CBD Labeling Requirements — Federal Gaps and State Rules
Three years after FDA declined to regulate CBD as a dietary supplement, there is still no federal labeling framework for the category. That vacuum did not stay empty. States wrote their own rules — QR codes, milligram disclosures, license numbers, warning statements — and they enforce them. Here's what a compliant CBD label actually requires in 2026.

Catherine Zhou
| Co-founder at Truli

If you're looking for the federal CBD labeling rulebook, stop looking. It doesn't exist. In January 2023, FDA concluded that its existing food and dietary supplement pathways were not appropriate for CBD and asked Congress to create a new regulatory framework. As of mid-2026, Congress hasn't delivered one. Bills like the Lawful Hemp Protection Act and the HEMP Act would hand FDA a rulemaking mandate with per-serving cannabinoid limits, but none has passed.
The result is the most fragmented labeling environment in consumer products. Baseline FDA food and supplement labeling rules still apply, FDA's drug-exclusion position still hangs over the ingredient, and a patchwork of state statutes imposes requirements federal law never mentions. A CBD brand shipping to ten states is effectively complying with eleven rulebooks.
The Federal Gap, Precisely Defined
The answer to "what does FDA require on a CBD label" is: the same things it requires on any food or supplement label, and nothing CBD-specific. FDA has never issued CBD labeling regulations. Its 2023 statement explicitly punted the framework question to Congress, citing safety questions its existing authorities couldn't resolve.
That doesn't mean federal law is silent. FDA maintains that CBD is excluded from the dietary supplement definition because it was first investigated as a drug (Epidiolex) — the drug-exclusion issue we've covered in depth in our CBD claims guide. And the November 2025 spending law redefined hemp itself: starting November 12, 2026, finished products containing more than 0.4 mg total THC per container lose hemp status. Full-spectrum CBD products routinely exceed that number, so even non-intoxicating brands need to check their COAs against the new definition.
The FDA Rules That Still Apply to Every CBD Label
A CBD product sold as a food or supplement still has to satisfy the general labeling requirements of 21 CFR Part 101. The gaps in CBD-specific policy don't excuse the basics:
Statement of identity under 21 CFR 101.3 — what the product is, on the principal display panel
Net quantity of contents under 21 CFR 101.7 — accurate weight or volume, correctly placed and sized
Ingredient declaration under 21 CFR 101.4 — every ingredient in descending order by weight
Nutrition Facts under 21 CFR 101.9 for foods, or Supplement Facts under 21 CFR 101.36 for supplement-format products
Manufacturer, packer, or distributor name and address
FDA warning letters in this category almost always pair a claims violation with basic labeling failures. If an investigator is already reading your label for a disease claim, a missing net-quantity statement is a free additional charge.
The State Patchwork — Where the Real Requirements Live
The operative CBD labeling rules in 2026 are state rules. Four examples show the range:
State | QR code / COA | Content disclosures | Other requirements |
|---|---|---|---|
New York (10 NYCRR / Part 114) | Scannable QR or barcode linking to a downloadable COA | CBD and total THC (delta-8, -9, -10) in mg per serving and per package; serving count | Ingredients by predominance, batch/lot number, usage directions, adverse-effects statement, processor name |
California (AB-45) | COA from a licensed lab on request | Cannabinoid content consistent with label claims | State registration, no disease claims, THC limits; AB-8 (2026) bans intoxicating hemp products from retail |
Texas (Health & Safety Code ch. 443) | QR code linking to a COA with lot number and cannabinoid profile | Product name, manufacturer contact info, lot and dates | COA must confirm ≤0.3% delta-9 THC; DSHS registration |
Florida (§581.217, Rule 5K-4.034) | QR code resolving to the batch COA, live ≥90 days past expiration | Milligrams per serving; ingredient panel | COA from an ISO/IEC 17025-accredited lab; batch number; expiration date; child-resistant packaging (ASTM D3475) |
Two patterns run through nearly every state regime. First, traceability: a QR code or link that connects the physical unit to a batch-specific certificate of analysis. Second, quantified disclosure: cannabinoid content stated in milligrams per serving and per container, not just "hemp extract" in the ingredient list.
License numbers and warning statements
Several states go further. Hemp-program license or registration numbers must appear on labels in states including Texas and Florida. Warning statements are common — pregnancy and nursing warnings, "keep out of reach of children," and consult-your-physician language appear in multiple state rules with prescribed wording. Copying another brand's warning block is how the wrong state's language ends up on your panel.
How to Build One Label That Survives Fifty Reviewers
The practical approach is to design to the strictest common denominator rather than maintaining fifty SKU variants. That means a compliant federal base label (identity, net quantity, ingredients, facts panel), plus mg-per-serving and mg-per-container disclosures for every marketed cannabinoid, a batch-linked QR code to a current accredited-lab COA, and the union of state warning statements you can defensibly combine.
Then verify the claims layer separately. State frameworks like AB-45 prohibit disease claims on their own authority, and FDA and FTC enforcement in this category overwhelmingly targets anxiety, pain, and sleep treatment language. A structurally perfect label with "relieves anxiety" on the front panel is still the first letter in the mail pile.
Finally, put the November 2026 hemp redefinition on your calendar now. If any SKU's total THC exceeds 0.4 mg per container, its federal status changes in months, regardless of how compliant the label text is.
Fifty rulebooks, one scan
Truli's AI agents scan CBD labels, packaging, websites, and social content against FDA and FTC requirements and flag the gaps — from a missing net-quantity statement to a disease claim buried in a product review — citing the specific rule behind every finding. Book a demo to see your label the way a regulator does.
A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Platform
See Truli in action
If regulatory delays are consuming months and thousands in fees, see how Truli delivers fast and continuous compliance coverage at a fraction of the cost.















