a steep jump from the roughly $150–$155 fee that applied previously. That fee increase, along with a related rule change folding THCA into the state’s THC calculation, has drawn legal challenges from hemp industry groups, and courts have at times blocked enforcement while litigation plays out — so confirm the currently enforced fee and THC rules directly with DSHS before budgeting or relabeling. If you distribute into multiple states, treat each state’s rules — and fees — as a moving target and re-check them at least twice a year.
Tips / Common Mistakes
Don’t design one ‘universal’ label and hope it covers every state — build a base label template with the federal elements locked in, then treat state-specific warnings, QR codes, and THC disclosures as swappable modules for each market. Don’t let your COA landing page become the weak link: many states now expect the QR-linked lab report itself to be accurate and free of prohibited health claims, not just the physical label. Don’t assume ‘hemp-derived’ is automatically legal in every state — some states restrict or ban certain hemp cannabinoids (like delta-8) outright regardless of federal legality. And don’t wait until November 2026 to check your formulations against the new 0.4mg-per-container THC cap; start auditing products and package sizes now so you’re not reformulating under deadline pressure.
Explore more: More compliance guides for hemp and CBD brands.
CBD and hemp labeling requirements FAQs
Is there one federal CBD labeling law that covers every state?
No. Federal law (the 2018 Farm Bill and FDA rules) sets a baseline for what hemp is and what a label must generally include, but individual states add their own requirements for THC limits, QR codes, warning statements, and child-resistant packaging. You have to comply with both layers for every state you sell in.
Do all states require a QR code linking to a Certificate of Analysis?
Not all, but a growing number do — New York is a well-known example that requires QR codes on hemp product labels. Even where it isn’t strictly mandated, including a QR code to your COA is considered a best practice and is expected by many retailers regardless of state law.
What’s changing with the new federal THC cap taking effect in late 2026?
A new federal law effective November 12, 2026 caps raw hemp at 0.3% total THC (including THCA) on a dry-weight basis and limits finished consumer products to 0.4 milligrams of total THC per container. This is stricter than the old delta-9-only calculation many products relied on, so brands should audit formulations and package sizes ahead of the deadline.
Source Smarter With Packaura Direct
Find packaging suppliers, surplus inventory, and certification — all on Packaura Direct. Try Packaura Direct.
Photo: U.S. Air Force graphic by Airman Amanda Lovelace / Public domain, via Wikimedia Commons.