Cannabis Brands & California's AI Disclosure Trap

SB 243 went live January 1, 2026. Here's what it requires:

• AI chatbot operators must disclose to users under 18 that they're interacting with AI
• The disclosure must be clear, conspicuous, and given before the minor has a meaningful interaction with the bot
• Operators cannot knowingly allow minors to access companion AIs without proper safeguards
• Failure to comply can result in fines and regulatory enforcement

For cannabis specifically, this is radioactive. Cannabis regulators in California (and most states) treat any content or experience that could reach minors as a potential violation. You're already walking a tightrope with age verification. Now you have to actively confirm you're disclosing AI to anyone who might be a minor.

Most cannabis brands don't have that infrastructure.

Here's the mechanics: A cannabis e-commerce site uses an AI-powered recommendation engine. A user lands on the site, gets recommended products based on their behavior, viewing history, or search patterns. The AI recommends Sativa strains if you've been looking at uplifting products. It recommends high-THC if you're a repeat buyer of potent flower.

That's an AI interaction. SB 243 says it must be disclosed.

But cannabis e-commerce has a problem: age verification is mostly a checkbox. You enter your birthdate, the site checks if you're over 21. If you're 17 and lie, the site has no real way to know.

Now you're operating a recommendation engine that may be serving minors without proper disclosure. That's a regulatory exposure.

<figure>

<img src="https://media.base44.com/images/public/69b513c1d64ad97ce633a6ba/80aeb8d13_generated_image.png" alt="Phone screen showing cannabis product recommendation with AI disclosure banner at the top in blue" />

<figcaption>Recommendation engines need explicit AI disclosure. Most cannabis sites don't have it built in yet.</figcaption>

</figure>

The trap isn't that the law is vague. It's that it requires you to prove you checked for minors before allowing them to interact with your AI. And most cannabis e-commerce platforms can't prove that.

Here's what cannabis brands actually need to do right now:

1. Audit your recommendation engine. Does it have AI disclosure? Is it visible before someone interacts with it? Most don't. They have it buried in a footer or not at all.

2. Upgrade age verification. A checkbox isn't enough anymore. You need multi-factor age verification (ID check, phone verification, etc.) especially if you're using recommendation engines.

3. Add explicit AI disclosure to your chat, product recommendations, and personalization flows. Not buried. Not implied. Not "powered by AI." Explicit: "You're interacting with an AI."

4. Log your compliance. Save evidence that you showed the disclosure to the user. If a regulator asks, you need to prove it happened.

5. Restrict AI interactions for unverified users. If you can't confirm someone is 21+, don't show them recommendations. Make the experience non-personalized for unverified traffic.

These aren't minor updates. Most e-commerce platforms would need weeks or months to implement this fully.

<figure>

<img src="https://media.base44.com/images/public/69b513c1d64ad97ce633a6ba/e235d379d_generated_image.png" alt="Law office desk at night with laptop showing California state seal and SB 243 document, red warning light reflected on glass" />

<figcaption>Regulatory liability just shifted. Cannabis brands need to prove they're SB 243 compliant before the first enforcement action hits.</figcaption>

</figure>

Here's the cruel part: SB 243 went live in January. It's June now. If you haven't updated your recommendation engine yet, you've been non-compliant for five months.

Cannabis regulators don't usually look backward aggressively, but enforcement happens in clusters. One brand gets audited. Suddenly everyone in that segment is under review.

The brands that move first have a narrative: "We updated to comply with SB 243 immediately." The ones that wait have a different story: "We operated a non-compliant AI recommendation engine for months."

That story matters in regulatory proceedings.

This is bigger than compliance theater. For cannabis brands, personalization was supposed to be a competitive moat. You track what customers like, you recommend products they'll buy, you build loyalty through AI-powered curation.

SB 243 doesn't kill that. But it does kill the silent version. Every recommendation, every personalized experience, now requires a disclosure. That friction matters.

Some brands will disable recommendations for unverified users entirely. Others will add the disclosure and live with the slight UX cost. The smart ones will see it as a brand moment: "We use AI, and we're transparent about it. Here's why."

<figure>

<img src="https://media.base44.com/images/public/69b513c1d64ad97ce633a6ba/54bda3a9d_generated_image.png" alt="Side-by-side comparison: cannabis checkout on left without AI disclosure warnings, on right with prominent AI disclosure banner and age verification popup" />

<figcaption>The cost of compliance: explicit AI disclosure in the checkout flow. Cannabis brands are caught between personalization and transparency.</figcaption>

</figure>

The window to act quietly is closing. If you're operating a cannabis e-commerce platform with recommendation engines, recommendation chatbots, or personalized product suggestions, audit them this month.

Don't wait for the first enforcement action. That's when the regulatory pressure gets real, and you're explaining why you were non-compliant for months while the rest of the industry was updating their systems.

SB 243 isn't a trap if you act. It's a trap if you don't.