FTC and FDA Compliance Rules for CBD Product Claims

Before a brand can even think about what to say, it has to reckon with what it is legally permitted to sell. This is where the story gets strange, and, frankly, a little absurd.

Because CBD is the active ingredient in Epidiolex, the FDA-approved drug for certain epilepsy syndromes, federal law excludes it from the definition of a dietary supplement under the Food, Drug, and Cosmetic Act. This is the drug preclusion rule. Its downstream consequences are considerable: CBD cannot legally be added to conventional food or beverages, cannot legally be sold as a dietary supplement, and FDA has found no GRAS basis for it in human or animal food. These prohibitions apply regardless of what state law permits.

In January 2023, FDA issued its position: existing regulatory frameworks for foods and supplements are "not appropriate" for CBD. The agency denied three citizen petitions seeking a supplement pathway and announced it would pursue a new regulatory channel through Congress. That channel does not yet exist.

What this means practically is that most CBD products on shelves today exist in a zone of enforcement discretion, not legal authorization. That is a material distinction. Enforcement discretion means the agency has chosen not to act; it does not mean the product is lawful. A brand assessing risk needs to understand which condition it is operating under, because those are very different foundations on which to build a business.

The darkly ironic punchline: Epidiolex's approval, which proved CBD could be medically efficacious, is the precise reason the supplement path is closed. The drug that validated the category foreclosed the most natural route to market for that category. The industry got cured right out of its best legal argument.

What FDA Has Actually Said Constitutes a Prohibited Label Claim

FDA's primary enforcement concern is products marketed for therapeutic or medical uses without approval. Disease claims, which suggest a product treats, cures, mitigates, or prevents a disease, are categorically prohibited for unapproved products. Warning letters have cited explicit references to cancer, anxiety, chronic pain, and seizures, among others.

In 2024, FDA issued warning letters to seven companies over unapproved hemp cannabinoid products. The violations included unsubstantiated health claims, delta-8 THC content, and material safety risks. Among the flagged products: CBD eye drops and intravenous CBD formulations. That last category deserves a pause. A product delivered intravenously implies drug-level efficacy by form alone, independent of any written claim. The delivery mechanism itself functions as a disease claim in FDA's interpretive framework. No copy needed.

Animal product labeling is its own active enforcement area. CBD edibles for pets and livestock are treated as unapproved new animal drugs when they carry health claims. FDA has raised concerns about cannabinoid residues in food-producing animals and the safety implications for resulting meat and dairy, a concern most pet-focused CBD brands have not engaged with in any serious way.

The agency's documented safety concerns, including potential liver toxicity, drug interactions with CNS depressants, interaction with alcohol, and male reproductive toxicity observed in animal studies, are not hypothetical risks invented to justify regulatory posture. They are the substantive basis for why FDA treats deceptive marketing as a public health issue rather than bureaucratic box-checking: patients forgo approved therapies in favor of unproven products, and some of those patients are harmed.

Enforcement mechanics matter. Warning letters require a written response within 15 business days. Failure to address violations can escalate to product seizure or injunction. The clock starts immediately.

Where FDA Warning Letters Consistently Draw the Line in Practice

Warning letters are the most useful public record available for understanding where FDA's threshold actually sits. They identify precisely what language or presentation triggered a violation, which makes them far more instructive than the agency's guidance documents, which lean toward studied generality.

Recurring patterns across warning letters to hemp and CBD companies include: explicit disease references in product names or descriptions; customer testimonials on product pages describing relief from named conditions; structure/function language that implies treatment without naming a disease; and high-risk form factors like intravenous or ophthalmic delivery. The testimonial pattern deserves specific attention. A brand that did not write a testimonial but published it on its product page owns the claim. "I haven't had a panic attack since I started using this" is a disease claim. The fact that a customer wrote it is irrelevant.

Delta-8 THC has become its own enforcement category. Warning letters in 2024 addressed delta-8 products both for health claims and for safety risks inherent to the product form itself, not just the marketing language around it.

That raises a question: given the scale of the CBD market, why are there relatively few formal enforcement actions? The answer is enforcement discretion, and it cuts both ways. It signals that FDA is not systematically sweeping the market. It also means the decision to act is unpredictable. A brand cannot look at its neighbor's continued operation as evidence of permissibility. Enforcement discretion is not a safe harbor. It is a pardon that has not been issued yet.

The FTC's Substantiation Standard and What It Actually Requires

FTC's core rule for health claims in advertising is that a company must possess "competent and reliable scientific evidence," including human clinical studies, before making any claim that a product can prevent, treat, or cure a disease. The substantiation must exist at the time the claim is made. Not assembled afterward. Not in development. In hand, before the ad runs.

