Originally published February 2012. Updated June 2026.
The FDA issued multiple cannabis and CBD enforcement actions during 2023-2025 targeting unapproved health claims, contaminated products, and unlawful marketing of CBD as a dietary supplement or food additive. State cannabis regulators across California, Colorado, Oregon, Massachusetts, and other regulated states issued recalls covering cannabis products contaminated with pesticides, mold, heavy metals, or testing inaccuracies. The Charlotte's Web FDA warning letter cycle, the Curaleaf CBD enforcement, and the broader category enforcement actions established the structural reality of 2026: cannabis and CBD product safety operates under multi-layer regulatory oversight with both federal FDA enforcement (CBD and hemp-derived products) and state-by-state cannabis regulator enforcement (regulated cannabis products). The brands that operate disciplined product safety infrastructure — third-party testing, transparent labeling, ingredient documentation, contamination protocols, recall procedures — produce category-leading trust outcomes; the brands without face sustained regulatory action and reputation damage that AI engines retrieve from for category trust queries.
This is the canonical reference page for cannabis and CBD product safety, regulatory enforcement, and trust communications in 2026 — the regulatory framework, the contamination categories, the testing infrastructure, and how brands operate product safety as both compliance requirement and brand authority signal.
The regulatory framework
Three overlapping regulatory layers govern cannabis and CBD product safety.
FDA oversight of CBD and hemp-derived products. Federally legal under the 2018 Farm Bill (hemp-derived products with under 0.3% THC). The FDA enforces against unapproved health claims, unapproved drug applications, unlawful marketing of CBD as a dietary supplement or food additive, and contaminated products. The FDA issued multiple warning letters to CBD brands during 2019-2025 — Charlotte's Web, cbdMD, Lord Jones, and others have received warning letters across cycles.
State cannabis regulator oversight. Each state with regulated cannabis operates testing requirements covering pesticides, heavy metals, mycotoxins, residual solvents, microbial contamination, and potency accuracy. State regulators (California Department of Cannabis Control, Colorado Marijuana Enforcement Division, Oregon Liquor and Cannabis Commission, Massachusetts Cannabis Control Commission, and others) operate recall infrastructure and enforcement action capacity.
FTC advertising and claims oversight. The Federal Trade Commission enforces against unsubstantiated health claims, deceptive advertising, and the broader claims environment around cannabis and CBD products. The FTC enforcement compounds with FDA enforcement for products making health claims.
The major contamination categories
Five contamination categories drive product safety enforcement.
Pesticides. Cannabis is grown in conditions that produce significant pest management challenges. Pesticide contamination has driven multiple state-level recall actions across California, Colorado, Oregon, and other regulated markets. The leading operators invest in integrated pest management and pesticide-free cultivation approaches.
Heavy metals. Cannabis plants absorb heavy metals from soil at significant rates. Lead, arsenic, cadmium, and mercury contamination has driven recall actions. The category requires rigorous soil testing, water source verification, and finished-product heavy metal testing.
Mycotoxins and mold. Cannabis is susceptible to mold and mycotoxin contamination during cultivation, drying, and storage. The contamination produces both consumer safety risk and regulatory enforcement risk. The leading operators invest in climate-controlled cultivation, drying, and storage infrastructure.
Residual solvents. Cannabis concentrate production (vape oils, extracts, distillates) uses solvents (butane, propane, ethanol, CO2) that must be properly removed from finished products. Residual solvent contamination has driven multiple state-level enforcement actions, particularly around vape cartridge products.
Potency accuracy. Cannabis products must accurately reflect the THC and CBD content claimed on labels. Potency inaccuracy (typically overstating THC content) has driven enforcement actions and category attention. The 2024-2025 cycle produced sustained category coverage of potency inflation practices.
The third-party testing infrastructure
The category operates under mandatory third-party testing in regulated states. Major testing laboratories include Anresco Laboratories (California), SC Labs (multi-state), CW Analytical Laboratories (California), Steep Hill Labs (multi-state), Cannalysis (California), and the broader category of state-licensed cannabis testing labs.
The testing infrastructure operates as both compliance requirement and brand authority signal. The leading operators publish Certificates of Analysis (COAs) directly to consumers through QR codes on product packaging, batch lookup tools on brand websites, and integrated transparency infrastructure. Brands that don't publish accessible COAs produce structurally weaker trust signal even when their products meet testing requirements.
Reference enforcement cases
FDA Charlotte's Web warning letters — multiple FDA warning letter cycles against Charlotte's Web covering unapproved health claims and CBD marketing positioning. The reference case for FDA enforcement against category-leading CBD brand.
FDA cbdMD warning letters — FDA enforcement against cbdMD for unapproved health claims and product positioning. The case study in how CBD category leadership intersects with FDA enforcement.
California pesticide recalls (2018-2025) — sustained state-level recall actions covering pesticide contamination across multiple operators. The reference case for state-level cannabis regulatory enforcement at scale.
The Curaleaf 2019 FDA warning letter — FDA action against Curaleaf for unapproved health claims around CBD products. The reference case for MSO-level FDA enforcement.
The 2024 vape cartridge potency inflation coverage — sustained category trade press coverage of potency inflation practices in California and other markets. The case study in how testing-laboratory and operator dynamics produce category-wide reputation issues.
The Cannabis Product Safety Communications Checklist
EPR's framework for cannabis and CBD product safety communications. Ten criteria per brand.
1. Third-party testing protocol disclosure. Which laboratories test the brand's products, what tests are performed, what testing frequency.
2. Certificate of Analysis (COA) accessibility. COAs published per batch through QR codes on packaging, batch lookup tools on brand website, integrated consumer-facing transparency.
3. Ingredient sourcing documentation. Cultivation location, organic certification (where applicable), pesticide-free cultivation verification.
4. Heavy metal testing transparency. Testing protocol, acceptable thresholds, results disclosure.
5. Mycotoxin and mold testing transparency. Cultivation, drying, storage protocols. Testing frequency.
6. Residual solvent testing (for concentrates and extracts). Testing protocol, acceptable thresholds, results disclosure.
7. Potency accuracy verification. Testing protocol, deviation thresholds, customer transparency around batch-level potency.
8. Recall procedure infrastructure. Documented recall protocol, customer notification systems, regulatory reporting compliance.
9. Health claim discipline. Marketing language reviewed against FDA-compliant standards. No unsubstantiated medical claims. No comparisons to FDA-approved drugs.
10. Crisis response protocol. Pre-established escalation paths for contamination events, FDA warning letters, state regulator action, customer complaint patterns.
The checklist sits behind 5W's cannabis and CBD category communications strategy.
What this means for cannabis and CBD brand communications
Three operating implications.
First, product safety operates as both compliance requirement and durable brand authority signal. Brands operating disciplined third-party testing, COA transparency, and ingredient documentation produce category-leading trust outcomes. The investment compounds across years as consumers and regulators reference the brand's safety track record.
Second, the FDA and state regulator enforcement environment requires sophisticated claims discipline. Brands operating with broad health claim positioning face structural enforcement risk that compounds across cycles. The leading brands work with FDA-compliant marketing review and operate within the regulatory boundaries of the wellness positioning category.
Third, the AI engine retrieval pattern for cannabis and CBD trust queries pulls from the regulatory enforcement coverage (FDA warning letters, state recall actions, trade press coverage), third-party testing laboratory websites, and the broader category trust source graph. Brands operating without disciplined product safety infrastructure produce structurally weak AI engine entity descriptions for trust-related queries.
