You can buy CBD online legally in the United States as long as the product is derived from hemp and contains no more than 0.3% delta-9 THC on a dry weight basis. That single federal threshold is what separates a lawful purchase from a controlled substance. It is not, however, the whole picture. Your state may restrict certain product types or set its own potency and age rules, the FDA still treats CBD as an unapproved additive in food and supplements, and a rewrite of the federal hemp definition scheduled for November 2026 will tighten what qualifies as legal hemp in the first place.
What Federal Law Actually Says
The 2018 Farm Bill defines hemp as the cannabis plant and its derivatives containing no more than 0.3% delta-9 THC on a dry weight basis, and it removed hemp from the federal list of controlled substances.1Office of the Law Revision Counsel. 7 U.S. Code 1639o – Definitions The Controlled Substances Act now excludes hemp from its definition of marijuana.2Office of the Law Revision Counsel. 21 U.S. Code 802 – Definitions The USDA has confirmed that the law “authorized the production of hemp and removed hemp and hemp seeds from the Drug Enforcement Administration’s schedule of Controlled Substances.”3U.S. Department of Agriculture. About Hemp
So if the CBD you are ordering comes from hemp and stays under that 0.3% ceiling, federal law does not treat it as a controlled substance. CBD derived from marijuana, regardless of its actual THC content, is a different product and remains federally illegal.
State Laws Can Override the Federal Answer
Federal legality does not preempt state rules. Roughly 35 states allow hemp-derived CBD without major restrictions; the rest impose their own limits, and some of those limits are stricter than the federal standard. A product that ships legally from one state can be contraband when it arrives at your door.
The restrictions that most often affect online buyers include:
- Age minimums. There is no federal minimum age to buy CBD. Some states set 18, some set 21, and some set none.
- Product-type bans. Some states prohibit specific formats such as inhalable hemp or CBD-infused food and beverages, even when the THC content is below the federal threshold.
- Potency caps. A growing number of states limit the total milligrams of THC allowed per product or per serving, going beyond the federal percentage.
- Retail licensing. Some states require sellers, including out-of-state online sellers shipping in, to hold a license or registration.
Before ordering, check the rules in your state and confirm the seller will actually ship there. Reputable retailers maintain a list of states they cannot serve.
Why CBD Gummies and Oils Exist in a Gray Zone
The FDA considers it unlawful to sell CBD as a dietary supplement or to add it to food sold in interstate commerce. The reason is a provision in the Federal Food, Drug, and Cosmetic Act that excludes any substance from the dietary supplement definition if it was first investigated or approved as a drug. CBD is the active ingredient in Epidiolex, an FDA-approved prescription seizure medication, which triggers that exclusion. The agency has stated that “it is a prohibited act to introduce or deliver for introduction into interstate commerce any food to which THC or CBD has been added.”4U.S. Food and Drug Administration. FDA Regulation of Cannabis and Cannabis-Derived Products, Including Cannabidiol (CBD)
That is why the CBD market looks the way it does. Gummies, tinctures, capsules, and beverages are sold everywhere online because the FDA has largely used enforcement discretion, focusing on companies making explicit health claims rather than pursuing every edible on the market. The products are not controlled substances, but they are also not FDA-approved. If a seller advertises CBD as a treatment for anxiety, chronic pain, cancer, or any other condition, the company is violating federal law, and the FDA has consistently targeted those claims in warning letters.5Food and Drug Administration. What You Need to Know (And What We’re Working to Find Out) About Products Containing Cannabis or Cannabis-derived Compounds, Including CBD Treat health claims as a signal about the seller, not a feature of the product.
How to Vet a CBD Product Before You Order
Because the FDA is not policing content and potency, verification falls to you. Two documents do most of the work.
The Certificate of Analysis
A Certificate of Analysis (COA) is an independent lab report showing a product’s cannabinoid profile and screening for heavy metals, pesticides, and residual solvents. Legitimate sellers post current, batch-specific COAs directly on the product page. If you have to email the company to see the results, or the results do not exist, that tells you how the business is run.
