CBD isn’t exactly illegal, but it isn’t fully legal either. It sits in a complicated gray zone created by overlapping federal laws that sometimes contradict each other. Hemp-derived CBD containing no more than 0.3% THC was removed from the Controlled Substances Act in 2018, yet the FDA still prohibits it from being sold as a food ingredient or dietary supplement. The result is a product you can buy in gas stations across most of the country that technically violates federal food and drug law.
The 2018 Farm Bill Changed Everything, Sort Of
Before 2018, all CBD was a Schedule I controlled substance, the same category as heroin, because it came from cannabis. The Agriculture Improvement Act of 2018 (commonly called the Farm Bill) carved out a new legal category called “hemp,” defined as any part of the cannabis plant containing no more than 0.3% delta-9 THC on a dry-weight basis. That single line of legislation removed hemp-derived CBD from the Controlled Substances Act entirely.
CBD derived from marijuana (cannabis with more than 0.3% THC) remains federally illegal. So the legality of a CBD product depends entirely on where it came from and how much THC it contains. The 0.3% threshold is the dividing line between a legal agricultural product and a Schedule I drug.
Why the FDA Still Blocks CBD Products
Here’s where most of the confusion lives. Even though hemp-derived CBD is no longer a controlled substance, the FDA has a separate rule that prevents it from being sold as a dietary supplement or added to food. The reason comes down to a quirk in pharmaceutical law: once a compound becomes the active ingredient in an approved drug, it can no longer be marketed as a supplement or food additive.
CBD is the active ingredient in Epidiolex, a prescription medication approved in 2018 for treating seizures in people with rare forms of epilepsy (Lennox-Gastaut syndrome, Dravet syndrome, and tuberous sclerosis complex). Because Epidiolex received FDA approval, and because substantial clinical investigations into CBD were made public before anyone marketed it as a supplement, the FDA concluded that CBD is permanently excluded from the dietary supplement category. The same rule blocks companies from adding CBD to food products sold across state lines.
This creates the strange situation where you can legally grow hemp, legally extract CBD from it, but not legally sell that CBD in a gummy, capsule, or beverage as a health product. The FDA has issued warning letters to companies making therapeutic claims about CBD, such as claiming it treats cancer, anxiety, or chronic pain.
State Laws Add Another Layer
Federal law sets the floor, but states can be more restrictive. Thirty-five states allow hemp-derived CBD without major conditions. The rest impose tighter controls. Delaware, Florida, and Hawaii require a medical prescription for CBD products, even hemp-derived ones with less than 0.3% THC. Idaho and Kansas only allow CBD products with zero detectable THC, not just below 0.3%. Mississippi limits CBD to medical cannabis patients with specific qualifying conditions.
This patchwork means a CBD oil you legally purchased in Colorado could technically be illegal to possess in Idaho if it contains any measurable THC at all.
The Product Purity Problem
The lack of FDA regulation creates a real-world legal risk for consumers. Without mandatory testing standards, many CBD products contain more THC than their labels claim. In a study analyzing 80 commercially available CBD products, 64% contained detectable levels of THC. Among products specifically labeled “THC-Free,” nearly one in four actually contained measurable THC.
This matters because a product that exceeds 0.3% THC is no longer legal hemp under federal law. It also matters for anyone subject to drug testing, since even small amounts of THC can accumulate with regular use.
Flying and Traveling With CBD
The TSA allows hemp-derived CBD products containing no more than 0.3% THC in both carry-on and checked bags. TSA officers don’t actively search for cannabis products, but if they discover something that appears to violate the law during a security screening, they’re required to refer it to law enforcement. The final call on whether a specific product passes through a checkpoint rests with the individual officer, and there’s no practical way for them to verify THC content on the spot.
How Other Countries Handle CBD
The legal gray zone isn’t unique to the United States. In the United Kingdom, CBD was classified as a “novel food” in January 2019, meaning CBD food products need government authorization before they can be sold. No CBD extracts or isolates have been authorized yet, so technically every CBD food product on UK shelves exists in a regulatory limbo. The European Union applies the same novel food framework, and the European Commission hasn’t authorized any CBD food products either.
Why CBD Isn’t Simply Made Legal
The core issue is that CBD falls between two regulatory systems that weren’t designed to accommodate it. Drug scheduling law treats it as legal (when derived from hemp), but food and drug law treats it as an unapproved drug ingredient because of its pharmaceutical use in Epidiolex. Congress could resolve this by passing legislation that explicitly allows CBD in supplements and food, overriding the FDA’s exclusion rule. Several bills have been introduced to do exactly that, but none have passed.
Until that changes, CBD occupies a unique position in American law: not a controlled substance, not an approved supplement, widely sold, rarely prosecuted, and technically illegal to market in most of the forms you’ll find it on store shelves.