The scope of what triggers this standard is broader than most brands appreciate. Direct claims in ad copy, obviously. But also implied claims: a product named "Anxiety Away" carries an implied claim without a single word of additional copy. Website names and metatags can constitute claims, a position FTC has explicitly articulated. Customer testimonials framed as personal experience do not insulate a brand from liability for the underlying assertion.

Fine print cannot rescue an unsubstantiated primary message. The instinct to disclaim is strong, and understandable, but a disclaimer does not repair a fundamentally misleading claim; it just adds text beneath it.

The practical gap for most CBD brands is this: the clinical evidence base for CBD outside of epilepsy, Epidiolex's approved indication, is thin. Most therapeutic claims, including those for anxiety, pain, sleep disorders, cancer, Alzheimer's disease, heart disease, and hypertension, cannot meet the substantiation bar today. That is not a pessimistic reading. It is simply where the science currently sits, and wishing it otherwise does not change the enforcement calculus.

Operation CBDeceit and What the FTC's First CBD Enforcement Actions Established

In December 2020, FTC announced Operation CBDeceit, settling with six companies over deceptive marketing of CBD gummies, lozenges, oils, and balms. The claims at issue were not ambiguous: treatment or cure of cancer, heart disease, hypertension, and Alzheimer's disease. Direct therapeutic assertions in ad copy. Five of the six companies paid fines ranging from $20,000 to $85,000, representing the first time FTC imposed financial penalties specifically against CBD marketers.

The consent orders established two evidentiary standards going forward. Human clinical testing is required for prevention, treatment, and safety claims. Competent and reliable scientific evidence is required for other health-related claims. Both standards are defined by FTC. The brand does not get to determine whether its evidence meets the bar.

Individual liability deserves emphasis. The orders named corporate officers personally, a deliberate signal that FTC would pursue individuals rather than merely corporate entities. Compliance monitoring terms ran up to twenty years, making these settlements long-term operational constraints rather than one-time penalties.

What Operation CBDeceit did not resolve is equally important. It established consequences; it did not create a safe harbor. It told the market what would be penalized but not what would be permitted. Brands looking for the boundary of the permissible zone still had to reason backward from enforcement history, not forward from clear authorization. That remains true today.

How Influencer Marketing and Endorsements Expanded the Compliance Perimeter

FTC's revised Endorsement Guides took effect in June 2023, the first major update in roughly fourteen years. The core disclosure requirement: all material connections between a brand and an endorser, including payment, free product, and business relationships, must be clearly and conspicuously disclosed. Straightforward enough in principle.

The "unavoidable" standard is where execution typically breaks down. Disclosures buried in hashtag strings, or accessible only through a separate link, do not meet the standard. FTC specifically cited click-through disclosures as an example of what fails the test. If a consumer has to work to find the disclosure, the disclosure does not count.

Brand liability for third-party content is the element most brands have not fully internalized. A brand is liable for unsubstantiated claims made by influencers it works with, even when the post is framed as personal experience. Retweeting or republishing a third-party statement transforms it into a brand endorsement; liability can attach even without a direct payment relationship.

The National Advertising Division has also reviewed and referred hemp and CBD campaigns for unsupported efficacy claims, adding a private-sector enforcement layer beneath the two federal agencies. The compliance perimeter now extends to every piece of content produced by or amplified by anyone connected to the brand. Most brand compliance programs have not operationally caught up to that reality.

The Copycat Packaging Problem and How Joint FDA/FTC Enforcement Targets It

One of the clearer signals that FDA and FTC are building a coordinated approach to the hemp market, rather than operating in parallel silos, is the emergence of joint warning letters targeting copycat packaging.

In July 2023, the agencies sent joint warning letters to six companies marketing edible delta-8 THC products in packaging nearly identical to Doritos, Cheetos, Nerds, and similar products. In July 2024, a second set of five joint warning letters went to Hippy Mood in Pennsylvania, Earthly Hemps in Florida, Shamrockshrooms.com, Mary Janes Bakery Co. LLC in Florida, and Life Leaf Medical CBD Center in South Carolina.

The agencies' stated rationale is that children are less likely to read or understand label text, making packaging design itself a deceptive practice when it mimics familiar food products. This is a notable expansion of the enforcement framework: visual design, not just written claims, can constitute a deceptive or misleading representation under both agencies' standards.

It is also worth considering what this coordination signals about trajectory. Joint letters require coordination, shared resources, and aligned priorities. The two agencies are not merely watching the same market; they are acting on it together. A brand with a health claim problem and a packaging problem is not managing two separate enforcement risks. It is managing one coordinated one, and the relevant question is whether its compliance program reflects that.

Subscription Billing and "Dark Patterns" as a Separate FTC Exposure for CBD Brands

In December 2025, FTC returned $27.6 million to over 1.2 million consumers harmed by unauthorized billing schemes involving CBD and other wellness products. The companies at issue, Legion Media, KP Commerce, and related entities, had enrolled consumers in auto-renewing programs without adequate disclosure or accessible cancellation paths. The violations were not about health claims. They were about billing structure.

