Influencer Marketing Rules for Hemp and CBD Products
The 2018 Farm Bill created the hemp industry as we know it, predicated on one threshold: Delta-9 THC below 0.3% by dry weight. What it did not create was an aggregate THC limit, and that gap is what allowed a proliferation of hemp-derived cannabinoids, including Delta-8 THC, to occupy a legal gray zone for the better part of seven years — long enough that many brands stopped treating the fog as a problem and started treating it as the forecast.
The November 2025 Continuing Appropriations Act closed that gap in three specific ways: it excludes cannabinoids not naturally producible in the Cannabis sativa L. plant; it excludes cannabinoids synthesized or manufactured outside the plant; and it caps final products at no more than 0.4 milligrams per container of combined tetrahydrocannabinols and cannabinoids marketed to produce THC-like effects.
That last condition is where most campaign exposure actually lives. The word "container" is not yet settled in FDA rulemaking. Whether a single-serving beverage, a multi-dose tincture, or a multi-pack of gummies constitutes a "container" for purposes of the cap will determine which product formats survive the new definition. Pending rulemaking on an unsettled term is a compliance amber light, not green. It is an invitation to document your assumptions carefully and revisit them the moment the rule drops.
Delta-8 THC and similar hemp-derived cannabinoids sit squarely in the crosshairs. Campaigns in this space carry the highest definitional risk right now, precisely because the product was legally marketable as recently as 2024 and does not meet the 2025 standard today. There are also congressional bills pending to repeal or delay the 2025 changes by two years. That legislative uncertainty does not reduce compliance risk; it compounds it. A brand that built its campaign on the assumption the old framework would hold finds itself exposed in either direction.
Confirm product compliance with the 2025 definition before you brief an influencer. Not after content is created. Not after a warning letter arrives.
The FDA Has Not Sanctioned CBD in Food or Supplements, and That Silence Is Its Own Kind of Enforcement Signal
The FDA has approved exactly one CBD-containing drug: Epidiolex, for seizure conditions. Its standing position is that CBD is not legal as a dietary supplement or food additive, and while enforcement under that position has been uneven, the legal vulnerability it creates is not contingent on enforcement frequency. Inconsistent enforcement is categorically different from no enforcement.
In September 2025, the FDA issued a deceptive drug advertising initiative accompanied by roughly 100 cease-and-desist letters, with specific attention to CBD and THC beverages. This is the agency's current posture, and it raises the substantiation bar for the entire category in ways that pre-2025 compliance frameworks were not built to anticipate.
The trigger is the claim, not the product's existence. A product already on the market that makes no health claims faces materially lower enforcement risk than one whose influencer content describes what it does to the body. Describing a product's taste, texture, or routine integration is categorically different from describing its physiological effect. That line is exactly where most violations accumulate, which makes sense: wellness is a selling point, and the people writing these captions believe in what they are describing. Good intentions are not a compliance strategy.
The FDA and FTC coordinate on warning letters. An FDA-flagged product simultaneously being promoted by influencers with unsubstantiated health claims creates compounding exposure across both agencies. A problem with one regulator becomes a problem with two, almost automatically.
The FTC Endorsement Guides Are the Operating Manual, Not a Suggestion Box
The FTC revised its Endorsement Guides, effective July 26, 2023. These are administrative interpretations of Section 5 of the FTC Act, which prohibits unfair or deceptive acts in commerce. They are not voluntary guidelines. Brands that treat them as aspirational rather than mandatory have made an expensive misapprehension, and the enforcement record bears that out.
The core obligation is disclosure of any material connection between brand and endorser. Material connection is defined broadly: cash payment, free products sent for review even without additional compensation, affiliate commissions, and employment relationships all qualify. There is no follower-count threshold. A nano-influencer with 800 followers posting a gifted product review without disclosure is in violation. The audience size is irrelevant to the obligation.
The 2023 revision expanded the liability chain in ways brands consistently underestimate. Advertisers are liable for influencers' unsubstantiated claims or failed disclosures, even when the influencer is not themselves found liable. Agencies and talent managers carry separate exposure. And influencers are personally liable for claims they know or should know are deceptive, including falsely claiming personal product use. That last provision is sharply relevant in a category where "it changed my life" is a common content register.
Brand obligation under the Guides is active, not passive. Brands must provide guidance, monitor compliance, and take corrective action when posts fall short. "My influencer didn't disclose" is not a defense. It demonstrates the brand failed its monitoring obligation in the first place.
