Is CBD Flower Legal? The Federal Rule, the State Bans, and Why an Officer Cannot Tell

Is CBD flower legal? Federally, the answer turns on one number measured on the day you are holding the material. Practically, it turns on two things almost nobody tells you: whether your state has banned the form rather than the cannabinoid, and the fact that nothing at a roadside separates legal hemp flower from illegal marijuana without a laboratory. This is general information about United States law as we read it on September 20, 2026, written for adults. It is not legal advice.

The short version, stated as two separate conditions. First, federal law as it stands today defines hemp by delta-9 THC alone, at a concentration "of not more than 0.3 percent on a dry weight basis" (7 U.S.C. 1639o, added by the 2018 farm bill on December 20, 2018). That definition is mid-change: a 2025 law rewrites it to a total tetrahydrocannabinols test that counts THCA, and a law enacted on September 2, 2026 moved the part of the rewrite that reaches raw flower to December 11, 2026. Second, and this is the condition that usually decides whether a reader has a problem, your state can leave CBD entirely legal and still reach flower, by banning the form, by banning only its manufacture, or by capping milligrams per package. For the general federal and state framework this page sits on top of, start with our overview of where CBD stands legally.

Is CBD flower legal? Two conditions, and one document

Almost every page that answers this question answers only the first part. "Federally legal under the 2018 Farm Bill, check your state" is true and it is half the story, and the half it leaves out is the half that produces consequences. Worth knowing why the federal half matters at all: under 21 U.S.C. 802(16)(B), the federal definition of marijuana excludes "hemp, as defined in section 1639o of title 7". Marijuana is cannabis minus hemp. Move the hemp line and you move the marijuana line with it, which is why a change to a definition in an agriculture statute rewrites what is a controlled substance.

1. 1Does the material meet the federal definition of hemp on the date you are holding it? That is a question about a laboratory number, not about a label, and the number the federal test asks for changes during 2026.
2. 2Has your state prohibited the form, prohibited one link in the chain, or capped the arithmetic? States regulate hemp separately, and a state that permits CBD in oils and edibles can still reach smokable flower.
3. 3Can you show the first answer with a batch-matched certificate of analysis? Nobody can read a percentage off a plant, so the paperwork is the only thing on your side of the exchange that carries a number.

One federal provision gets pressed into service here and is almost always quoted wrong. Section 10114(b) of the 2018 farm bill, printed as a statutory note on the same page of the U.S. Code as the hemp definition, says that "No State or Indian Tribe shall prohibit the transportation or shipment of hemp or hemp products" produced in accordance with the relevant subtitle, ending with the words "through the State". That is a rule about goods moving through a state. It is not a right to buy, sell or possess anything, and it is not the sentence "legal in all 50 states", which appears on many seller pages and is not something this provision says.

Hemp is a measurement, and flower is the hardest form to keep inside it

"Hemp" is not a variety, a look or a smell. It is a measurement result, and the measurement is not a raw delta-9 reading. The USDA's Domestic Hemp Production Program defines the compliance figure at 7 CFR 990.1, where both the "post-decarboxylation" and "decarboxylated" definitions print the same conversion: total THC equals 0.877 times THCA plus delta-9 THC. The rule says the formula "calculates the potential total THC in a given sample", and potential is the operative word. THCA is not delta-9 THC, but heat converts most of it, so the regulation counts what the material can become. We do not re-derive that arithmetic here; our page on hemp-derived THC works through the statutory numbers in detail.

That is why flower is the hardest form to keep inside the definition. A material can read well under 0.3% delta-9 and still compute far over the line once its THCA is counted, and the THCA figure on raw plant material is frequently the largest number on the page. The same rule builds in laboratory uncertainty rather than pretending it away: its own worked example takes a reported 0.35% with a measurement of uncertainty of plus or minus 0.06%, produces a distribution of 0.29% to 0.41%, and treats the sample as acceptable because that range includes 0.3%. Two honest caveats belong in the same breath. This is the crop regime, applied to a growing plant before harvest, not a finished-product rule for something on a shelf. And it is a total within the delta-9 class, which is a narrower thing than the "total tetrahydrocannabinols" the pending federal definition uses. For the molecule-level comparison behind all of this, see how THCA and CBD differ.

What changes federally, and the two dates page one is missing

On November 12, 2025, Public Law 119-37 was enacted. Its section 781 opens with a clock, "Effective 365 days after the enactment of this Act", and rewrites the hemp definition so that the quantity measured is a total tetrahydrocannabinols concentration, including tetrahydrocannabinolic acid, of not more than 0.3 percent. Three hundred and sixty-five days after November 12, 2025 is November 12, 2026. The same section also creates a category it calls a final hemp-derived cannabinoid product and excludes from hemp anything in that category carrying "greater than 0.4 milligrams combined total per container" of total tetrahydrocannabinols plus other cannabinoids that the Secretary of Health and Human Services determines have similar effects. Whether raw flower is a "final hemp-derived cannabinoid product" at all is not resolved in the text, and we are not going to resolve it for you.

