Yes, dispensaries do report to the government, and they report a lot. Every state-legal cannabis sale is logged into a government-run tracking system the state regulator can see in near real time, and the dispensary itself files federal income taxes and federal cash-transaction reports the same way any other business would. What varies is who sees what, and under what legal process.
What Gets Logged When You Buy
Every state with a legal cannabis program requires licensed dispensaries to use an electronic tracking system that follows product from seed through final sale. The most widely adopted platform, Metrc, operates in roughly 20 jurisdictions; other states use competing systems, but the function is the same. Regulators can see what a dispensary has on its shelves, what it sold, and when.
Each individual transaction is logged. The record includes the product type, weight, batch number, and the date and time of sale. In medical programs, the purchase is also tied to your patient registry number so the state can confirm your card is valid and that you haven’t exceeded your allowed supply. In recreational markets, the transaction is logged but doesn’t always flow into the state tracking system attached to your name.
State regulators use this data to enforce purchase limits, audit dispensary inventory against reported sales, flag potential diversion to the illegal market, and calculate the excise and sales taxes a dispensary owes. A dispensary that falls behind on its tracking entries can lose its license.
What the Dispensary Itself Collects About You
Before completing a sale, the dispensary scans or inspects your government-issued ID to confirm you meet the minimum age. That scan captures your name, date of birth, and ID number.
Dispensaries also collect information that has nothing to do with government reporting. If you sign up for a loyalty program, the dispensary records your phone number or email and ties it to your purchase history for marketing purposes. That data stays with the dispensary and isn’t sent to any government agency, though it could be reached by a subpoena in a criminal investigation, the same as loyalty data from any other retailer.
What the Dispensary Reports to Federal Agencies
Dispensaries file federal income tax returns like any other business. The form depends on how the business is organized: a sole proprietor files Schedule C, a partnership files Form 1065, an S corporation files Form 1120-S, and a C corporation files Form 1120.1Internal Revenue Service. Instructions for Form 1120-S, U.S. Income Tax Return for an S Corporation These returns disclose revenue and tax liability to the IRS, and the IRS can cross-reference them against the sales data states collect through tracking systems.
Section 280E of the Internal Revenue Code prohibits any business that traffics in Schedule I or Schedule II controlled substances from deducting ordinary business expenses from gross income.2Office of the Law Revision Counsel. 26 USC 280E – Expenditures in Connection With the Illegal Sale of Drugs For a dispensary, that means rent, payroll, advertising, and utilities aren’t deductible; only cost of goods sold reduces the tax bill. Effective tax rates often exceed 70 percent as a result, and the IRS has warned cannabis businesses against taking deductions they aren’t entitled to.
Then there’s cash. Federal banking access remains severely limited for the industry, so dispensaries handle far more currency than typical retailers, and two separate federal reporting rules kick in. Any business that receives more than $10,000 in cash from a single buyer, or from a series of related transactions, must file IRS Form 8300 within 15 days. The form identifies the customer and the transaction and goes to both the IRS and FinCEN. Penalties for ignoring it are steep: civil penalties for intentional disregard run at least $31,520 per failure (as of 2024 figures, adjusted annually), and willful failure to file can bring criminal fines up to $25,000 and up to five years in prison.3Internal Revenue Service. IRS Form 8300 Reference Guide
Separately, the banks and credit unions that serve dispensaries file Currency Transaction Reports for any cash deposit or withdrawal exceeding $10,000 in a day, and they file Suspicious Activity Reports on marijuana-related accounts under FinCEN guidance.4Financial Crimes Enforcement Network. BSA Expectations Regarding Marijuana-Related Businesses Those reports are generated by the financial institution, not the dispensary, but the underlying activity being described is the dispensary’s.
Who Can Actually See Your Records
State cannabis regulators have routine, built-in access to dispensary data through the tracking system. That’s part of how licensing works, and it doesn’t require any additional legal process.
Law enforcement is different. Police or prosecutors investigating a crime can compel a dispensary to turn over business records or customer data, but they generally need a subpoena, search warrant, or court order to do so.5HHS.gov. HIPAA Privacy Rule – A Guide for Law Enforcement A search warrant requires probable cause and a judge’s approval. A subpoena may have a lower threshold but still follows established procedure.
Federal agencies have an extra tool. The DEA can issue administrative subpoenas under its authority to investigate controlled substance violations, and those do not require prior court approval.6Office of the Law Revision Counsel. 21 U.S. Code 876 – Subpenas A dispensary served with one can challenge it in court, but the initial demand comes from the agency alone. A Department of Justice Inspector General report confirmed the DEA has used this authority to collect bulk data in controlled substance investigations.7U.S. Department of Justice Office of the Inspector General. A Review of the Drug Enforcement Administration’s Use of Administrative Subpoenas
There is no evidence that federal agencies routinely tap state cannabis tracking databases or patient registries. The current enforcement posture has focused on businesses violating state law or diverting product, not on individual consumers in compliant state programs.
Medical Patient Data Carries Extra Protection
Medical marijuana patient registries sit under tighter rules than recreational purchase data. States generally restrict access to the registry to certifying physicians and the patient, and law enforcement can’t browse it without an active investigation and the appropriate legal process. The National Instant Criminal Background Check System used for firearm purchases does not receive medical marijuana registration data.
Whether HIPAA applies to a dispensary depends on how much health information it actually handles. A dispensary that only checks your card against the state registry probably isn’t a HIPAA-covered entity. One that keeps files with diagnoses or physician certifications likely is, and has to follow HIPAA’s rules on disclosure.
Recreational dispensaries collect less sensitive information, but the purchase records in the state tracking system still contain your name, what you bought, and when. Most states with legal cannabis have enacted some confidentiality protection for this data, with specific rules varying by state. Your purchase history is not publicly available and requires legal process to reach.
Downstream Federal Consequences
Because marijuana remains a Schedule I controlled substance under federal law, the record of your legal state purchase can carry weight beyond the transaction.
Firearms are the clearest example. Federal law makes it illegal for any “unlawful user of or addicted to any controlled substance” to possess firearms or ammunition.8Office of the Law Revision Counsel. 18 U.S. Code 922 – Unlawful Acts The ATF has stated that even a state-issued medical marijuana card is enough for a licensed dealer to refuse a sale, and that buyers must answer “yes” to the drug-use question on ATF Form 4473.9Bureau of Alcohol, Tobacco, Firearms and Explosives. Open Letter to All Federal Firearms Licensees Regarding Medicinal Marijuana Use Answering falsely is a federal felony. The background check system doesn’t pull registry data, but the legal prohibition still applies.
Federal employment and contracting work similarly. The Drug-Free Workplace Act of 1988 requires federal contractors and grant recipients to maintain drug-free workplaces, and employees convicted of a workplace drug violation trigger mandatory reporting to the contracting agency within 10 calendar days.10U.S. Department of Labor. Drug-Free Workplace Regulatory Requirements The act doesn’t mandate testing, but many contractors test anyway, and a positive marijuana result can mean termination or loss of a security clearance regardless of whether the use was legal under state law.