The 2023 revision also extended coverage to fake reviews, virtual influencers, and tag structures in social media. For brands experimenting with AI-generated content or ambassador networks built around product tags, this extension is directly relevant and worth reading carefully before the next campaign launches.
"Clear and Conspicuous" Is More Specific Than It Sounds, and That Specificity Is the Whole Point
The Guides now codify what clear and conspicuous actually requires: disclosure must be difficult to miss, easily understandable, unavoidable in interactive media, and cannot be contradicted or mitigated by other content in the same post. That last condition is the one that catches brands who assume a disclosure buried somewhere in a long wellness manifesto caption somehow counts.
Platform mechanics vary enough that a blanket policy is insufficient. On Instagram, disclosure belongs at the beginning of the caption, not after hashtags or at the end of a long scroll. Stories require a text overlay visible throughout the Story. On TikTok, verbal disclosure in the first few seconds of video is required, plus text disclosure in the caption; one without the other falls short of compliance. On YouTube, both verbal and written disclosure must appear in the video itself; a disclosure confined to the description box falls short. On X and Threads, disclosure must be within the post itself; a separate reply does not satisfy the requirement.
Instagram's built-in Paid Partnership tag is not sufficient on its own. The FTC has explicitly noted that reliance on platform disclosure tools is inadequate. These are separate questions with separate answers, and conflating them is a common source of exposure.
On hashtag disclosure: #ad works when it is isolated and prominent. #ad as the seventeenth entry in a dense hashtag stack does not meet the standard. The FTC has been consistent on this point.
Each non-compliant post is a separate violation, subject to civil penalties of $53,088 per violation under 16 C.F.R. Part 1 as adjusted for inflation. A ten-post campaign with disclosure failures across eight posts is not one violation. Do the arithmetic before deciding how much compliance infrastructure is worth building.
The Enforcement Record Is Not Ancient History; It Is a Roadmap
Operation CBDeceit, the FTC's first crackdown specifically targeting deceptive CBD marketing, launched in December 2020. Six companies were targeted for unsubstantiated health claims. Fines ranged from $20,000 to $85,000 per company for five of the six respondents. Settlement terms run twenty years, and violations of those terms trigger additional penalties per incident. Individual company officers and founders were named as respondents. Personal liability in this space is not theoretical.
The claims that triggered enforcement were not obscure or fringe. Anxiety, chronic pain, insomnia, cancer, Alzheimer's, diabetes, PTSD, and cardiovascular conditions were all in scope. A broad range of serious health condition claims is actionable. The substantiation standard the FTC applies, "competent and reliable scientific evidence," is the same bar it holds all health claims for consumer products to. The CBD industry has not been granted a lower threshold, and there is little reason to expect one.
In 2025, the FTC challenged over fifteen cannabis-adjacent brands for unsubstantiated claims, with penalties ranging from $50,000 to $500,000 per violation. The National Advertising Division's 2025 enforcement actions set a tighter substantiation standard for CBD, CBG, and cannabinoid beverage advertising, with specific scrutiny of "fast-acting nano" claims and microdosing language. NAD referrals to the FTC are a recognized pathway to formal enforcement; a NAD action is a serious outcome, even if it feels procedurally removed from an FTC proceeding.
One argument holds that the CBD category is large enough, and enforcement resources finite enough, that the practical probability of any individual brand being targeted is low. That argument is not entirely wrong. It is also no substitute for a compliance strategy.
Child-Appeal Content Triggers Both Agencies Simultaneously, and That Is Exactly the Point of It
On July 15, 2024, the FDA and FTC jointly issued warning letters to five companies selling delta-8 THC products designed to mimic children's snack and candy brands: Froot Loops, Cap'n Crunch, Flamin' Hot Cheetos, Chips Ahoy, Skittles, Sour Patch Kids, and Jolly Ranchers. The joint-letter mechanism matters here. When two agencies coordinate enforcement rather than act independently, it signals that the issue is a heightened priority.
The 2023 revised FTC Guides specifically flag child-directed advertising as a special concern. It is not solely a product safety issue; it is an FTC advertising compliance issue, full stop. Any influencer post that features hemp products alongside imagery, humor, or aesthetics that skew toward minors, even without intent, raises joint-agency exposure. Intent is not a defense in this space.
State enforcement on child appeal is, in several jurisdictions, moving faster than federal action. Florida's 2025 legislation introduced new requirements for child-resistant packaging and strict prohibitions on youth-appealing branding. The Connecticut penalty against Planet Zaza reached $4.93 million, with youth-appeal violations as a central element of the case, independent of any federal proceeding.