The September 2 law is the piece missing from every page-one result we read. H.R. 6500 became Public Law 119-103 on that date, and the enrolled text provides at section 2019 that "Until December 11, 2026", the section 781 amendments "shall only apply with respect to products described in paragraphs (1)(C)(ii)(I) and (1)(C)(iv)(I)". Those two cross-references are, in the statute's own words, products containing cannabinoids "not capable of being naturally produced" by a Cannabis sativa L. plant. So the synthesized-cannabinoid exclusions arrive on November 12, and the total-THC redefinition, the one that matters most for raw flower, arrives on December 11. A Congressional Research Service In Focus dated August 17, 2026 describes the same measure, writing that it "would delay the effective date of most of the new hemp definition until December 11, 2026". CRS wrote that about a Senate-passed bill; the bill became law on September 2. We reported that split when it happened, in our newsroom item on the moved deadline, and the underlying section 781 rewrite has its own background explainer in what the 2026 hemp definition change does. One honest note about our own archive: that background page was published before September 2, 2026, and its bill-tracker table now carries a dated correction recording that enactment rather than a rewrite of its August snapshot. The dates in this section are the current ones.

The state layer has three shapes, not one

Seller "state guides" list states in one undifferentiated bucket, usually labeled legal, illegal or unclear. Real state rules have at least three different shapes, and the shape determines who is exposed and to what. A state can prohibit the form outright and reach the person holding it. A state can prohibit one link in the chain, such as manufacturing, and leave the rest alone. Or a state can prohibit nothing by name and still make retail flower effectively impossible with an arithmetic cap. Below are the three states whose current text we read on the day this was written. The FDA's cannabis page, which ranks for this question, does not answer it at state level at all.

Texas is the state every seller guide gets wrong. The prohibition itself is narrow: House Bill 1325 as enrolled in 2019 says the rules must reflect the principle that "the processing or manufacturing of a consumable hemp product for smoking is prohibited", and the same act defines smoking as burning or igniting a substance and inhaling the smoke, or heating a substance and inhaling the resulting vapor or aerosol. The department's adopted rule text, effective March 31, 2026, implements it in one sentence at section 300.104: "The manufacturing and processing of consumable hemp products for smoking is prohibited." Then read what the regulator itself says about reach. Its Consumable Hemp Program page, fetched September 20, 2026, records that the Texas Supreme Court upheld that statute on June 24, 2022 and that "At the same time, the lower court's injunction remains, which allows the distribution and retail sale of consumable hemp products for smoking." Its program FAQ puts it flatly: "However, retail sale and wholesale distribution of these products manufactured outside Texas is allowed." Neither page carries a last-updated stamp, so the date attached to those sentences is our read date. Separately, the March 2026 rules define the acceptable level by a THCA-inclusive total using the same 0.877 conversion, which is the provision that reaches high-THCA material. As reported by KUT, Austin's NPR station, on June 9, 2026, a state appeals court that day denied the hemp industry's emergency request to keep a temporary injunction against those rules in place, so they took effect again, with a department spokesperson quoted saying there was not yet a final disposition. That is journalism, not a court record we could read, and the position may have moved since.

Iowa goes furthest, and it is the clearest example of a state reaching the person rather than the supply chain. Iowa Code section 204.14A opens "A person shall not possess, use, manufacture, market, transport, deliver, or distribute harvested hemp or a hemp product" where the intended use is introduction into a human body by any method of inhalation, and it spells out what that includes: smoke produced from combustion, and devices such as a cigarette, cigar, cigarillo or pipe. Subsection (2) separately bars using, marketing or distributing a raw or dried flower form of hemp for the inhalation purposes described in paragraphs b or c of subsection 1, and requires a container notice that begins "This is a raw or dried agricultural commodity not suitable or intended for human consumption". Subsection (4) provides that "A person who violates this section is guilty of a serious misdemeanor." The definitions section closes the loop: section 204.2(2)(e) says a "'Consumable hemp product' does not include a hemp product if the intended use of the hemp product is introduction into the human body by any method of inhalation, as prohibited under section 204.14A." Note that the test is intended use, which is exactly why the container notice exists, and that subsection (5) carves out inhalation uses authorized under federal law.

