Dispensary loyalty programs: text, email and app rules, 2026
Dispensary loyalty programs can run on the web, by text, email or app. Each channel has its own consent and store rules. Here is what applies in October 2026.
A dispensary loyalty program can run on a web account, by text, by email or in a mobile app. The web is the lowest-risk base. Text and email need documented consent and a working opt-out. A native app must stay out of the ordering flow, because Google Play does not allow apps that facilitate marijuana sales. Your state regulator sets what the rewards themselves may be.
Everything below is sourced to a primary document. State rules differ, so read the New York material as one worked example and check your own regulator before you launch.
What a dispensary loyalty program can offer
Start with the reward, because it decides the rest. Regulators treat a reward as advertising, and many of them restrict price promotions.
Points and member discounts
New York's Office of Cannabis Management lists loyalty programs among the promotions a licensee may offer. Its marketing and advertising guidance gives two permitted examples: "Earn points for future discounts" and "15% off for loyalty members". Retail tax is calculated on the pre-discount price.
What regulators prohibit
The same guidance sets limits you can design around:
- Ads cannot promote pricing below market value, defined as the minimum retail price of 1.5 times the wholesale price.
- Discount stacking that drives prices below market value is prohibited.
- "Spin the wheel" promotions and scratch-off games are prohibited.
- Ads cannot use the words "free" or "donated", so "Buy one, get one free" and a free pre-roll on a member's birthday with no purchase are out.
Other states have their own text. Colorado, Washington, California and Minnesota publish separate rules, and a program that is fine in one state can be a violation in another. Build the reward logic as configuration, not as hard-coded behavior, so a rule change is a settings edit.
Web, text or app: which channel fits
| Channel | Main rule source | Main risk |
|---|---|---|
| Web account and wallet pass | State advertising rules | Rewards that break price or "free" limits |
| Text messages | FCC consent rules | Texting without written consent |
| FTC CAN-SPAM guide | Slow or broken unsubscribe | |
| Native app | Apple and Google store policies | Rejection or removal over ordering features |
If you also run a compliant site, the cannabis website compliance checklist covers the surrounding pages a loyalty sign-up sits on.
Text: written consent and STOP
The FCC states that texts sent to a mobile phone with an autodialer are banned unless the owner gave prior consent. Marketing texts need prior express written consent, a requirement that dates to 2012. Consumers can withdraw consent at any time and in any reasonable manner, and replying "STOP" is a standard example. Treat any clear refusal as a revocation, not only the keyword you chose.
The FCC adopted a stricter revocation rule in 2024, but enforcement of 47 CFR 64.1200(a)(10) has been waived. As of a January 2026 FCC order, that waiver runs until January 31, 2027. Don't plan around the waiver. Build the opt-out handling now.
In practice, a text sign-up needs four things:
- A checkbox that is not pre-checked, with plain wording that the member agrees to marketing texts.
- A stored record of the consent: timestamp, wording shown and phone number.
- An immediate stop on any reply that asks to stop, across all your text programs.
- Age and licensing awareness. New York requires that promotions sent through electronic communications reach an audience that is at least 75.9% adults 21 and over, based on 2023 Census data.
We could not load the FCC's own page when we checked, so confirm the current rule text before you rely on the dates above.
Email: CAN-SPAM basics
Email is simpler. The FTC's CAN-SPAM compliance guide, dated August 2023 and edited January 2024, lists eight requirements. The ones that trip up loyalty programs:
- Include a valid physical postal address in every message.
- Identify the message as an ad.
- Give a clear opt-out. The guide states: "You must honor a recipient's opt-out request within 10 business days."
- Keep the opt-out working for at least 30 days after you send.
- Do not charge a fee or ask for more than an email address to opt out.
Each separate email in violation can draw penalties of up to $53,088. Prior consent from a member does not remove the opt-out duty. Offer a menu of message types if you want, but always include an option to stop all marketing.
Apps: Google Play and Apple
App stores add a second rulebook on top of the law.
Google Play is the stricter one. Its policy says: "We don't allow apps that facilitate the sale of marijuana or marijuana products, regardless of legality." Letting users order through a shopping cart, or arranging delivery or pickup, are named violations. A loyalty app on Android should therefore show points, offers and store info, and send ordering back to the web.
Apple allows more, with conditions. Guideline 1.4.3 reads: "Facilitating the sale of controlled substances (except for licensed pharmacies and licensed or otherwise legal cannabis dispensaries), or tobacco is not allowed." Under guideline 5.1.1(ix), such apps "should be submitted by a legal entity that provides the services, and not by an individual developer. Apps that facilitate the legal sale of cannabis must be geo-restricted to the corresponding legal jurisdiction." Both pages showed no revision date when we read them in October 2026, so recheck before you submit.
Many programs end up web-first with an optional app. A pass or link that opens the right screen from a text or email is a web-to-app handoff problem, and it is solved with universal links rather than extra sign-ups.
Tradeoffs and edge cases
A web-only program reaches everyone and skips store review, but it has no push channel. A text program puts your offer in front of members fastest and carries the strictest consent burden. An app gives you the richest experience and the narrowest distribution rules.
Collect only the data the program needs. A phone number and an email are enough to start, and every extra field is something you must secure and delete on request. Keep promotions separate from the menu and checkout so a regulator reading an ad sees an ad, not a sale mechanism. Paid promotion has its own limits; see the advertising restrictions on Google and Meta.
If you need the sign-up flow, consent records and member account built into your site, that is web development work. Kallos Labs builds these flows for regulated retail, and the sensible order is consent storage first, rewards logic second, design last.
Frequently asked questions
Do dispensary loyalty programs have to follow the same rules in every state?
No. Rules vary by state regulator. New York permits points and member discounts but bans "free" offers and below-market pricing, and other states publish different text. Read your regulator's advertising rules before you design rewards.
Do I need consent before texting loyalty members?
Yes. Marketing texts sent with an autodialer to mobile phones need prior express written consent, and members can revoke it in any reasonable way, including by replying "STOP". Keep a record of each consent.
How fast must I honor an email unsubscribe?
Within 10 business days under the FTC's CAN-SPAM guide, and the opt-out mechanism must keep working for at least 30 days after you send. Faster is better, and you should never charge for it.
Can I publish a dispensary loyalty app on Google Play?
Only if it does not facilitate marijuana sales. Google says it does not allow such apps "regardless of legality", so keep ordering, delivery and pickup out of the Android app.