Why Your CBD Bottle Carries a California Prop 65 Warning

You bought a CBD tincture in Ohio, or Texas, or Florida, and there is a yellow triangle on the carton telling you something about California. That box is a Proposition 65 warning, usually shortened to Prop 65. Nothing about the oil changed when it crossed a state line, so the warning is not describing the liquid. It is describing a California law, and the chemical that law names is delta-9-THC. Cannabidiol is not on the list at all.

Here is the short version, and everything below was checked against primary records on September 5, 2026. Proposition 65 is a 1986 California ballot initiative that requires a warning before a business knowingly and intentionally exposes someone to a chemical the state has listed. California listed delta-9-THC on January 3, 2020, and the warning requirement took effect twelve months later. It never listed CBD. In the rulemaking document that created the cannabis warning rules, California's Office of Environmental Health Hazard Assessment wrote that while delta-9-THC is on the Proposition 65 list, cannabidiol and other cannabinoids in cannabis are not. Several of the pages that rank for this question tell companies the opposite. That is worth knowing about the pages themselves: every page-one result we read on September 5, 2026 is either a law firm or insurance alert addressed to a company that might be sued, or a brand's own one-paragraph disclaimer. Not one of them is written for the person holding the bottle.

What a Prop 65 warning on a CBD label actually is

Proposition 65 is the Safe Drinking Water and Toxic Enforcement Act of 1986, Chapter 6.6 of Division 20 of California's Health and Safety Code. It was added by ballot initiative on November 4, 1986 and became operative on January 1, 1987. Most people meet it as a yellow triangle at the entrance to a parking garage or on the tag of an extension cord, which is why it reads as background noise. It is not noise. It is a disclosure duty with a private right of action bolted to it, and that combination is the entire reason a box turns up on a hemp tincture.

The duty itself is one sentence long. Section 25249.6 reads: "No person in the course of doing business shall knowingly and intentionally expose any individual to a chemical known to the state to cause cancer or reproductive toxicity without first giving clear and reasonable warning to such individual, except as provided in Section 25249.10." Read the last clause together with the rest of it, because quoting the duty without the exception is what most summaries do. Section 25249.10 carries the exemptions, and two of them do real work in this story: a twelve month grace period after a chemical is listed, and an exemption for an exposure a business can show has no observable effect at 1,000 times the level in question.

The other half of the machinery is who gets to enforce it. Under Section 25249.7, the Attorney General, a district attorney, the city attorney of a city with more than 750,000 people, or a city prosecutor with the district attorney's consent may bring an action. So may any private "person in the public interest", provided the action is commenced more than 60 days after that person gives notice of an alleged violation to the Attorney General, to the local prosecutor and to the alleged violator, and provided the notice includes a certificate of merit stating that someone with relevant experience or expertise has reviewed the facts and that there is "a reasonable and meritorious case for the private action". Civil penalties are set at an amount "not to exceed two thousand five hundred dollars ($2,500) per day for each violation", and the same section lists the factors a court weighs in setting one.

The listed chemical is THC, and CBD is not on the Prop 65 list

California's Proposition 65 list is published as a regulation at Title 27 of the California Code of Regulations, Section 27001, and OEHHA posts it as a downloadable file in two formats: a PDF, and a spreadsheet that carries two columns the PDF does not, the listing mechanism and the safe harbor level. In the version dated July 31, 2026, three cannabis-related entries appear. None of the three is struck through, which is how the file marks entries that have been removed, so all three are active listings as of our read on September 5, 2026.

SQE is the spreadsheet's own abbreviation for State's Qualified Experts, meaning the listing came from a state committee rather than from a federal agency's finding. For these three entries that committee is the Developmental and Reproductive Toxicant Identification Committee. Two things in that table are worth slowing down for. The first is the cancer entry: it is eleven years older than the other two, it is dated June 19, 2009, and it is about smoke. That entry is where the word cancer in the familiar Proposition 65 boilerplate comes from. It is not something the delta-9-THC listing says, and the exposure it names is not a bottle of oil you swallow.