Virginia is the shape nobody writes about, because there is no ban to point at. Section 4.1-600 defines a "hemp product" so that, when offered for retail sale, it "contains a total tetrahydrocannabinol concentration of no greater than 0.3 percent" and "contains no more than two milligrams of total tetrahydrocannabinol per package", and the same section defines total tetrahydrocannabinol as the sum, after any necessary conversion factor, of THC and THCA by weight. Do the arithmetic on the statute's own numbers. At the statutory maximum of 0.3%, 2 mg of total THC is reached by about 0.67 g of material (2 divided by 0.003 is 666.7 mg). A 3.5 g package at that same 0.3% carries 10.5 mg, more than five times the cap. There used to be an alternative route for CBD-rich products, a ratio of at least 25 parts CBD to 1 part total THC, and it was removed. You can see the removal happen on the page: section 3.2-5145.4 prints its version effective until August 15, 2026 with that alternative and its version effective from August 15, 2026 without it. That section governs industrial hemp extract rather than flower, and the same tightening appears in the retail hemp-product definition quoted above, which is the one that catches flower. Read the version labels carefully, because section 3.2-4112 publishes three timed versions side by side and the one in force on September 20, 2026 is the middle one. This describes the hemp-product definition only. Virginia also has a separate licensed retail channel, and we are not describing the whole of its cannabis law.

Three states, and that is deliberate. We tried to reach the current primary text for nine. Five state hosts refused automated access on the day we wrote this, and one state's provision turned out to be entangled in litigation we could not verify from a court record, so all six were dropped rather than described. We are not going to tell you those states are banned, legal or unclear, because we do not know what their text says today, and a stale list copied from a seller page or a 2021 roundup is exactly the failure this page exists to correct. Nobody on page one for this question publishes a fifty-state table with statute citations and effective dates, because doing it properly is expensive and doing it improperly is invisible to the reader.

1. 1Find your state's hemp chapter and read its definition of a consumable or retail hemp product. The exclusion is often inside the definition rather than in a prohibition, as it is in Iowa.
2. 2Search that chapter for the words "smoking", "intended for smoking" and "inhalation". A state can permit hemp-derived CBD in oils and edibles and still exclude the inhaled form in a single clause.
3. 3Read which verbs the prohibition uses: manufacture, process, sell, distribute, transport, possess. Those are not the same reach, and Texas and Iowa differ on exactly that point.
4. 4Check the arithmetic limits separately: a percentage cap, a milligrams-per-package cap, and whether the state counts THCA in its total. Virginia bans nothing by name and still caps a package at 2 mg.
5. 5Check the version date on the page you are reading, since state codes publish future-effective versions side by side, and confirm what you found against the state agency's own current program page.
6. 6Write down the date you read all of it, because that date is the only thing that makes your note usable later. Then take anything consequential to a lawyer licensed in that state.

Why nobody at the roadside can tell

Hemp and marijuana are the same species. The difference is chemotype, which is a chemical profile, not a botanical category, and a chemical profile is invisible. Genetics work such as a 2015 PLoS One study of marijuana and hemp population structure can separate the two populations at the level of the genome, and the inheritance work on cannabinoid chemotype explains why the chemical difference is heritable, but neither says anything an officer can use at the side of a road. The Congressional Research Service puts the same point in plain words: hemp and marijuana are from the same plant species, and regulators have characterized them by their chemical content. Our page on the botanical difference between hemp and marijuana covers the taxonomy this rests on.

The presumptive tests are not built for the job either. A 2025 paper in Forensic Toxicology from Japan's National Research Institute of Police Science, developing a new delta-9-specific color test reagent, states that the existing on-site color tests, including the rapid Duquenois-Levine and 4-aminophenol reagents, have "insufficient specificity", particularly for distinguishing delta-9 THC from other cannabinoids. Treat that source for what it is: a reagent-development paper whose authors have a patent pending on the replacement, from a non-US laboratory, describing the gap its own product would fill. The purpose-built post-farm-bill test has its own published limits. A 2021 validation study in the Journal of Forensic Sciences, three of whose five authors were at the DEA Special Testing and Research Laboratory, reports that the 4-aminophenol test "reliably produces a pink result" when the level of delta-9 THC is approximately three times lower than the level of CBD, and a blue result when it is approximately three times higher, and that "Inconclusive results are observed when the levels of THC and CBD are within a factor of three from each other". The authors describe its purpose as being to "presumptively identify materials prior to submission to a laboratory for analysis". A 2023 optimization study in the same journal also recorded "false positive results for the presence of THC (blue color) for samples of thyme and oregano". That was a bench optimization study rather than a field audit, and one sentence is all it supports.

Put those together and the structural problem is clear. The color test reports a ratio. The law asks for an amount. A ratio can be right and still tell you nothing about whether a sample is at 0.29% or 0.41%, which is the only question the statute asks. Federal law effectively concedes this, because it builds the answer out of laboratory work: 7 CFR 990.3 requires sampling within 30 days before harvest by a sampling agent, says that "Producers may not collect samples from their own growing facilities", and provides that after December 31, 2022 states and tribes must require that only laboratories registered with the DEA conduct the testing. That is the crop regime rather than a consumer-product testing scheme, and DEA registration is a registration, not an accreditation. The point stands anyway: even the government does not try to answer this question by looking at the plant.

