February 20, 2026
Selling hemp-derived THC and CBD products online in the U.S. isn’t just a question of “is it legal?” It’s also a question of whether your commerce platform, payment stack, and carrier will allow it—today, next month, and when state rules change mid‑promotion.
In 2025, merchants learned the hard way that a storefront can be compliant with one layer (the Farm Bill definition of hemp), while still being non‑compliant with another layer (FDA/FTC marketing rules, card‑network risk controls, platform acceptable‑use policies, or carrier restrictions). The result is a fragile stack: a single failed attestation, chargeback spike, or prohibited shipping destination can freeze funds or take a store offline.
This guide focuses on federal considerations and practical platform rules for Shopify, BigCommerce, and WooCommerce in 2025, with build patterns you can implement to reduce shutdown risk.
Informational only—not legal advice.
Most mainstream commerce providers anchor their policies to the federal definition of hemp from the 2018 Farm Bill—generally, hemp is cannabis (and derivatives) with no more than 0.3% delta‑9 THC on a dry‑weight basis. USDA has summarized this definition in its legal opinion and hemp program materials.
External reference: USDA hemp legal summary (PDF) https://www.ams.usda.gov/sites/default/files/HempExecSumandLegalOpinion.pdf
But platforms and processors often go beyond that baseline. Many evaluate:
Even where hemp-derived cannabinoids are lawful under the Controlled Substances Act carve‑out, the FDA continues to object to many uses of CBD in foods, beverages, dietary supplements, and products that make drug-like claims. FDA warning letters remain a key risk signal for platforms, acquirers, and insurers.
The FTC layer matters just as much: if your product pages, ads, or affiliates imply treatment/cure claims without competent and reliable scientific evidence, you invite enforcement and also processor de-risking.
The National Advertising Division (NAD) publishes decision summaries and helps set standards around substantiation, disclosures, and influencer marketing—issues that routinely show up in cannabinoid product advertising.
A common failure pattern in hemp‑THC e‑commerce is treating the platform as the only gate. In practice you face at least four independent gates:
Your store is only as resilient as the strictest gate in that chain.
Shopify’s policy posture in the U.S. is best described as: the storefront may be allowed, but payments require specialized routing.
Shopify states it supports the sale of hemp and hemp-derived products when laws in both the merchant’s location and the shipping destination permit it—and warns that noncompliance can lead to action up to termination.
For U.S. merchants selling hemp and hemp-derived products containing CBD, Shopify requires you to comply with platform requirements and be prepared to produce documentation on request.
Shopify also publishes “considerations” emphasizing compliance across jurisdictions and terms.
For hemp/CBD categories, Shopify generally expects merchants to use third‑party payment providers that explicitly support these sales. Shopify’s own documentation explains you can use compatible third‑party providers and that it is the merchant’s responsibility to confirm support.
Practical takeaway: build Shopify as your UX engine, but treat payments as a separate compliance project with underwriting, documentation, and ongoing monitoring.
Even if your standalone Shopify store is compliant, your products may be blocked from certain sales channels due to channel‑specific prohibited product lists.
To keep a Shopify hemp‑THC store stable, assume you’ll be asked to show:
BigCommerce is often chosen for regulated or high‑risk categories because it’s less prescriptive at the platform layer and integrates with many gateways. The catch is that BigCommerce does not magically solve banking and card acceptance.
BigCommerce recognizes that not all partners support hemp/CBD sales and maintains a collection for apps that “support CBD.”
BigCommerce also publishes educational resources on selling CBD and emphasizes state-by-state variation and the need to avoid unlawful drug claims.
In practice, BigCommerce hemp storefronts typically depend on:
Merchants should treat the “platform decision” and the “acquirer decision” as separate approvals.
BigCommerce shines when you need:
But you must still engineer:
WooCommerce is not a single “platform policy.” It’s an ecosystem: WordPress (host), WooCommerce (cart), plugins, and—most importantly—your gateway and hosting provider policies.
WooCommerce’s documentation is explicit that CBD and other hemp-derived products cannot be sold using WooPayments due to processor restrictions.