The second is the one the search results get backwards. Cannabidiol is not on that list, under any spelling. OEHHA said so in plain words in the Initial Statement of Reasons dated February 2021, the document in which it proposed the cannabis warning regulations.

In the same passage OEHHA goes on to say that products made with CBD or other cannabinoids, or with purified extracts of the cannabis plant, that do not cause exposures to delta-9-THC or other Proposition 65 listed chemicals within the meaning of Health and Safety Code Section 25249.10(c), "do not require a warning". Its own worked example is a topical lotion made with CBD that has trace but unquantifiable levels of delta-9-THC. Two cautions belong in the same breath as that sentence. It is a 2021 rulemaking statement about how the agency understood the rule it was writing, not a determination about any particular product on any particular shelf. And it hangs on Section 25249.10(c), whose burden, as you will see in a moment, sits on the business rather than on the state. Nothing here tells you, or any brand, whether a warning is required for a specific product.

Whether a given bottle causes a delta-9-THC exposure at all depends on how the extract was made, which is the full spectrum, broad spectrum and isolate question. Our guide to CBD spectrums covers that difference properly. The short version for this page is that the three are not interchangeable here: a full spectrum extract is not made by removing THC, so the spectrum word on the front of a bottle is the first thing worth checking.

Two dates, and the twelve months between them

California listed delta-9-THC and cannabis (marijuana) smoke on January 3, 2020 for the developmental toxicity endpoint, on the findings of its Developmental and Reproductive Toxicant Identification Committee. We are reporting that as exactly what it is: a listing decision, made on a date, under a stated endpoint, by a named committee. This article makes no statement about what delta-9-THC does or does not do in pregnancy, in either direction, because that is not a question a labeling statute answers. The evidence document the committee considered is public. If you want to read it yourself it is OEHHA's 2019 hazard identification document on cannabis smoke and delta-9-THC. We are linking it and deliberately saying nothing about its contents.

The second date is arithmetic rather than a separate decision. Health and Safety Code Section 25249.10(b) exempts "an exposure that takes place less than twelve months subsequent to the listing of the chemical". Twelve months after January 3, 2020 is January 3, 2021, and OEHHA states that result in the same 2021 document: the warning requirement for the developmental endpoint took effect on January 3, 2021. The third date on the cards above belongs to the regulation rather than to the listing. It is October 1, 2023, when the cannabis-specific warning text finished its phase-in, and we come back to it in the next section.

Our separate article on CBD during pregnancy and breastfeeding is where that subject belongs, and it covers what the FDA has said and what the human evidence does and does not show. One line from the same 2021 OEHHA passage is worth carrying over here, because it is a regulator describing the limits of its own review: "The scientific evidence on harm from exposures during pregnancy to CBD and other cannabinoids beside delta-9-THC has not been reviewed." Read that as what it says. It is neither reassurance nor alarm.

The two warning boxes, side by side

The cannabis-specific warnings live at Title 27 of the California Code of Regulations, sections 25607.38 through 25607.47. That citation is worth printing correctly once, because it circulates in several wrong forms; this one comes from the cover page of OEHHA's Final Statement of Reasons, dated June 2022. The Office of Administrative Law approved the sections on August 4, 2022 and they became effective on October 1, 2022 with a one year phase-in, so the adopted text turns on October 1, 2023, the date printed inside Section 25607.40. OEHHA describes what it adopted as "non-mandatory, specific safe harbor exposure warning methods of transmission and content". Hold on to that adjective. A safe harbor is a way for a business to be certain that a warning counts, not an instruction to warn.

It matters because the box most people picture is not the box the cannabis regulation prescribes. Here they are next to each other, both reproduced from the regulation as it appears in OEHHA's compilation of the Proposition 65 regulations, updated February 2025, which OEHHA labels an unofficial copy and which points readers to the commercial publisher for the current text.

