Federal rules hinge on whether CBD comes from hemp or marijuana, making the plant’s origin the deciding factor. Cannabidiol (CBD) becomes a Schedule I controlled substance only when extracted from marijuana, cannabis containing more than 0.3% delta-9 THC by dry weight. CBD pulled from hemp, cannabis with 0.3% or less delta-9 THC, was removed from the federal Controlled Substances Act by the 2018 Farm Bill and sits outside drug scheduling. The grocery-store CBD oil on your shelf is federally legal, while the same compound from a high-THC plant remains illegal.
This guide walks through how CBD legal status actually works, from federal scheduling rules to TSA checkpoints, so you can buy, carry, and travel with confidence.
CBD’s Place Inside the Federal Controlled Substances Act
The Controlled Substances Act sorts drugs into five schedules based on medical use, abuse potential, and safety under supervision. Schedule I is the strictest tier, reserved for substances with no accepted medical use and a high potential for abuse, including heroin and ecstasy. Schedule V is the least restrictive, covering products with approved medical applications and limited dependency risk, such as certain cough preparations.
Cannabidiol itself does not appear on any schedule. DEA scheduling depends on the source plant, not the isolated compound, which is why CBD’s treatment shifts depending on whether it was extracted from hemp or marijuana. CBD is non-intoxicating and does not produce the euphoric effects associated with THC (tetrahydrocannabinol), a distinction the DEA has formally recognized.
That ambiguity has historical roots. Synthetic CBD was briefly listed as Schedule I in earlier code revisions, before the FDA (Food and Drug Administration) approved a plant-derived CBD medication. The lingering confusion from that short-lived scheduling still resurfaces in outdated legal guides and online forums that label all CBD as federally illegal.
Why the source plant determines everything
Two CBD products with identical molecular structures can sit on opposite sides of the law based solely on how much THC was in the source plant at harvest. Federal law looks at the plant’s delta-9 THC concentration by dry weight, not the finished product’s purity. A pure CBD isolate pulled from high-THC marijuana is still Schedule I, even though the isolate contains zero THC.
Because CBD is not explicitly scheduled, its legal status flows from the cannabis variety it came from, a detail most buyers never think to check.
How the 2018 Farm Bill Redefined Hemp and Its Cannabinoids
The Agriculture Improvement Act of 2018, commonly called the Farm Bill, removed hemp, defined as cannabis containing no more than 0.3% delta-9 THC by dry weight, from the Controlled Substances Act entirely. That single line legalized the cultivation, processing, and sale of hemp-derived cannabinoids across all 50 states, provided the source plant met the threshold.
The 0.3% figure applies to plant material on a dry-weight basis. Finished products like oils and gummies must be tested to confirm the source biomass fell within legal limits before extraction. A product’s label can claim “THC-free,” but what matters legally is the source plant’s THC content at harvest, not the final tincture’s potency.
Total THC versus delta-9 THC has become a legal flashpoint. Some states now require a “total THC” calculation that includes THCA conversion through decarboxylation, the process of heating THCA into active THC. A hemp crop testing at 0.29% delta-9 THC but 1% THCA could be legal under federal rules but restricted under stricter state definitions.
What a certificate of analysis actually proves
A certificate of analysis (COA) from an accredited third-party lab is the only reliable way to confirm a product qualifies as federally legal hemp. The COA should show the delta-9 THC percentage of the source material, the cannabinoid profile of the finished product, and confirm testing for contaminants like pesticides and heavy metals.
| Document | What It Verifies | Why It Matters |
|---|---|---|
| Certificate of Analysis (COA) | Delta-9 THC % of source plant and finished product | Confirms the product meets the 0.3% federal threshold |
| Lab Accreditation (ISO 17025) | Lab follows validated testing standards | Prevents fraudulent or manipulated results |
| Batch/Lot Number | Links the COA to the specific product you bought | Ensures the lab report matches the item in your hand |
| Contaminant Panel | Tests for heavy metals, pesticides, residual solvents | Identifies products the FDA has flagged for recalls |
Without a COA, a “hemp-derived” label is just marketing copy. Requesting the lab report before purchase is the single most effective buyer-protection step you can take.
That consumer-side caution matters, because even lawful hemp products can bump against federal pharmaceutical rules once they’re marketed for specific health claims.
