As we begin the 2020 legislative session, states legislatures are introducing bills that would prohibit marijuana retailers from collecting any personal information from consumers other than a government-issued identification for the purpose of consumer age verification.  Specifically, the Hawaii state legislature introduced a bill aimed at protecting individual privacy for marijuana consumers:

In order to ensure that individual privacy is protected, the department shall not require a consumer to provide a retail marijuana store with personal information other than government-issued identification to determine the consumer’s age. A retail marijuana store shall not be required to acquire and record a consumer’s personal information.

New Jersey introduced a similar bill looking to accomplish the same goal:

In order to ensure that individual privacy is protected, the division shall not require a consumer to provide a marijuana retailer with personal information other than government-issued identification to determine the consumer’s age, and a marijuana retailer shall not be required to acquire and record personal information about consumers other than information typically acquired in a financial transaction conducted by the holder of a Class C retail license concerning alcoholic beverages . . . .

Other states have already implemented laws protecting marijuana consumers’ data.  Oregon, for example, passed a bill in 2017 that prohibits the state’s marijuana retailers from sharing or keeping information about their customers’ identities or purchases.  Also, Colorado voters passed Colorado Amendment 64 in 2012, which provided that a consumer does not need to disclose personal information to a retail marijuana store other than a government-issued identification to determine the consumer’s age.

The takeaway here is clear.  Protecting consumer privacy is uniquely important to marijuana consumers, as the plant is still federally illegal.  States with medical and adult-use marijuana dispensaries that are looking to encourage legal purchases of marijuana must implement these privacy protections. Likewise, businesses storing personal information need to use best practices to protect it.  For more on privacy and data security best practices, check out the content on our sister blog, Ad Law Access.