For influencer briefs, this translates to an explicit written prohibition, not an assumption. The brief should specify that product staging, backgrounds, and humor registers that skew toward younger audiences are off-limits.
Platform Policies Create a Fifth Layer That Can Ground a Legally Compliant Campaign
Meta prohibits ads for hemp and CBD products in most circumstances, regardless of product legality. Organic influencer content is treated differently from paid amplification, but the line between them is narrow and enforced algorithmically. TikTok's prohibition on promoting hemp-derived CBD products is explicit; brands cannot boost or run paid promotions even for legally compliant products. YouTube allows organic content about hemp and CBD with restrictions, but monetization and paid placement face their own separate constraints.
A post fully compliant with FTC requirements and legally sound under the 2025 hemp definition can still be removed, demonetized, or reach-suppressed by a platform algorithm. Platform policy is not subordinate to federal law in terms of real-world campaign outcomes. In many cases, it is the more operationally consequential constraint. Treating it as a secondary consideration, something to address after legal review is complete, inverts the practical order of risk.
Shopify and major e-commerce platforms carry their own CBD merchant policies, relevant whenever influencer content links directly to a purchase page. A compliant post linked to a non-compliant product listing creates a different category of exposure than either problem in isolation.
Platform policies also change more frequently than federal law. A campaign approved against current platform terms can become non-compliant mid-run. Contracts with influencers should address this scenario explicitly: what happens when a platform changes its policy during an active campaign? Who bears the cost of re-editing or re-posting? Leaving that question unaddressed is leaving a foreseeable risk open.
A Compliant Influencer Brief Is a Legal Document That Happens to Also Be a Creative Brief
Most influencer briefs in this space are creative documents with a legal footnote that says something like "avoid health claims." That footnote is not a compliance program. It is a notation that the brand was aware rules existed, which is worse than saying nothing if the rules were subsequently violated.
A compliant brief specifies disclosure requirements in writing, with exact language and placement by platform. Not "disclose per FTC guidelines," but "#ad at the start of the caption on Instagram" and "verbal disclosure within the first few seconds for TikTok video, plus text in caption." The difference between those two instructions is the difference between a brand that delegated disclosure to influencer judgment and a brand that took its monitoring obligation seriously.
The prohibited claims list should be specific, drawn from categories that have already triggered enforcement: pain, anxiety, sleep, cancer, inflammation, immune function, any condition-specific language. Alongside the prohibited list, include language influencers can actually use: sensory descriptions, routine context, format and form factor. Give them a vocabulary. The goal is creative content that does not create a compliance event, not content so cautious it communicates nothing.
The brief should also confirm that the specific product being promoted has been reviewed for compliance with the 2025 hemp definition before content is created. A brand with a compliant hero product and a non-compliant line extension cannot assume the influencer will know the difference, or care.
Finally, build a content review step before posting. The November 2023 FTC warning letters to health influencers and trade associations for undisclosed paid promotion of food and beverage products on Instagram and TikTok established the closest direct enforcement precedent for how wellness influencer relationships are scrutinized. The mechanics that applied there apply in the CBD and hemp context. Reviewing content before it goes live is the minimum credible posture, and it is not actually that hard to operationalize.
The Enforcement Arc Runs in One Direction, and It Has Not Peaked
Operation CBDeceit in December 2020. Revised FTC Endorsement Guides in July 2023. Warning letters to health influencers in November 2023. The FDA's deceptive advertising push and roughly 100 cease-and-desist letters in September 2025. Over fifteen cannabis-adjacent brands challenged by the FTC in 2025 alone. The direction of travel is not ambiguous, and anyone reading the pattern as a reason to wait is reading it backwards.
The 2025 hemp definition change has not yet produced settled rulemaking. Congressional bills to delay or repeal the changes are pending. That legislative uncertainty is sometimes interpreted by brands as a reason to continue operating under the 2024 framework until things clarify. Regulatory uncertainty does not reduce compliance risk; it elevates it, because the floor can shift in either direction and the brand that made assumptions about where it sits is exposed regardless of which way the movement goes.
Brands that understand the layered structure — federal agency jurisdiction, platform policy, state law, contract mechanics with influencers — are better positioned to defend their decisions and to run campaigns with genuine creative ambition, because they know where the edges are. The brands treating this as an indecipherable minefield are ceding ground to the ones treating it as a map.
It is a map. A frustrating, four-cartographer, rarely-fully-updated map drawn by people who have largely never met, but a map nonetheless. The question is whether you read all of it before you start moving.