Three checkable observations follow from that table, and each one is small enough to verify on a real carton. First, the cannabis text for something you swallow does not contain the word cancer anywhere. The variant that does, at Section 25607.41(a)(3)(B), applies only where the product also exposes consumers to a listed carcinogen, and it requires that carcinogen to be named. The text that opens "Smoking cannabis increases your cancer risk" is Section 25607.39, and it is about smoke. Second, the short form warning that most consumer products may use is excluded here by Section 25607.40(a); OEHHA's stated reason in the 2021 rulemaking record is "so that consumers receive the full safe harbor warning language so they can be made aware of the specific effects the exposures can cause to unborn children". Third, the two boxes point at two different web pages, and the address printed inside your box is the quickest way to tell which of them you are looking at.

Why there is no safe number for delta-9-THC

California can adopt a safe harbor level for a listed chemical: a No Significant Risk Level for a carcinogen, or a Maximum Allowable Dose Level for a reproductive toxicant. Where one exists, a business has a published number to measure an exposure against. For delta-9-THC there is no such number, and we checked that two ways on September 5, 2026. On the July 31, 2026 version of the official list, the NSRL or MADL column on the delta-9-THC row is empty. In the MADL table itself, at Title 27 Section 25805(b) as reproduced in OEHHA's compilation updated February 2025, there are 47 chemical entries and not one of them is cannabis, THC or delta-9 anything; the table runs from sulfur dioxide to thiophanate-methyl to toluene with nothing in between.

Law firm alerts written between 2020 and 2023 tell companies that no safe harbor level has been established for THC, usually with no date and no document attached to the sentence. It is still true today, and we would rather you could check it than take our word for it, which is why the two documents and the read date are in the paragraph above. What none of those alerts adds is the context, and the context is the interesting part, so we counted it ourselves off the same list file.

The method, so you can rerun it: OEHHA publishes the list as a spreadsheet as well as a PDF. We counted the rows below the header that carry a chemical name and are not struck through, which gives 1,020 rows across 950 distinct chemical names, because a chemical with both an oral and an inhalation level occupies two rows. Then we counted the non-empty values in the NSRL or MADL column. Those are rows, not chemicals, and the two numbers should not be mixed. The point of the count is simple: having no adopted safe harbor level is the ordinary condition of a Proposition 65 listing, not a special judgment about cannabis.

The absence does have a consequence, and it is written in the statute rather than in anybody's opinion. Section 25249.10(c) exempts an exposure for which the business "can show" there is no observable effect at 1,000 times the level in question, and then adds: "In any action brought to enforce Section 25249.6, the burden of showing that an exposure meets the criteria of this subdivision shall be on the defendant." A published safe harbor level is the cheap way to carry that burden. Without one, a business has to build the showing itself. That is the whole mechanism, and it explains the thing worth taking away from this page: a warning is a legal position, and the delta-9-THC figure on a certificate of analysis is a measurement. They are different objects, and only one of them is about the liquid.

Why a bottle sold in Ohio carries a California Prop 65 warning

Four steps, and the first three are documented in the statute and the regulation. Step one: the duty attaches to an exposure, and the exposures this Act regulates are Californian ones. It is a California statute, enforced in California courts, and the safe harbor rules are California regulations.

Step two: the statute deliberately pushes the label onto the manufacturer. Section 25249.11(f) directs that regulations implementing the warning duty "shall to the extent practicable place the obligation to provide any warning materials such as labels on the producer or packager rather than on the retail seller". The shop that sold you the bottle is not the party the Act expects to design a warning. The same section, at subdivision (b), also puts a business employing fewer than 10 people outside the definition of a person in the course of doing business.

Step three: the regulation gives that producer exactly two routes, at Title 27 Section 25600.2(b). It can put a compliant warning on the product label or labeling. Or it can send a written notice to the retail seller's authorized agent with all the necessary warning materials attached, renewed annually for as long as the product is sold in California by a retail seller. Route one is a printing decision made once. Route two is an administrative relationship maintained every year with every retailer.