WooPayments also lists prohibited/restricted products and reiterates that CBD sales currently require different gateways.
If you host on WordPress.com or Pressable, WooCommerce publishes guidelines requiring specific payment solutions (notably Square in the U.S., Viva.com/Viva Wallet in certain regions).
Practical takeaway: with WooCommerce you can build almost any compliance feature—but you can also accidentally choose a host/gateway pair that will terminate you.
WooCommerce is often best for teams that want:
But it requires mature ops:
In 2025, Visa consolidated fraud and dispute monitoring into the Visa Acquirer Monitoring Program (VAMP). The official fact sheet explains new ratios and thresholds used to identify above‑standard and excessive risk portfolios.
Why it matters for hemp‑THC e‑commerce: acquirers may tighten underwriting, require stronger fraud controls, or terminate merchants if dispute and fraud metrics rise. Your compliance stack must include chargeback prevention (clear descriptors, fast customer support, transparent policies, and evidence packages).
Mastercard’s excessive chargeback and fraud monitoring programs are widely operationalized by acquirers. Even if your platform is fine, an adverse chargeback profile can lead to higher reserves, rolling holds, or account closure.
Operational reference (processor documentation): Braintree overview of Mastercard’s Excessive Chargeback Program: https://developer.paypal.com/braintree/articles/risk-and-security/card-brand-monitoring-programs/mastercard-programs/excessive-chargeback-program
If you sell subscriptions (gummies, tinctures, beverages) the category is already high‑risk. Layering continuity billing on top increases scrutiny. Build:
Many hemp‑THC merchants use hosted payment pages or iFrames specifically to reduce PCI scope. PCI DSS v4.0.1’s “future-dated” requirements became enforceable March 31, 2025, and the PCI SSC published an updated SAQ A in January 2025.
Even where SAQ A validation is simplified, the underlying reality remains: script injection and checkout manipulation are top threats. If your store runs many third-party scripts (pixels, affiliate tags, CRO tools), you need governance.
Practical controls to implement in 2025:
USPS updated Publication 52 to address hemp-based products and record retention, including retaining laboratory test results for a period (USPS has referenced a two‑year retention update).
Practical takeaway: if you ship via USPS, maintain an audit-ready packet for hemp shipments (COAs, licensing where applicable, policies), and do not assume international shipments are permitted.
UPS publicly states it accepts hemp derivatives or products containing hemp derivatives only as permitted by applicable federal, state, and local laws.
Operational takeaway: build adult-signature capability into your shipping rules for age-restricted SKUs and verify UPS account terms for your exact product set.
FedEx publishes prohibited item guidance (especially for international). Merchants should confirm whether their specific products are accepted under the current service guide and account terms.
Because carrier risk tolerance changes, your tech stack should support carrier switching without breaking compliance (e.g., automatically enforcing adult signature when required).
The following patterns directly address the user’s research notes and are the highest ROI for preventing platform, payments, and shipping failures.
A simple “Are you 21+?” pop-up is rarely enough for high-risk payment partners.
Build a layered approach:
Also log:
Treat compliance as data.
At the SKU level, add flags like:
Then wire those flags into:
The goal is to prevent “human memory” from becoming your compliance control.
Most enforcement pain comes from marketing language, not lab reports.
Create a claims review workflow:
Log every change:
External references:
In 2025, the merchants who survived platform and processor reviews were the ones who could quickly produce records.
Maintain an audit trail that includes:
A practical rule: if a regulator, platform, bank, or carrier asked “why did you ship this product to that address on that date?” you should be able to answer in minutes.
Best for:
Plan for:
Key references:
Best for:
Start here:
Best for:
Remember:
If you’re designing or rebuilding a hemp‑THC e‑commerce stack, don’t wait for a shutdown notice to discover a platform, bank, or carrier mismatch. Use https://cannabisregulations.ai/ to monitor policy changes, track federal and state compliance updates, and build repeatable workflows for cannabis compliance, licensing readiness, marketing review, and enforcement response—so your storefront stays live and your payment rails stay stable.
