CBD and Hemp Products on Shopify: Legal and Age Requirements

The CBD and hemp industry has exploded over the past five years, and Shopify has become one of the most popular platforms for merchants entering this space. Whether you're selling CBD tinctures, hemp skincare, or cannabidiol-infused edibles, the commercial opportunity is real — the global CBD market is projected to surpass $47 billion by 2028. But with that opportunity comes a layer of legal complexity that many new merchants underestimate until they've already made a costly mistake.

The challenge isn't just understanding whether CBD is legal in your country. It's understanding the patchwork of regulations that govern how you sell it, who you can sell it to, what you can say about it, and how your payment processor and platform will treat your store. Shopify has its own policies on top of national laws, and age verification adds yet another dimension that many merchants ignore until they receive a compliance warning or account suspension.

This guide is written for Shopify merchants who sell — or are considering selling — CBD and hemp products. You'll learn the key legal requirements in major markets, how Shopify's policies interact with those laws, what age verification actually means in practice, and the practical steps you should take to protect your store from liability, suspension, and regulatory fines.

Is CBD Legal to Sell? A Market-by-Market Overview

CBD legality varies dramatically depending on your market, and "hemp-derived" does not automatically mean "legal to sell." In the United States, the 2018 Farm Bill federally legalised hemp-derived CBD with less than 0.3% THC, but individual states like Idaho, South Dakota, and Iowa still impose restrictions. This means a merchant operating in Colorado faces a very different compliance picture than one shipping orders to customers in Iowa, even within the same country.

In the United Kingdom — where merchants supplying major retailers like Selfridges have operated for years — CBD is legal as a food supplement, but the Food Standards Agency requires that all ingestible CBD products be submitted for a Novel Food authorisation. Products without a validated Novel Food application cannot legally be sold as food supplements in England, Scotland, and Wales. The threshold for THC content in UK products is also tightly controlled, and any product exceeding 1mg of THC per container is classified as a controlled substance.

Within the European Union, the picture is similarly fragmented. Countries like Germany have moved toward a more regulated but accessible CBD market, while France has been more restrictive about which parts of the hemp plant can be used in consumer products. If you're selling internationally via Shopify, you need geo-specific legal advice — not just a general blog post. Budget for proper compliance counsel before you launch, because the cost of getting it wrong is orders of magnitude higher than the cost of getting it right.

What Shopify Actually Allows — And Where It Gets Complicated

Shopify permits the sale of hemp and CBD products in jurisdictions where they are legal, but the platform's Acceptable Use Policy requires merchants to comply with all applicable local laws. Shopify Payments, however, is a different story — it does not support CBD merchants in most regions, which means most CBD sellers must use a third-party payment gateway that is comfortable with the industry. Processors like Bankful, PaymentCloud, and Pinwheel have built specific products for cannabis-adjacent businesses, but expect higher transaction fees, typically between 3.5% and 5.5%.

Beyond payments, Shopify's app ecosystem also treats CBD merchants differently. Some apps will flag your store type and refuse to activate, while others — particularly fulfilment and shipping apps — may have restrictions on what products they'll handle. It's worth auditing every app in your store against the CBD or hemp policy before you go live, because discovering a critical app doesn't support your niche after launch can set your timeline back by weeks.

Shopify also requires that merchants with age-restricted products implement appropriate age verification. While Shopify doesn't prescribe a specific technical solution, it does expect merchants to take reasonable steps to prevent sales to minors where local law requires it. Failing to do so isn't just a Shopify policy issue — it can expose you to regulatory action from trading standards bodies in the UK or state-level consumer protection agencies in the US. Using a purpose-built tool like AgeGuard is the most practical way to meet this requirement without building a custom solution.

Age Verification for CBD: What the Law Actually Requires

Age verification for CBD products is not universally mandated at the same age threshold across all markets, which creates real complexity for merchants selling cross-border. In the United States, there is no federal minimum age for purchasing hemp-derived CBD, but many states — including California and New York — effectively treat CBD edibles similarly to supplements sold to adults, and various state-level proposals have pushed for 18+ or 21+ requirements. In the UK, CBD products are not legally classified as age-restricted goods in the same way that alcohol or tobacco are, but best practice guidance from industry bodies like the Centre for Medicinal Cannabis recommends age-gating at 18+.

In practice, the most defensible position for any CBD merchant is to implement a 18+ age gate across their entire store, regardless of whether your specific jurisdiction mandates it. This isn't just about legal compliance — it's about demonstrating responsible retail behaviour to your payment processor, your platform, and any regulatory body that reviews your operation. Payment processors in particular scrutinise CBD merchants more heavily than average, and having visible age verification signals that you're running a professional, compliant business.