Step four is not law and we are marking it as such. A national print run has one artwork. In practice, a brand that ships to every state and chooses the label route commonly prints one label, and that label goes into every box regardless of destination. That is a manufacturing and distribution observation, not a legal requirement, and nothing in Proposition 65 tells anybody to warn Ohio. The cheapest compliant label is the one you only have to design once, which is why the carton in your kitchen is addressed, in part, to somebody in Sacramento.

What the enforcement record actually looks like

Proposition 65 enforcement is public and searchable, which is unusual and useful. The California Attorney General publishes every 60-day notice in a Proposition 65 60-day notice database that anyone can query without a login or a key. The numbers below are ours. We pulled them on September 5, 2026, and the method is printed underneath so you can rerun them and get the same answer.

The shape of the right-hand column is the story. Before 2021 it is zero, all the way back to the earliest cannabis-related notice in the database on December 3, 2014. That is not a hole in the data. The chemical was not listed until January 3, 2020, and Section 25249.10(b) exempted exposures for the following twelve months, so 2021 is the first year in which a delta-9-THC notice could be filed at all. The series begins the year the exemption ended, at 6 notices, and it reaches 100 by September 4, 2026. Two separately sourced legal facts and one visible consequence in a public database, and none of the results we read on page one for this question on September 5, 2026 draws the line between them.

Filter the same database by the word CBD in the product field instead and you get 53 distinct notices between 2021 and September 4, 2026: 7, 1, 10, 7, 11 and 17 by year. Forty-nine of those 53 name a delta-9-THC listing as the chemical. The other four name marijuana smoke, diethanolamine, DEHP, or no listed chemical at all. So when a CBD product turns up in this record, the chemical named is almost always the THC. Across the 235 delta-9-THC notices there are 208 distinct alleged violators.

The method and its caveats, because a number without them is not worth publishing. We used the Attorney General's own chemical filter (its taxonomy values 902 for marijuana smoke, and 1020 and 1021 for the two spellings of the delta-9-THC listing) and its product-text filter for CBD, at 100 results per page. The results header counts rows, not notices: the CBD query reports 262 notices in its header, and those 262 rows resolve to 53 distinct Attorney General numbers, because the view emits one row per notice per chemical per alleged violator. Every figure above is a count of distinct notice numbers. A 60-day notice is an allegation of a violation, not a finding, a lawsuit or a judgment. One notice can name several products and several alleged violators. 2026 is a partial year here, covering January 16 through September 4. And the notices are concentrated by filer: Proposition 65 allows any person to enforce it in the public interest after a 60-day notice, and in this dataset 180 of the 235 delta-9-THC notices, about 77 percent, came from a single noticing party or its name variants. We report that as structure. We name no alleged violator, because these are unresolved allegations against real companies.

What the box tells you about the bottle in your hand

Here is the honest version, and it cuts in both directions. The presence of a Proposition 65 warning does not mean this batch failed a test, exceeded a limit, or was found by anyone to contain anything in particular. Nobody measured your bottle in order to decide whether to print the box. And the absence of a warning does not mean the bottle has no THC in it. A brand can arrive at a no-warning position more than one way, and none of them is visible from the outside of a carton.

So the box is not the thing to read. The thing to read is the certificate of analysis for the batch number printed on your bottle, because a certificate is a measurement of the liquid rather than a legal position about it. Five steps:

1. 1Find the certificate for the batch printed on your bottle, not a generic certificate linked from a product page. The batch on the certificate has to match the one on the label.
2. 2Read the delta-9-THC row. It reports either a percentage and a milligram figure, or ND, meaning the lab did not detect it.
3. 3If the row says ND, look at the detection limits printed beside it. An ND is a result measured against a floor, and the floor is on the same page.
4. 4Check the production date and the test date. A certificate for a different batch is a certificate for a different product.
5. 5If you are pregnant or nursing, or you take prescription medication, take the question to a clinician rather than to a label.