DEA Scheduling, Epidiolex, and the Pharmaceutical Exception
Epidiolex, the first FDA-approved CBD medication, was descheduled and placed into Schedule V by the DEA (Drug Enforcement Administration) in 2018. Schedule V is the least restrictive category, acknowledging the drug’s approved medical use and low potential for abuse relative to other controlled substances. Epidiolex treats seizures associated with rare forms of epilepsy, including Lennox-Gastaut syndrome and Dravet syndrome, and was developed by GW Pharmaceuticals.
The pharmaceutical carve-out applies only to FDA-approved CBD drugs, not to the over-the-counter oils, gummies, and topicals sold at retailers. Those products remain unregulated as drugs, which means manufacturers cannot make disease-treatment claims, but the DEA does not schedule them either, because they qualify as hemp under the Farm Bill.
The history of CBD’s brief synthetic Schedule I status explains why older legal references still mislabel all CBD as federally illegal. Before Epidiolex’s approval, synthetic CBD sat in Schedule I regardless of source. Once a plant-derived version gained FDA approval, the DEA had to address scheduling, and the resulting Schedule V placement for the approved drug created the patchwork you see today.
How FDA-approved CBD differs from retail CBD
| Factor | Epidiolex (FDA-Approved) | Retail Hemp-Derived CBD |
|---|---|---|
| Legal Classification | Schedule V controlled substance | Hemp-derived cannabinoid (not scheduled) |
| FDA Oversight | Full drug approval, batch testing, labeling rules | No FDA approval, no standardized dosing |
| Claim Restrictions | Approved to treat specific seizure disorders | Cannot make disease-treatment claims |
| Availability | Prescription only, through licensed pharmacies | Over-the-counter, online, retail stores |
This distinction matters because the FDA has approved exactly one CBD product, not the entire category. Everything else on the market is technically an unregulated hemp extract, even when the label says “pharmaceutical grade.”
Pharmaceutical approval under Epidiolex didn’t pull cannabis off Schedule I, though, leaving non-prescription marijuana-derived CBD in legal limbo.
Marijuana-Derived CBD and the Persistent Schedule I Problem
CBD extracted from cannabis containing more than 0.3% delta-9 THC is legally classified as a Schedule I controlled substance under federal law, regardless of the CBD-to-THC ratio in the finished product. Even when a state has fully legalized recreational cannabis, marijuana-derived CBD crossing state lines or shipping through federal channels violates the Controlled Substances Act.
This is why dispensary CBD products in legal states cannot legally be mailed across state borders. The U.S. Postal Service, FedEx, and UPS all operate under federal law, and transporting Schedule I substances through federal infrastructure is a felony, even between two states where cannabis is legal. A Colorado dispensary cannot legally ship a high-CBD marijuana extract to a customer in California, despite both states permitting recreational sales.
Consumers buying CBD in a legal-state dispensary should verify whether the product comes from hemp or high-THC cannabis, because the legal exposure is fundamentally different. Hemp-derived CBD from the same dispensary is federally legal. Marijuana-derived CBD is Schedule I, and possession outside a state-licensed system can carry criminal penalties.
State legalization does not change federal classification. The moment marijuana-derived CBD crosses a state line, federal law reasserts control.
FDA Oversight, State Patchwork, and International Rules
The FDA prohibits adding CBD to food products and dietary supplements under federal law, though enforcement has been discretionary. The agency has focused its limited resources on products making unproven health claims, contaminated batches, and companies marketing CBD as a cure or treatment. Retailers selling CBD-infused gummies, beverages, and pet treats are operating in a regulatory gray zone where the FDA could intervene at any time.
State laws range from fully permissive to restrictive. A handful of states still treat all cannabis-derived products as controlled, regardless of THC content, while others have explicitly adopted the federal 0.3% hemp threshold and built regulatory frameworks around testing, labeling, and retail licensing. The patchwork means the same product can be legal in one state and prohibited in a neighboring one.
The World Health Organization recommended in 2017 that pure CBD should not be scheduled under international drug treaties, and CBD was later removed from the organization’s scheduling review list. Most countries now follow a hemp-THC threshold similar to the U.S. 0.3% standard, though the European Union uses 0.2% for cultivation, and other nations like Japan impose zero-tolerance rules for any detectable THC.
Those international variations make cross-border travel especially fraught, which is why a practical checklist matters before you board a plane.
What varies by jurisdiction
- Federal (U.S.): Hemp-derived CBD with ≤0.3% delta-9 THC is legal; marijuana-derived CBD is Schedule I.
- State patchwork: Laws range from full prohibition to regulated retail; check your specific state’s hemp and cannabis statutes before purchasing.
