Cannabis delivery website requirements: zones, ID checks and order tracking, 2026
A cannabis delivery website enforces zones, age and ID checks, delivery windows and order records. Here is what New York, Minnesota and California say.
The short answer
A cannabis delivery website does not carry the legal duties itself. The licensed retailer and its drivers do. The site's job is to enforce those duties early: accept only addresses the rules allow, collect what the driver will need to check ID, respect delivery windows, and keep a clean record of each order. The rules differ by state, so this guide uses three regulators as examples: New York, Minnesota and California.
What a cannabis delivery website has to do
Think of the site as the first checkpoint. The driver at the door is the last one. If the site lets through an address the rules forbid, the retailer finds out at the worst moment.
In practice the site does four things:
- It checks the delivery address before payment.
- It collects the customer's name and date of birth so the door check can match them.
- It shows the delivery window and the cut-off for same-day orders.
- It writes each order into a record the retailer can reconcile later.
Payment and pickup choices sit alongside this, and we cover them in pickup, delivery and payment options.
Delivery zones: which addresses to accept
Zones are usually set by law and by your licence, not by a map you draw yourself. New York's Office of Cannabis Management is specific about where a delivery may go. Its compliance reminders rule out "any location that is not a residential property, short- or long-term residence, or private business". They also strictly prohibit public spaces, including parks, public buildings, community centers, school grounds, day-care centers and houses of worship. Locations outside New York State are not allowed, and the same page says cannabis cannot be delivered to "anyone inside a motor vehicle".
The same page adds that delivery must begin from the licensee's approved retail location. That matters for the site: the order has to be routed to the right store, not to any store in a group.
Here is what that means for the address step:
- Validate the address against the state before anything else.
- Check it against the types of place the rules allow. A park, a school or a parked car is not a valid drop-off.
- Apply any stricter local rule. California, for example, lets cities and counties set tighter hours than the state, and local limits can apply to delivery too, so confirm yours.
- Show a plain rejection message that says why, so a customer does not retry five times.
A zone check can't read the whole rulebook. Some rules, such as the "no one in a motor vehicle" rule, are only enforceable at the door. Put them in the checkout copy anyway, so the customer is not surprised.
ID checks: at checkout and at the door
A website can ask for a date of birth. It can't prove who is standing at the door. Regulators put the real check at delivery.
- New York: "ID and age must be verified at delivery," and cannabis cannot be delivered to anyone other than the person who placed the order, according to the OCM compliance reminders.
- Minnesota: before completing any delivery, the service "shall verify that the customer is at least 21 years of age" or enrolled in the registry program, under Minn. Stat. 342.42, subd. 1.
- California: retailers must verify customer age by checking ID. The Department of Cannabis Control lists a government-issued photo ID such as a driver's license, a military photo ID or a passport.
Two design choices follow from this. First, ask for the name and date of birth at checkout and show a short note that the same person must show ID at the door. Second, make the ordering account the recipient. If New York allows delivery only to the person who placed the order, a "send it to a friend" field is a risk, not a feature.
Keep the checkout age gate honest. It reduces wasted trips. It does not replace the check that the rules require at delivery.
Delivery windows and cut-off times
Hours belong on the site because they decide whether an order can be fulfilled today. California's retail page says retailers may sell between 6:00 a.m. and 10:00 p.m., that cities or counties can set stricter hours, and that delivery drivers "must return to the retail premises no later than 10:00 p.m."
Plan the site around that last line. If drivers must be back by 10:00 p.m., the last order cannot be accepted at 9:55 p.m. Set the cut-off from the drive time to your farthest zone, not from closing time. Show the window next to the address field, and switch the button to "closed" outside it rather than letting orders queue overnight.
Order records and tracking
Records are where a delivery site earns its keep. Minnesota's statute is the clearest public example. Under section 342.42, receipt of cannabis flower and products, and each delivery to a customer, must be recorded in the statewide monitoring system "within the time established by rule". The office also sets record-keeping requirements by rule, including proof of delivery to customers who are 21 or older or enrolled in the registry.
The same section governs the vehicle: products travel in a locked, secure compartment that is part of the vehicle, or in a locked container, and may not be visible from outside. Only cannabis workers who are at least 21 may transport products, and every passenger must be a cannabis worker. Delivery vehicles are subject to inspection at any time.
What the website should store for each order:
- Order number, time placed and the store it was routed to.
- Delivery address and the zone check result.
- Customer name and date of birth as entered.
- Status steps with timestamps: received, packed, out for delivery, delivered or failed.
- Delivery outcome, including a refused or failed ID check.
Keep this in a form you can export. Our Minnesota dispensary website requirements guide covers how the state's other rules fit around it.
One caution on "live tracking". The sources above do not require a live map for customers, and we found no requirement for one on the pages we read. If you offer one, treat it as a convenience feature. Status steps are enough, and they are what the record needs.
Check your own regulator
Everything above is a snapshot from three regulators, read in November 2026. The pages we cite change, local ordinances add their own limits, and a state we did not cover may work differently. This is general information, not legal advice for your situation. Before you build, confirm the current rules with your state regulator and your own counsel, and run your site against a full cannabis website compliance checklist.
If you want a team to build the ordering flow around those rules, that is web development work we do.
Frequently asked questions
Can a cannabis delivery website limit delivery by address?
Yes. The site can check an address against the places your licence and local rules allow before checkout. New York, for example, bars delivery to public spaces, school grounds, day-care centers and houses of worship, and to anyone inside a motor vehicle.
Does the website need to check ID?
The regulators we read put the ID check at delivery. New York says ID and age must be verified at delivery, and Minnesota requires age verification before a delivery is completed. A date-of-birth field at checkout helps, but it is not that check.
What order records should the site keep?
Keep what your regulator requires. Minnesota, for example, requires each delivery to be logged in the statewide monitoring system and sets proof of delivery by rule. A good baseline is the order, address, zone result, customer details, status timestamps and delivery outcome.
Do I need live GPS tracking for customers?
Not according to the pages we reviewed. Status steps with timestamps are enough to meet the record needs described above. Check your own state's rules before promising or skipping a live map.