What each of those numbers means, and what the abbreviations beside them stand for, is the job of our walkthrough of a certificate of analysis. The rest of the printing on the carton, the front panel milligrams, the Supplement Facts panel and the batch code, is covered in our guide to reading a CBD label. This article stops at the warning box, which is the one element of that label nobody explains to the person buying the bottle.

What our own certificates show

One reason we can be specific about the gap between a legal posture and a measurement is that our own certificates disagree with each other in a useful way. All four batches were tested by Infinite Chemical Analysis Labs in San Diego, California license C8-0000047-LIC, and every figure below is printed on the certificate itself. The three Broad Spectrum batches were produced on April 1 and April 2, 2026; the Full Spectrum batch was produced on March 18, 2026. Each certificate states its own package size in its header: 56.7 g, in a 60 mL bottle.

Read the first three rows again. Same product line, same laboratory, produced on April 1 and April 2, 2026. Two Broad Spectrum batches report non-detected and 0.000 mg per package. The third Broad Spectrum batch, the lemon one, reports 10.7 mg of delta-9-THC in the bottle. "THC removed" and "no detectable THC" are not the same sentence, and our own certificates are where we learned to stop using them as if they were. Across the nine full spectrum certificates in the line, the delta-9-THC column runs from 0.129 percent to 0.252 percent, which the same certificates print as 73.1 mg to 143 mg per package. That range is one column, one set of nine certificates, one denominator.

Two notes so those numbers are not read as more than they are. First, the ND rows print their own detection limits beside the result: on batch 260320 the delta-9-THC limits read 0.0460 and 0.172, and what those two numbers are is explained in the certificate walkthrough linked above rather than here. Second, we are quoting the delta-9-THC column throughout, because delta-9-THC is the chemical the Proposition 65 listing names. On one certificate in that set of nine, the CBD+CBN Lemon batch 260312, the Total THC line reads 0.163 percent and 92.4 mg while the delta-9-THC line reads 0.143 percent. It is the only one of the nine where the two lines differ, and we would rather print that than tidy it. The arithmetic that converts a percentage into the federal hemp threshold is a separate subject, handled in our article on hemp-derived THC.

Every certificate we have, including the ones with numbers on them rather than an ND, is posted on our lab results page. None of this makes our products safer, cleaner or better than anybody else's, and it is not offered that way. It makes them legible, which is the only claim a certificate can support.

What this article is not

This is a description of a California statute and its public record, dated to our read on September 5, 2026. It is not legal advice, and it does not tell any business whether a warning is required for its product. Where OEHHA describes its own regulation we quote it and we do not construe it. Where the record is a rulemaking statement from 2021 we say so, because agencies revise their positions, the chemical list is republished several times a year, and the compilation we quote from labels itself unofficial.

It also makes no statement about whether delta-9-THC does or does not cause developmental harm. What we reported is a listing: California added a chemical to a list, on a date, under a stated endpoint, on the findings of a named committee. The hazard identification document behind that decision is public and linked earlier in this article, and we have deliberately not summarized, quoted or characterized it. If the question you actually have is about pregnancy or nursing, it belongs with a clinician and with our article on CBD, pregnancy and breastfeeding, not with a box on a carton.

And Proposition 65 is state law. It is not an FDA rule, an FDA approval or an FDA safety finding, and a warning box says nothing about federal status in either direction. The federal picture, including the fact that the FDA has approved one CBD medicine and has not approved CBD as a dietary supplement, is a separate subject we cover in what the FDA says about CBD.

Questions people actually ask

If the box is what brought you here, the next useful thing is not more Proposition 65. It is the certificate for the batch you already own, and then the wider question of what actually separates one bottle from another. Our guide to choosing a CBD oil is the hub for that, and the certificate of analysis walkthrough is the page to keep open beside a real report.