Cannabis has been legal in some form in California longer than most of the industry's current workforce has been in it. Thirty years, four major statutes, and one total agency overhaul got us to today's rules, and none of it happened as a single event. It happened in stages, and every stage is still layered into the law that governs your business right now.
TL;DR
California cannabis law runs on three layers: statutes from the legislature, DCC regulations that interpret them, and local ordinances that can be tighter but never looser. MAUCRSA, passed in 2017, is the statute governing commercial cannabis today.
How We Got Here
It started as a legal defense, not a business model. Proposition 215 passed in 1996 and decriminalized cultivation and possession for patients with a doctor's recommendation. No licenses, no agency, no commercial framework. The Medical Marijuana Program Act followed in 2004, adding a voluntary ID card system on top of the same patchwork of local tolerance and local crackdowns.
The real system didn't show up until 2015, when the Medical Marijuana Regulation and Safety Act built the state's first actual licensing structure: cultivation, manufacturing, distribution, delivery, sale. A year later, voters passed Proposition 64 and made California the fifth state to legalize recreational cannabis, with a full regulatory build-out around adult use.
That left two parallel tracks, medical and adult-use, running overlapping but not identical rules. MAUCRSA, signed in 2017, repealed MMRSA and merged both into the one statute that governs commercial cannabis in California today. It lives in the state's Business and Professions Code, and for a full year-by-year breakdown of how each of these laws landed, the legal timeline covers it in order.
Statutes, Regulations, Ordinances
MAUCRSA is a statute, meaning the legislature wrote it and the governor signed it. It sets the broad rules, but it doesn't spell out what goes on a package label or how a security camera has to be positioned. That's the job of regulations, written by the DCC to interpret the statute into specific, enforceable requirements.
Below that sit ordinances, written by individual cities and counties. Ordinances can be tighter than state regulations. They can restrict hours, zoning, or which license types are allowed, and they can ban commercial cannabis outright. What they can't do is loosen what the state already requires. State legalization was never a mandate. It set a ceiling on how far local governments could go in the other direction, and even that ceiling leaves plenty of room underneath it.
Outside of MAUCRSA, cannabis businesses also answer to the same general laws every other California business follows: waste disposal, environmental protection, vehicle registration, tax law. Separately, the Health and Safety Code carries the consumer-facing rules: who can legally possess cannabis, how much, and under what conditions.
Strip away the layers and the regulatory goal is narrow. Keep businesses operating safely, keep products free of contaminants and properly labeled, keep cannabis away from minors. Every packaging rule, every testing requirement, every security standard on the books traces back to one of those three goals.
The Consumer Side
Adults 21 and older can possess up to 28.5 grams of cannabis or 8 grams of concentrate. Adults can cultivate up to 6 plants at home, regardless of how many people live there. Local jurisdictions can restrict how that grow is set up, but they can't ban indoor personal cultivation outright. Manufactured edibles are capped at 10 milligrams of THC per serving and 100 milligrams per package. None of this requires a license. It's baseline consumer law, separate from the commercial licensing system entirely.
Every legislative session adds something. Statutes get amended, regulations get rewritten, and local ordinances shift as city councils turn over. The structure holds, but what's inside it is worth checking every year, not just the year you got licensed.