When you read a COA, confirm three things: delta-9 THC comes in below 0.3%; the lab has no financial tie to the brand; and the batch number on the report matches the batch number on the bottle you are buying.
Label Accuracy
Mislabeling is common. A 2022 study in the Journal of Cannabis Research tested 80 unregulated CBD products and found only 54% were accurately labeled, meaning the actual CBD content fell within 10% of what the label claimed. Of the rest, 31% contained more CBD than listed and 15% contained less.6National Library of Medicine. Label Accuracy of Unregulated Cannabidiol (CBD) Products An earlier 2017 study found only 31% of products tested within an acceptable range.
There is no standardized CBD labeling requirement, so use the label as a screening tool. A product should clearly state CBD content per serving, list all ingredients, identify the hemp source, and specify the extract type (isolate, broad-spectrum, or full-spectrum). Missing any of these is a warning sign. Domestic hemp grown under a USDA-approved program is subject to testing requirements that imported hemp may not be.3U.S. Department of Agriculture. About Hemp
Shipping to Your Door
The U.S. Postal Service allows domestic shipment of hemp-based products, including CBD, provided the THC concentration does not exceed 0.3%. Mailers must comply with all applicable federal, state, and local laws and must retain compliance records, including lab results and licenses, for at least three years after mailing.7United States Postal Service. Publication 52 Revision: Hemp-based Products Update USPS prohibits international shipments of hemp and CBD, including to APO, FPO, and DPO military addresses.
FedEx and UPS set their own policies, which can be more restrictive. Check the seller’s shipping page before ordering to confirm they can deliver to your state and that their carrier handles CBD.
If You Face Workplace Drug Testing
Standard drug tests screen for THC, not CBD, so a pure CBD isolate should not trigger a positive result. Full-spectrum products are different. Even trace THC below the 0.3% legal limit can accumulate with regular use and push you past the 50 ng/mL urine screening threshold. The mislabeling problem compounds the risk: nearly half of tested products contain something other than what the label says, and cross-contamination during manufacturing adds more uncertainty, particularly with companies that also handle marijuana.
CBD isolate and broad-spectrum products (which have THC removed after extraction) are the lower-risk options. Full-spectrum is the highest risk. No CBD product carries zero risk unless independent testing shows no detectable THC. Keep the COA for any product you use; if you test positive, documentation of the product’s THC content can be relevant to disputing the result, though your employer is not obligated to accept it.
What Changes on November 12, 2026
Congress rewrote the federal definition of hemp in November 2025 through P.L. 119-37, with the new rules taking effect on November 12, 2026.8Congress.gov. Change to Federal Definition of Hemp and Implications for Federal Controls The changes will reshape what CBD you can legally buy online.
The threshold shifts from delta-9 THC alone to “total tetrahydrocannabinols,” which includes THCA, the acidic precursor that converts to THC when heated.1Office of the Law Revision Counsel. 7 U.S. Code 1639o – Definitions Many products that currently pass the 0.3% delta-9 test contain higher total THC once THCA is counted.
The amended law also sets three specific limits on finished CBD products:
- Finished hemp-derived cannabinoid products cannot contain more than 0.4 milligrams combined total of THC and THC-like cannabinoids per container. A typical 30ml bottle of full-spectrum CBD oil under current rules could legally contain far more than that, so this effectively eliminates most full-spectrum products in their current form.1Office of the Law Revision Counsel. 7 U.S. Code 1639o – Definitions
- Products containing cannabinoids that cannot be naturally produced by the cannabis plant, or that were synthesized outside the plant, fall outside the definition of hemp entirely.8Congress.gov. Change to Federal Definition of Hemp and Implications for Federal Controls
- Bulk hemp-derived cannabinoid products cannot be sold directly to consumers; they may only move through the supply chain to manufacturers of finished goods.
Until November 12, 2026, the current delta-9-only rules still govern. After that date, the same online purchase that is legal today may not be. If you rely on full-spectrum products, watch the transition, and pay attention to the FDA lists identifying which cannabinoids qualify as THC-like intoxicants under the new framework.