Age verification for cannabis & CBD

Legal cannabis is among the most tightly age-controlled retail categories — typically 21+ in US states and 18/19+ in Canada. Verify age online and at delivery with an auditable, privacy-first flow.

Book a 20-minute demo

In US states with legal adult-use cannabis, the minimum age is 21, with strict verification required at purchase and at delivery; Canada's federal Cannabis Act sets 18/19+ by province. Even hemp-derived CBD and intoxicating cannabinoids (e.g. delta-8) face tightening age rules. Because cannabis remains federally illegal in the US, operators carry heightened compliance and banking scrutiny.

Dispensaries and delivery platforms need verifiable, auditable age checks that satisfy state regulators and ID-at-the-door requirements. Xident verifies legal age fast on-device, keeps an auditable result, and re-confirms returning customers instantly — without storing customer identity documents.

Minimum age in US adult-use cannabis states (18/19 in Canada)

Why now

Age-verification law for cannabis & cbd, by country

How the major markets regulate age assurance in this sector — and what each one requires of operators.

Country	Law / Regulator	Min. age	Requirement	Status
United States	State cannabis programs (CA, CO, NY +more)	21	Verify 21+ at purchase and delivery; ID check and logging required.	In force
Canada	Cannabis Act + provincial rules	18 / 19	Age verification online and at delivery; varies by province.	In force
United States (CBD)	State hemp / delta-8 laws	18 / 21	Age gating for intoxicating hemp products; varies by state.	Phasing in
Germany	Cannabis Act (KCanG) 2024	18	Adult-use framework with age restrictions and access controls.	In force
Netherlands	Tolerated-sale (gedoogbeleid) rules	18	Age verification for coffeeshop and regulated sales.	In force

United States In force

Law: State cannabis programs (CA, CO, NY +more)
Min. age: 21
Requirement: Verify 21+ at purchase and delivery; ID check and logging required.

Canada In force

Law: Cannabis Act + provincial rules
Min. age: 18 / 19
Requirement: Age verification online and at delivery; varies by province.

United States (CBD) Phasing in

Law: State hemp / delta-8 laws
Min. age: 18 / 21
Requirement: Age gating for intoxicating hemp products; varies by state.

Germany In force

Law: Cannabis Act (KCanG) 2024
Min. age: 18
Requirement: Adult-use framework with age restrictions and access controls.

Netherlands In force

Law: Tolerated-sale (gedoogbeleid) rules
Min. age: 18
Requirement: Age verification for coffeeshop and regulated sales.

The cost of getting it wrong

US: state licence suspension/revocation and fines for sales to under-21s; failed compliance / secret-shopper checks.
Loss of banking and payment access — already constrained for cannabis operators.
Canada: penalties and licence action for age-verification failures.
Personal and corporate liability for supplying minors; brand and licence risk.

How on-device works

How Xident verifies age for this sector

The same privacy-first flow underpins every vertical: clear most users on-device, fall back to documents only when needed, and re-use the credential for returning visits.

Age is estimated on the device

An on-device model runs in the user's browser and estimates whether they clear the required age threshold. No upload, no server round-trip for the image.

Nothing leaves the device

No selfie, no biometric template, no raw frame is transmitted. Only a pass/fail age signal reaches your backend — so there is no biometric honeypot to breach or disclose.

Document fallback only for borderline cases

Ambiguous ages step up to a document check, which is processed for extraction and deleted immediately. Verified users get a reusable age credential, so returning visits resolve with a one-tap Check.

The face never becomes data you hold. That is the difference between meeting an age-assurance duty and becoming the next breach headline.

The benefits

Why operators choose Xident for cannabis & cbd

Meet your age-assurance obligations without becoming a store of biometric or identity data.

Auditable 21+ / 18+ verification

Fast on-device age estimation plus a document fallback and an auditable result trail meet state requirements to verify and log age at purchase.

Delivery ID-at-the-door support

Re-confirm a returning customer with a quick Check at hand-off, supporting the age-at-delivery requirements common in cannabis programs.

Reusable age credential — returning users never re-verify

After a user verifies once, returning visits resolve with a token lookup (a "Check") instead of a full re-verification. Conversion stays high and your per-event cost drops up to 80% versus repeating document checks.

Privacy by design — faces never leave the browser

On the fast path, age is estimated client-side with on-device models; only a pass/fail age signal reaches the server, never the image. You meet age-assurance duties without becoming a honeypot of biometric data — the single biggest objection regulators and users raise.

Frequently asked questions

Can Xident enforce the 21+ cannabis threshold?

Yes. The +21 threshold (or +18/+19 for Canada) is configured per jurisdiction and applied automatically.

Do regulators require a logged/auditable check?

Many cannabis programs require operators to verify and record age at purchase. Xident retains an auditable age-bracket result without storing the customer's ID image.

Does it work for CBD and delta-8 products?

Yes. As states extend age gating to intoxicating hemp products, the same configurable threshold and flow apply.

Ready to verify age the privacy-first way?

Integrate in minutes. Clear most users on-device in seconds. Re-use the credential so returning users never re-verify.