Dispensary website age gate requirements by state, 2026

Does a dispensary website need an age gate? It depends on which state's rule you're reading. New York requires an interactive age-restriction mechanism, in practice a splash page, before a visitor can reach cannabis advertising content. Washington's current rule asks for a visible text disclaimer and nothing more. California requires an age-affirmation step, but only for direct, individualized communication, not a public marketing page. Colorado's guidance stays focused on checking ID at the door. Below is what each regulator's own text says, sourced directly.

What it is and why it matters

An age gate, in the strict sense, is an interactive mechanism a visitor has to clear before reaching content: a splash page, a click-through, a birth date field. A disclaimer is a different animal. It's just text on the page stating a rule, for example "products may only be purchased by persons 21 and older", that a visitor never has to interact with.

Operators get this distinction wrong in both directions. Some assume a disclaimer line in the footer satisfies every state's rule. Others assume every state requires an interactive splash page because one prominent state does. Neither assumption survives contact with the regulations themselves.

New York goes furthest. Its Part 129 marketing and advertising guidance requires that "a licensee who advertises via a website or digital application shall have a mechanism designed to require a visitor to such website or digital application to verify that the visitor is 21 years of age or older." That's a mechanism requirement, not a disclaimer requirement, and it applies broadly to advertising visitors rather than a narrow subset of them.

What follows is a walk through how New York, Washington, California and Colorado differ on this point. "Does my site need an age gate" only has a useful answer once you know which state's rule is actually in scope.

How it works in practice

New York: the mechanism requirement

Part 129 doesn't stop at the age-restriction mechanism. Certain ad formats also have to reach an audience where at least 75.9% of viewers are 21 or older, matching New York State's own adult population share. Unsolicited pop-up or banner advertising is barred outright, online and in apps, except on age-restricted sites where the 21-plus visitor has already agreed to view them. Promotional pricing is boxed in too: it can only run through channels already limited to a verified 21-plus audience, direct email or SMS, say, or a licensee-approved third-party site with an age-restricted audience.

New York isn't the only state with its own detailed dispensary website rulebook. Minnesota's requirements diverge in several places worth checking directly if you operate there; see Minnesota's own dispensary website rules for that state's specifics.

Washington: disclaimer today, a gate under petition

Washington's current advertising rule, WAC 314-55-155, takes a lighter touch. It requires that "all advertising for cannabis businesses or cannabis products" carry text, clearly visible, stating that the products may be purchased or possessed only by persons 21 years of age or older. That's a disclaimer, not an interactive mechanism. Nothing in the current rule requires a click-through or a birth date field before a visitor can see the page.

That may not stay true for long. In September 2025, a petition was filed asking the Washington State Liquor and Cannabis Board to add an online age-verification requirement for cannabis retail licensees. As of this writing, that petition hasn't been adopted into rule. Operators in Washington should watch the docket rather than build against a requirement that isn't there yet.

California: age affirmation, but scoped to direct communication

California sits in between. Under Business and Professions Code section 26151 and California Code of Regulations section 15040(a)(1), any advertising or marketing involving direct, individualized communication or dialogue controlled by the licensee must use a method of age affirmation, such as user confirmation, birth date disclosure, or a comparable registration method, to verify the recipient is 21 or older before that communication happens.

Scope is the key word. This duty attaches to direct, individualized channels: an email list, an SMS program, a logged-in account experience. A public marketing page without a login or a messaging component sits in a greyer area than it would under New York's broader mechanism requirement.

Colorado: verification stays on the retail floor

Colorado's Marijuana Enforcement Division frames age verification almost entirely around the physical store. Its industry-wide bulletin on underage sales requires licensees to check a valid, government-issued photo ID before allowing entry to the restricted access area, and again before completing a sale. Public MED guidance doesn't codify an equivalent website-gate mechanism. For a Colorado dispensary, the compliance obligation on the website itself stops at general advertising content restrictions, not a specific access-gating mechanism.

Tradeoffs and edge cases

Here's the gap operators actually fall into: building one age gate and assuming it satisfies every state they serve. It doesn't, because the underlying legal duty differs in kind, not just in wording. New York's rule reaches all advertising visitors. California's reaches direct-dialogue channels only. Colorado hasn't codified a website duty at all. A gate engineered to New York's standard will over-comply almost everywhere else; a disclaimer engineered to Washington's current standard under-complies in New York today.

There's a federal layer on top of all this, and it's easy to miss because it isn't cannabis-specific. The FTC's 2026 enforcement policy statement on age-verification technology gives operators a safe harbor under COPPA for age-verification tools used solely to determine a visitor's age, so long as the data collected isn't retained or reused for any other purpose, gets deleted once verification is complete, and any third-party vendor handling it has been vetted for confidentiality and security. An age gate that quietly doubles as a marketing opt-in, or stores birth dates longer than the verification step requires, creates exposure no state cannabis regulator asked for.

Match the gate's legal function, mechanism, disclaimer, or affirmation-on-dialogue, to the state the visitor is actually in. Treat Washington's pending petition as a signal to watch, not a rule to build against. This is the kind of state-by-state mapping we build into the launch checklist when building a compliant dispensary website at Kallos Labs, because getting the gate's scope wrong is a compliance problem, not a design one.

Frequently asked questions

Does every state require a cannabis website to have an age gate?

No. New York requires an interactive age-restriction mechanism under Part 129, but Washington's current rule only requires a visible 21-plus text disclaimer, and Colorado's public guidance addresses in-person ID checks without a website-specific mechanism. The honest answer is state by state, not a single national rule.

Is a simple "Are you 21 or older?" button enough to comply?

It depends on the state and the channel. New York's splash-page requirement is satisfied by a visitor-facing verification mechanism, and California accepts user confirmation as one valid age-affirmation method. But California's duty applies specifically to direct, individualized communication rather than every public page, so the same button can be enough in one state and beside the point in another.

Does an age gate on a dispensary website create a data privacy problem?

It can, if it collects more than it needs. The FTC's 2026 enforcement policy statement gives operators a safe harbor for age-verification technology used solely to determine a visitor's age, provided the data isn't retained or reused beyond that purpose and any third-party verification vendor is vetted for confidentiality and security.

Is Washington about to require an online age gate for cannabis retailers?

A petition asking the Washington State Liquor and Cannabis Board to add an online age-verification requirement was filed in September 2025, but as of this writing it hasn't been adopted into rule. Operators should track the docket rather than build against a requirement that doesn't exist yet.