The short answer to “is it legal to buy CBD online” is yes, but only when the product comes from hemp with less than 0.3% THC. The 2018 Farm Bill sets that federal rule, and state laws can add their own limits on top of it. The most useful habit: pull the Certificate of Analysis (COA) before you pay and confirm the THC number yourself.
Check These Three Things Before You Buy CBD Vape Online
Marijuana-derived CBD sits in a different category. Under federal law, cannabis with more than 0.3% THC remains a Schedule I controlled substance. That means a CBD oil made from marijuana flowers is not legal to buy online, even if the final bottle shows only trace THC.
Is It Legal to Buy CBD Online? What Federal Law Says
The 2018 Farm Bill removed hemp from the Controlled Substances Act. Hemp is defined as Cannabis sativa with no more than 0.3% THC on a dry weight basis. Any CBD extract that stays under that line is a legal hemp product for interstate commerce, and that includes online sales.
Note the wording: the limit applies to the plant, not the finished tincture or gummy. A product can test at 0.2% THC and still be legal under the farm bill. It cannot cross the 0.3% threshold at any stage.
Four Checks Before You Buy CBD Online
These four checks take about five minutes total. Skip one, and you risk buying something that is illegal in your state or different from what the label claims.
Check 1: The THC Number on the Lab Report
Reputable sellers publish a COA from an independent lab. Look at the delta-9 THC line, not the total THC column. The delta-9 number must sit below 0.3% for the product to count as hemp.
Some labs report total THC, which includes THCa. High-THCa flower can exceed the limit once heated, so read the fine print.
Check 2: Where the Hemp Was Grown
The farm bill requires hemp to be grown under a state or tribal program approved by the USDA. Sellers should name the farm or processor. Vague sourcing is a red flag.
Check 3: Your State's CBD Rules
Federal legality does not erase state law. A few states restrict smokable hemp, and others require in-state retailers to hold a license. Your state's department of agriculture is the authority, not the seller's FAQ page.
Check 4: The Seller's Claims
Legal sellers do not promise to cure a disease. The FDA has not approved CBD as a dietary supplement or an over-the-counter medicine, and health claims push a product into a gray zone. If the site says CBD treats cancer or anxiety, treat that as a warning sign.
What Should CBD Cost Online? Price Bands That Make Sense
Price per milligram is the only fair way to compare oils, gummies, and capsules. You will see three general bands online.
- Budget, under $0.03 per mg: basic isolates with a COA. Fine for a low-cost trial, but potency accuracy can drift.
- Mid-range, $0.05 to $0.10 per mg: full-spectrum oils with solvent-free extraction and steady third-party testing. The sweet spot for most buyers.
- Premium, $0.15 per mg and up: organic hemp, small-batch extraction, heavy testing. You are paying for sourcing and brand overhead, not a guaranteed stronger effect.
A 1,000 mg bottle at $60 works out to $0.06 per mg, a fair mid-range price. The same bottle at $15 should raise questions about extraction quality. A $15 bottle of full-spectrum oil is a warning sign, not a bargain.
Common Pitfalls That Turn Legal CBD Into a Bad Buy
Pitfall one: no COA. If the lab report is missing, assume the product is untested. The label claim is a marketing sentence until a lab confirms it.
Pitfall two: synthetic cannabinoids. Some products labeled “CBD” contain lab-made delta-8 or hexahydrocannabinol (HHC). These compounds carry their own legal questions and may not appear on a basic COA.
Pitfall three: hidden subscriptions. Many sites sign you up for monthly deliveries during checkout. Find the checkbox before you enter payment details.
Pitfall four: dosage guessing. A 10 mg gummy and a 100 mg dropper are not interchangeable. Start with a low dose and read the serving size twice.
How to Spot a Lab Report You Can Trust
A trustworthy COA comes from a third-party lab, not the brand's own facility. The report should show the test date, the batch number, and the lab's signature. It should match the batch number printed on your bottle.
Cross-check the lab's name. Reputable labs such as Eurofins and ProVerde Laboratories appear across multiple brands. If the lab name is invented, treat the report as fiction.
A full report covers pesticides, heavy metals, residual solvents, and microbials. A COA that lists only cannabinoid potency is a partial report, and partial is not enough.
FAQ: Quick Answers on Buying CBD Online
Is CBD legal in all 50 states?
At the federal level, hemp-derived CBD with less than 0.3% THC is legal in all states. State laws still vary, and a few restrict product types like smokable hemp. Check your state's agriculture department before ordering.
Do I need a prescription to buy CBD online?
No. Hemp-derived CBD is not a prescription drug, so you can buy it without a doctor's order. Epidiolex, the FDA-approved CBD medicine for certain seizure disorders, does require a prescription, and it is not the same product sold online.
Can a legal CBD product fail a drug test?
Yes. Even a product with 0.2% THC can trigger a positive result, because drug tests screen for THC metabolites, not legal status. If your workplace tests, choose a broad-spectrum or isolate product with a COA that shows non-detectable THC.
Does the 0.3% THC limit apply to each batch?
Yes. Ask for the COA for the specific batch you are buying, not a generic report. A brand that tests one batch and applies the result to ten batches is not being accurate. Look for batch numbers that match.
The bottom line: legal CBD exists, and most of it is sold online. The question is whether the seller can prove it. A current COA, a transparent THC number, and a quick state check take five minutes and keep the purchase legal.