Heavy Metals in Cannabis Extracts: Testing, Limits, and Vape Risks

Heavy metals in cannabis extracts are regulated in every U.S. state with a legal cannabis market, and the four that must be tested are lead, cadmium, arsenic, and mercury. Safety limits are largely modeled on the U.S. Pharmacopeia’s Chapter 232 thresholds for pharmaceutical products, and they are dramatically tighter for inhaled products like vape cartridges than for edibles or topicals because the lungs absorb contaminants much more directly than the digestive system. If any single metal exceeds the action level, the batch fails and cannot be sold.

Why Extracts Carry More Metal Than the Plant Did

Cannabis is an unusually efficient bioaccumulator. It pulls lead, cadmium, arsenic, and mercury out of soil and irrigation water more readily than many other crops, and it stores those metals in its tissues throughout the growing cycle. A plant grown in contaminated ground can look and smell completely normal while carrying metal concentrations that would fail lab testing.

Extraction concentrates the problem. When manufacturers use solvents, CO₂, or heat to strip cannabinoids and terpenes from plant material, the heavy metals dissolved in the plant’s tissues come along. The final extract is a concentrated version of everything in the starting material, so a batch of flower that barely passes at the raw-plant level can produce an extract that fails outright. That is the main reason regulators treat extracts as higher-risk products and require their own testing rather than accepting flower-level results.

Metals can also enter after extraction. Storage containers, processing equipment, and especially low-quality vape cartridge hardware can leach metals into the finished product, sometimes turning a clean extract into a contaminated one before it ever reaches a consumer.

The Four Metals States Test For

Every state that mandates heavy metal testing for cannabis requires screening for the same four elements: arsenic, cadmium, lead, and mercury. A peer-reviewed comparison of state regulations found that all 28 jurisdictions with metals testing on the books listed these four as mandatory.¹ They get singled out because they are toxic at very low doses, they build up in the body over time, and they appear in cannabis more frequently than other metals.

A handful of states go further. Chromium is required by roughly six jurisdictions, and nickel and copper each appear in a couple of state testing programs.¹ Most states have not added those to their mandatory panels.

Safety Limits for Inhaled and Oral Extracts

Most state cannabis programs base their thresholds on USP Chapter 232, which sets concentration limits for elemental impurities in pharmaceutical products. USP distinguishes between oral, injected, and inhaled products, with inhalation limits set lowest. The benchmarks most state cannabis regulators have adopted, in micrograms per gram (µg/g), which is the same as parts per million (ppm):²

Cadmium: 0.2 ppm inhaled, 0.5 ppm oral
Lead: 0.5 ppm inhaled and oral
Arsenic: 0.2 ppm inhaled, 1.5 ppm oral
Mercury: 0.1 ppm inhaled, 3.0 ppm oral

Three of the four metals have far lower limits for inhaled products. A vape cartridge with 0.3 ppm of arsenic fails; the same concentration in an edible passes. For mercury, the oral limit is 30 times higher than the inhalation limit. Those gaps exist because a contaminant crossing directly into the bloodstream through lung tissue does more damage than the same dose routed through digestion.

Not every state adopts USP limits exactly. Action levels across jurisdictions range from as low as 0.00009 ppm to as high as 10 ppm for certain metals in certain product types.¹ A product that passes in one state may fail in another.

How to Read a Certificate of Analysis

Every regulated cannabis extract has a certificate of analysis (COA), and dispensaries are required to provide it on request. Four things are worth checking:

All four metals (lead, cadmium, arsenic, mercury) are listed.
Each result is below the applicable action level for that product type.
The lab is identified by name and accreditation number.
The batch number on the COA matches the batch number on your packaging.

Independent samplers collect the material tested on a COA using protocols that scale sample points to batch size, so a single lucky scoop cannot mask contamination in the rest of the batch. If a dispensary cannot produce a COA or refuses to, that alone is reason to walk away.

The Vape Cartridge Problem

Even an extract that tests clean in the lab can pick up metals after it is loaded into a vape cartridge, and this is where the most alarming contamination data has surfaced. Heating coils are typically made from alloys containing chromium, iron, and nickel, and other internal components can contain copper, lead, and zinc.³ When the oil heats, those metals leach into the liquid and then into the aerosol.