The technical implementation matters as well. A simple pop-up asking "Are you over 18?" with a yes/no button is the bare minimum, but it's also the easiest to bypass and provides limited legal protection. More robust solutions use date-of-birth entry, cookie persistence to avoid asking returning visitors repeatedly, and bot-detection to prevent automated bypass. If you're serious about compliance, invest in a solution that creates a verifiable record of the age check — that documentation could matter if you're ever audited.

Labelling, Health Claims, and What You Cannot Say

The rules around health claims on CBD products are strict, frequently misunderstood, and one of the most common reasons merchants receive warnings or delisting notices. In the UK, you cannot claim that a CBD product will treat, cure, or prevent any medical condition. Saying your tincture "supports relaxation" sits in a grey area; saying it "treats anxiety" is a clear violation of the Medicines and Regulations Act and could result in enforcement action from the MHRA. The same principle applies in the US, where the FDA has issued warning letters to numerous CBD companies for unapproved disease claims.

On your Shopify product pages, this means your descriptions need to be reviewed against both the platform's content policies and the regulations of every market you ship to. Avoid phrases like "clinically proven," "reduces inflammation," "treats chronic pain," or any language that implies a therapeutic outcome. Instead, focus on ingredient quality, sourcing transparency, third-party lab testing, and general wellness positioning — all of which are both legally safer and increasingly important to sophisticated CBD consumers who want to see certificates of analysis before buying.

Labelling on physical products must also comply with local packaging regulations. In the UK, CBD products must list the exact CBD content per serving and per container, include a batch number traceable to a certificate of analysis, and display appropriate allergen and storage information. If you're using print-on-demand or dropshipping suppliers, verify that their label templates meet your target market's requirements — generic templates are frequently non-compliant and could result in product recalls or marketplace delisting.

Setting Up Your Shopify Store for CBD Compliance

Building a compliant CBD store on Shopify requires more than just ticking boxes — it requires a systematic approach from theme selection to checkout flow. Start by documenting your compliance framework before you build: identify your target markets, the applicable laws in each, the minimum age threshold you'll enforce, and the payment and shipping partners who will support your product category. This document becomes your reference point every time you add a product, change a supplier, or expand to a new market.

Your store's technical setup should include age verification on entry, clear terms of service that reference your compliance obligations, a privacy policy that covers data collected during age checks, and a checkout flow that confirms the buyer is of legal age. If you're shipping internationally, consider using Shopify Markets to apply different rules and messaging to different geographic regions — this lets you display UK-specific Novel Food disclaimers to British customers while showing different regulatory language to US customers.

Finally, keep records. Retain your certificates of analysis, your age verification logs where your solution supports it, your Novel Food application status, and any correspondence with regulatory bodies. A CBD business that can demonstrate a documented compliance process is in a fundamentally stronger position than one that operates informally, whether you're dealing with a payment processor query or a trading standards inspection.

Ongoing Compliance: How to Stay Current as Laws Change

CBD regulations are not static — they are among the most actively evolving areas of consumer goods law in both the UK and the US. The UK's Novel Food authorisation process has already seen multiple deadline extensions and category expansions, and the FDA in the US has signalled its intention to create a formal regulatory pathway for CBD supplements that will likely introduce new labelling and testing requirements. Merchants who treat compliance as a one-time task rather than an ongoing discipline will find themselves out of step with the law within 12 to 18 months.

Subscribe to updates from the relevant regulatory bodies — the FSA in the UK, the FDA in the US, and the EMCDDA for EU-wide trends. Industry associations like the Association for the Cannabinoid Industry (ACI) in the UK publish regular guidance updates and can be a cost-effective way to stay informed without paying for constant legal counsel. Many of these organisations also provide template policies and label guidelines that can save significant time.

On the Shopify platform side, monitor the Shopify Changelog and the Shopify Community forums for policy updates that affect CBD merchants specifically. Shopify has historically given merchants advance notice of policy changes, but the window is not always generous. Having a compliance-aware technical partner — whether that's an agency, a consultant, or a well-supported app ecosystem — means you're more likely to catch changes before they affect your store's operation.

Conclusion

Selling CBD and hemp products on Shopify is genuinely viable, but it demands a level of compliance rigour that most standard e-commerce categories simply don't require. The legal landscape is fragmented across markets, Shopify's own policies add another layer of complexity, and age verification is a practical and reputational necessity even where it isn't strictly mandated by law. The merchants who build sustainable CBD businesses on Shopify are the ones who invest in compliance infrastructure from day one rather than retrofitting it after a problem arises.

The key takeaways are straightforward: know the law in every market you sell to, implement robust age verification, avoid health claims on your product pages, keep your labelling compliant, and treat compliance as an ongoing operational discipline rather than a launch checklist. With the right tools and the right mindset, a compliant CBD Shopify store is well within reach.

Try AgeGuard free at saltai.app — no credit card required.