The paperwork is the only thing that argues for you

Since nobody can read a percentage off a plant, the certificate of analysis is the only artifact in the transaction that carries a number, and a certificate that does not match the batch in front of you carries nothing at all. Some states have written that logic into law. Virginia, for example, requires at section 3.2-5145.4:1 that a hemp extract offered for sale be accompanied by a third-party certificate of analysis from an ISO/IEC 17025-accredited laboratory stating the total THC, with the accreditation certificate available for review at the point of sale, and provides that a disease claim on the label renders the product misbranded. That provision is about extracts and foods containing them rather than about flower, and it is worth reading as a sign of where certificates sit legally. We keep the mechanics on their own pages: how to read a certificate of analysis and what third-party tested actually certifies.

• The batch or lot code on the certificate matches the code on the material you are holding. A certificate for a different batch is a certificate about something else.
• The THCA line, read by you, not just the line the laboratory has chosen to print as "Total THC". A laboratory's total is its own summation convention, and the federal and Texas rules both print 0.877 times THCA plus delta-9 THC.
• The laboratory's accreditation and the scope it covers, which is a narrower thing than the word "accredited" on a website.
• The date of the report and the method it names, since a certificate is a statement about one sample on one day.
• Keep it with the material rather than in an inbox. And keep the limit in mind: it is evidence about a sample, not immunity for a person.

"CBD flower" and "THCA flower" are not the same legal object

Walk into a shop and the two sit on the same shelf, in the same jars, described in the same vocabulary. The search results merge them too: one page-one result we read on September 20, 2026 fuses both terms into a single title. They are not the same legal object, and the thing that separates them is not the packaging, the price or the name on the jar. It is one line on the certificate. We are not going to tell you how often a jar labeled one way holds the other, because that is not something we measured. What we can tell you is that under a total-THC test the THCA line is the line that decides the outcome, and the name on the jar plays no part in the calculation.

Here is the concrete version. On a hypothetical certificate reading 0.2% delta-9 THC and 20% THCA, the conversion that the USDA rule and the Texas rules both print gives (0.877 times 20) plus 0.2, which is about 17.7% total THC. The delta-9 line on that same report looks like a compliant number. The computed total does not, and two different governments print the same formula for computing it, which is the point. Note what this does not settle: which molecule is which and how they behave chemically is a separate topic, and we cover it in our comparison of THCA and CBD. Note also that a label percentage is not the same object as a laboratory result, which we get into in what a THC percentage actually tells you.

Putting it in the mail, and taking it through an airport

Shipping is its own body of rules, run by carriers as well as by governments, and we keep it on our page about mailing CBD. One point from the first section carries straight into it: the federal transit provision at section 10114(b) is conditioned on lawful production, and a package that is lawful to send through a state is not, by that fact, lawful to buy or hold in it.

Air travel adds a second set of rules on top of both the federal and the state layer, including the rules of wherever you land, and that also has its own page: flying with cannabis and hemp products. If your question is instead about how raw plant material holds up over time rather than about where you can take it, that is a storage question, and we answer it in whether cannabis goes bad.

What this page cannot tell you

This is general information, not legal advice, and it is not a state-by-state legal reference. We named three states because we read their own current text on September 20, 2026, and we said nothing about six others because we could not. Rules change, and two federal dates in this article are in the future as we write. There is also a measurement limit underneath everything above: two competent laboratories can hand you two different numbers for the same material. In NIST's first interlaboratory hemp exercise, 31 of the 68 laboratories that reported CBD in one hemp oil fell outside NIST's range of tolerance. That was hemp oils in 2020, deliberately educational, with no pass or fail grade attached, and it should not be stretched into a claim about flower testing. It is still a reason to treat any single number as a number from one laboratory on one day.

We are also not going to forecast. We will not tell you that the December 11 date will move, that the FDA lists will appear, that the Texas appeal will come out one way, or that enforcement will be strict or lax. The ceiling for this page is a sentence the nonpartisan Congressional Research Service published in a separate Insight on what the new definition means for federal enforcement, dated December 3, 2025 and therefore written before the September 2026 narrowing: while the change to the hemp definition "will seemingly alter the legal status of many hemp products" on the market, "it remains unclear if and how federal law enforcement will enforce the new prohibitions when the new definition goes into effect". What you can do is concrete: read your own state's current text, read the certificate rather than the jar, note the date you read both, and take anything that could become a legal problem to a lawyer licensed where you are. For the wider picture this page sits inside, the federal and state legal hub is the next thing to read, and the practical skill underneath every section above is going through a certificate line by line.