- International travel: Many countries mirror the 0.3% threshold, but some ban CBD entirely or require zero THC.
- FDA enforcement: Focused on unapproved health claims and contaminated products, not on possession by individual consumers.
Travel, TSA, and a Practical Buyer-Protection Checklist
TSA screening focuses on security threats rather than drug interdiction. Officers will only flag CBD if it appears to be a marijuana-derived product exceeding legal hemp limits. TSA’s own guidance states that possession of hemp-derived CBD is not a federal law-enforcement priority, but agents are required to report suspected violations to local law enforcement if a product tests above 0.3% delta-9 THC.
Destination state law matters more than TSA when flying with CBD, because travelers can still face local penalties upon arrival in restrictive jurisdictions. Flying with hemp CBD into a state that bans all cannabis products can result in confiscation or misdemeanor charges, even if the product was perfectly legal at the departure airport. Research both your origin and destination state rules before packing CBD in carry-on luggage.
Buyers should request a current certificate of analysis, avoid products making disease-treatment claims, and watch for delta-8 THC contamination that can push total THC above legal thresholds. Delta-8, a psychoactive cannabinoid derived from hemp through chemical conversion, has created a new enforcement headache because some products labeled “CBD” contain undeclared delta-8 or delta-9 THC that pushes them out of compliance.
Your buyer-protection checklist
- Request the COA: Confirm the delta-9 THC percentage of the source plant and the cannabinoid profile of the finished product.
- Verify lab accreditation: Look for ISO 17025 certification or equivalent third-party validation.
- Check state law: Confirm both your home state and destination state permit hemp-derived CBD before traveling.
- Avoid health claims: Products claiming to treat, cure, or prevent diseases violate FDA rules and signal low-quality manufacturers.
- Watch for delta-8: Full-spectrum products may contain trace THC that accumulates; broad-spectrum or isolate products eliminate that risk.
- Match the batch number: The COA’s batch or lot number should match the product label exactly.
Putting It Together
Under 0.3% delta-9 THC by dry weight, the product is federally legal hemp. Above that threshold, it is Schedule I marijuana, regardless of how much CBD the extract contains. The Farm Bill created the hemp category, Epidiolex carved out a pharmaceutical exception, and state laws fill in the gaps with their own rules. Your safest move is to verify the certificate of analysis, know your state’s position, and treat any disease-treatment claim as a red flag.
FAQ
Is CBD considered a controlled substance under federal law?
CBD is not a controlled substance when extracted from hemp containing 0.3% or less delta-9 THC by dry weight. The Farm Bill removed such hemp and its cannabinoids from the Controlled Substances Act, so federally legal hemp CBD sits outside federal drug scheduling. You can carry and use such products under federal law, though state rules may add further conditions.
Why is CBD sometimes called a Schedule I drug?
CBD derived from marijuana, cannabis exceeding the 0.3% delta-9 THC threshold, is classified as a Schedule I controlled substance under federal law. Synthetic CBD was also briefly Schedule I before Epidiolex’s approval, and that historical listing still confuses outdated legal references. You should always confirm the source plant’s THC percentage before assuming a CBD product is federally legal.
Is CBD legal in all 50 states?
Hemp-derived CBD with 0.3% or less delta-9 THC is legal under federal law, but state restrictions vary. A small number of states still limit or ban all cannabis-derived products regardless of THC content, so check your specific state’s hemp statutes before purchasing. Your safest move is to review both the state you live in and any state you plan to visit.
Can CBD be prescribed by a doctor legally?
A single FDA-approved CBD medication, Epidiolex, holds the only prescription status for seizure-related conditions. All other CBD products are sold as unregulated hemp supplements and cannot be marketed as treatments for any medical condition under FDA rules. You will not receive a prescription for over-the-counter CBD oils or gummies from a licensed pharmacy.
What does the 2018 Farm Bill say about CBD?
The Farm Bill removed hemp, defined as cannabis with no more than 0.3% delta-9 THC by dry weight, from the Controlled Substances Act. Hemp-derived CBD became federally legal, but marijuana-derived CBD remained Schedule I, and the FDA retained authority over CBD in food and supplements. You can buy, sell, and possess compliant hemp CBD across state lines as a result.
Does hemp-derived CBD have the same legal status as THC?
No. Hemp-derived CBD with 0.3% or less delta-9 THC is federally legal, while THC above that threshold remains a controlled substance. The two compounds have opposite legal classifications despite originating from the same plant species. You should treat them as separate categories when purchasing, traveling, or discussing CBD products with employers or medical providers.
