How GreenLeadSource fits the rules. This is information, not legal advice.
State-licensed retailers, delivery services, cannabis and hemp brands, and the agencies that market them. We are a software vendor: we never touch product, inventory, payment, or your track-and-trace system.
California's wiretap statute has become the main tool against sites that run tracking before consent. Trackers count more than 800 claims filed in 2025 and several thousand cases on file by mid-2026, with statutory damages of $5,000 per violation, and dispensary sites with chat widgets, pixels, and menu embeds have been named. We identify visitors only after consent, and we log it.
Cannabis email is commercial email, so CAN-SPAM applies in full: a working unsubscribe, your postal address, honest subject lines. We make the consent part provable and deliver no phone numbers, so nothing we provide runs into the carrier filters that drop cannabis texts.
Every licensed state limits who can be marketed to: adults only, no appeal to minors, and in some states an audience-composition test. A list of adults who each said yes on your own site is the easiest audience to defend. Age verification stays with your age gate; we never claim it.
Google does not allow cannabis advertising in the United States. Meta bars ads that promote the sale or use of marijuana. First-party lists are built to work on the platforms that do accept you, under their own programs, and each app page says what to confirm.
We encrypt records in transit and at rest, silo client data, and honor opt-outs across our network. We never read purchase history or medical status.
This page is general information, not legal advice. Check your program with your own counsel and your state regulator.
Cannabis email is commercial email, so CAN-SPAM applies in full. Every record we deliver was captured after the person said yes on your site. Your sends still need a working unsubscribe, your postal address, and honest subject lines — we make the consent part provable.
We act as your service provider. We don't sell or share captured records across clients, we honor deletion requests, and the consent receipt shows exactly what the person was told and when. California, Colorado, Oregon and Washington all have a privacy statute and a cannabis market; we are built for the overlap.
We deliver email records only — no phone numbers — so nothing we provide triggers call or text consent rules, and nothing we provide runs into the carrier filters that drop cannabis texts. If you text customers from other sources, those rules are yours to manage.
Every state that licenses cannabis restricts who can be marketed to: a 21+ audience, no appeal to minors, and in some states an audience-composition test. A list of adults who each said yes on your own site is the easiest audience to defend. Age verification stays with your age gate; we never claim it.
Descriptive summary, not legal advice. Your counsel and your state regulator should confirm how these apply to your license.
Late bulletin
Ten seconds. Your Customer Reach Score, what fires before anyone says yes, whether your age gate is the only question you ask, and what your privacy policy leaves out. Nothing installed, nobody contacted.