Email is the easier half of this. Federal CAN-SPAM law sets the baseline, state cannabis rules layer on top, and the biggest practical risk is the same one that applies to every other channel: no health-benefit claims in a subject line or body copy. "Your favorite strains are back in stock" is fine. Anything implying a cure or a treatment isn't, regardless of how it's phrased. Major email platforms generally work fine for hemp and CBD brands. THC brands run into more friction with mainstream providers than hemp brands do, so confirm a platform's cannabis policy before building a list on top of it.
Text marketing is where this gets genuinely harder, and it's gotten stricter recently enough that assumptions from a couple of years ago are already out of date.
TL;DR
SMS marketing requires express written consent captured before the first message, honors opt-outs sent through any method, and gets filtered by carriers before it even reaches a customer, since most carriers treat cannabis content as a restricted category by default. Recordkeeping is the only real defense if a complaint gets filed.
Consent Isn't Optional or Implied
Express written consent has to come before every promotional text, and verbal consent doesn't satisfy that requirement. A newer federal rule also means consent collected for one brand can't be shared across marketing partners, so a list bought or borrowed from somewhere else isn't a valid substitute for consent collected directly.
Valid ways to actually get that consent: a checkbox on a signup form, a keyword opt-in where someone texts a specific word to a number, or a consent form captured at the point of sale. Simply adding a number to a list after someone made a purchase or visited a website doesn't count, no matter how convenient it would be.
Opting Out Has to Work However Someone Does It
A newer rule requires honoring an opt-out sent through any reasonable method, not just a "STOP" reply. An opt-out through email, a voicemail, or even informal language in a reply still has to be respected. Building a program around only recognizing the word "STOP" is no longer a safe assumption.
Carriers Filter Cannabis Content Before It Even Arrives
Wireless carriers apply their own content categories to outgoing text traffic, and cannabis is treated as a restricted category by most of them by default, in the same bucket as alcohol, firearms, and adult content. That means messages referencing THC, CBD, or cannabis specifically get flagged or blocked at the carrier level with real frequency, even when the underlying product is a fully compliant hemp item. Standard business SMS numbers also need to go through carrier registration before sending at any real volume, and cannabis businesses face extra scrutiny in that process specifically.
None of this is a reason to avoid SMS. It's a reason to expect a real deliverability tax on cannabis messaging that a normal retail business never has to plan around.
Recordkeeping Is the Actual Defense
If a consent dispute ever comes up, "they probably signed up at checkout" isn't a defense. What holds up is a real record: the phone number, a timestamp, the page or location where consent was captured, the exact language shown at opt-in, and where relevant, an IP address. Store that for every subscriber, every time, not just for the ones who complain later.
The Practical Takeaway
Treat every subscriber as someone whose consent you'll need to prove, not just assume. Build the opt-in flow to capture that proof automatically, and check current FCC and carrier rules before scaling a program, since this specific area has moved fast and shows no sign of slowing down.