This is a compliance category that many CBD brands, focused reasonably on substantiation and labeling, have underweighted. CBD's direct-to-consumer model, common for oils, gummies, and topicals, makes subscription billing structures pervasive. Pervasive means widespread exposure.

FTC's "Click-to-Cancel" Negative Option Rule was vacated by the Eighth Circuit in July 2025, just before its effective date. Vacatur reduces exposure but does not eliminate it. FTC continues pursuing subscription dark pattern cases under Section 5 of the FTC Act. The Restore Online Shoppers' Confidence Act remains in force for online auto-renewals. Civil penalties can reach tens of thousands of dollars per knowing or reckless violation.

The $27.6 million refund action signals something worth noting: FTC is willing to pursue large-scale consumer restitution, not just consent orders, when billing practices cause widespread harm. That is a materially different enforcement posture than issuing a letter and moving on. Whether a brand's subscription flow is actually clear and cancellable is now a compliance question with the same practical urgency as whether its claims are substantiated.

How the November 2025 Continuing Resolution Changes the Compliance Baseline Going Forward

On November 12, 2025, Congress enacted Section 781 of the Continuing Appropriations Act, the most consequential federal hemp legislation since the 2018 Farm Bill. Its implications have not yet been fully absorbed by most of the market, which is itself a compliance risk.

The key definitional changes take effect November 12, 2026. Hemp will be defined by total THC content across the product, not solely delta-9 THC concentration. Products with more than 0.4 mg per container of combined tetrahydrocannabinols, or cannabinoids marketed to produce similar effects, fall outside the hemp definition. Cannabinoids synthesized or manufactured outside the plant are excluded from the hemp definition regardless of their chemical similarity to naturally occurring compounds.

Why does this matter for marketing compliance specifically? Because if a product is reclassified out of the hemp definition, the entire regulatory framework it operated under shifts. The product faces drug or controlled substance treatment instead. The claims the brand was making, the labeling it was using, the advertising standards it was applying: all of it recalibrates simultaneously.

Products currently marketed as hemp-derived that exceed the new thresholds will need reformulation, reclassification, or withdrawal before the effective date. That is roughly a one-year runway, which sounds sufficient until a brand factors in reformulation timelines, labeling redesign, and regulatory review.

What the new framework does not resolve is equally significant. It narrows the hemp category substantially but does not create the new CBD regulatory pathway FDA said in January 2023 it would seek from Congress. Brands still lack a clear, legal route to sell CBD as a supplement or food additive. The terrain is narrower. The destination remains uncharted.

What Permissible Marketing for CBD Products Actually Looks Like in Practice

The permissible zone is narrower than most CBD marketing in the market would suggest. That gap between market practice and legal permissibility is, frankly, striking, and it has persisted long enough that it cannot be attributed entirely to ignorance.

What generally holds up: non-therapeutic language describing the product itself, its sensory characteristics, its ingredients, its sourcing, and its manufacturing process. Accurate information about hemp as a plant. General wellness framing that stops well short of physiological claims. "Made with full-spectrum hemp extract" is a factual description. "Supports your body's natural balance" begins to imply mechanism and invites scrutiny. "Relieves anxiety" is a disease claim and draws enforcement. The gradient matters.

Structure/function claims, permissible for dietary supplements under specific statutory conditions, are not legally available to CBD products given the drug preclusion problem. A brand cannot claim the benefit of a framework that does not apply to it.

Customer testimonials require active management, not passive publication. If a testimonial describes a therapeutic outcome, the brand owns that claim the moment it appears on the product page. Testimonials should be reviewed against the same substantiation standard as any other marketing claim; publishing them without review is not a neutral act.

For brands working with influencers, the compliance obligation extends to every post an influencer creates in connection with the brand relationship, not just the ones the brand drafted or approved. Contracts, content review protocols, and documented substantiation standards are operational necessities.

But what if a brand believes the evidence supports a particular claim? Here is where I have to be direct: belief is not the standard. The FTC's standard is possession of competent and reliable scientific evidence, specifically human clinical data, at the time the claim is made. Belief, anecdote, and even preclinical data do not satisfy it.

I have had some version of this conversation more times than I can count. A founder tells me their product changed their life, their customers love it, and the testimonials are real. All of that is true. None of it constitutes substantiation. The certainty is real. The evidence is not. And the gap between what this industry believes about its products and what the evidentiary record can currently support is, more than anything else, the central compliance problem that has not been resolved.

The brands navigating this most effectively have accepted the constraint rather than tried to engineer around it. They compete on ingredient quality, sourcing transparency, manufacturing standards, and consumer education, without making claims the science cannot yet carry. That is a significant marketing limitation. Given the current landscape, it is also the most defensible position available.