The leaching gets worse over time. A scoping review of cannabis vape contamination found that repeated heating and cooling cycles chip metal particles from coil surfaces, and continuous use creates an increasingly concentrated metal solution in the remaining oil.⁴ Low liquid levels are especially dangerous because the exposed coil can volatilize dissolved metals directly. Cannabis oil’s relatively low pH accelerates corrosion during long-term contact, and extended storage before sale gives the oil more time to dissolve metals from the cartridge walls.

The documented concentrations are startling. Studies have found lead levels up to 50 µg/g and nickel up to 677 µg/g in cannabis vape liquids, numbers that dwarf the 0.5 ppm lead limit.⁴ Some disposable devices were found to contain leaded bronze alloys in components that directly contact the liquid, contributing lead concentrations up to 175 ppm alongside copper at 546 ppm.³ Most current regulations only test the oil before it enters the cartridge, so this category of contamination can slip through even a fully compliant testing program. The research overwhelmingly involved low-quality or unregulated devices, which is why buying vape cartridges from licensed dispensaries matters more than it does for any other extract format.

What Chronic Exposure Does to the Body

The danger from contaminated extracts is rarely a single acute event. These metals accumulate in the body, and regular use of contaminated products can push exposure into harmful territory without any dramatic warning. Each metal has its own targets:

Lead damages the brain, kidneys, and reproductive system. Chronic exposure causes high blood pressure, headaches, fatigue, joint pain, and irritability, and even low levels can impair brain development in children.
Cadmium targets the kidneys and lungs. Inhaling cadmium at elevated levels over time can cause kidney disease and brittle bones, and high acute inhalation exposure can be fatal.
Arsenic affects the liver, kidneys, lungs, and lymphatic system. Long-term exposure raises cancer risk and can cause skin lesions and eye damage.
Mercury is a potent neurotoxin that impairs the central nervous system, causing tremors, mood changes, and cognitive difficulty.

Inhalation is the most dangerous exposure route for all four metals, which is why vape cartridges receive the strictest scrutiny. Anyone experiencing unexplained headaches, fatigue, nausea, or a persistent metallic taste after using cannabis extracts can raise their consumption with a healthcare provider and ask about heavy metal blood testing. Adverse events involving hemp-derived CBD products can be reported through the FDA’s MedWatch program.⁵ For state-regulated cannabis products, the relevant state cannabis agency typically maintains its own complaint or adverse-event portal.

What Happens When a Batch Fails

A failed heavy metal test triggers an immediate quarantine. The laboratory uploads the result into the state’s traceability system, which blocks the batch from being transferred or sold.⁶ From there, most states allow either remediation or destruction. Remediation is harder than it sounds for this category: unlike pesticides, heavy metals are elemental and cannot be broken down. Some states permit retesting after reprocessing, requiring two consecutive passing results before release. When remediation is not permitted or not practical, the batch is destroyed under witnessed conditions and logged in the regulatory record.

If contaminated product reaches shelves before the problem is caught, a recall follows. The producer must notify the state regulatory agency (most states require contact within 24 hours), alert every retail partner that received the affected inventory with specific batch numbers, and post public notice. The result of that back-end system is what a consumer sees on the front end: a COA tied to a specific batch, a batch number on the packaging, and a dispensary that can answer for what it sold you.

1
PMC (PubMed Central). Comparison of State-Level Regulations for Cannabis Contaminants
2
U.S. Pharmacopeia (USP). USP 232 Elemental Impurities – Limits
3
PMC (PubMed Central). Elevated Toxic Element Emissions from Popular Disposable E-Cigarettes: Sources, Life Cycle, and Health Risks
4
PMC (PubMed Central). Heavy Metals in Cannabis Vapes and Their Health Implications – A Scoping Review
5
U.S. Food and Drug Administration. MedWatch: The FDA Safety Information and Adverse Event Reporting Program
6
Metrc. Cannabis Testing and Compliance Best Practices