Hemp CBD Labeling COAs and Lab Testing for DTC Ecommerce

By E-commerce 4 Internet Marketers Editorial

Explainer. Direct-to-consumer hemp and cannabidiol (CBD) catalogs live under three overlapping pressures: U.S. Food and Drug Administration (FDA) product-category and claim rules, state finished-product testing and labeling statutes that often require publishable certificates of analysis (COAs), and payment-platform underwriting that treats missing, stale, or mismatched lab files as account risk. Website owners and developers who sell these SKUs need storefront systems that keep batch-matched COAs, contaminant results, and claim-safe copy in sync with inventory. This article maps what teams should publish on product detail pages (PDPs) and labels, and what federal law actually does and does not mandate. It is not legal, underwriting, or laboratory advice. Prefer FDA and USDA primary materials over secondary summaries. Never invent a federal finished-product testing mandate or an FDA allowance for disease claims.

Start with the federal baseline, not a marketing COA template

The Agriculture Improvement Act of 2018 (2018 Farm Bill) defined hemp as Cannabis sativa L. and parts of that plant with a delta-9 tetrahydrocannabinol (THC) concentration of not more than 0.3 percent on a dry weight basis, and removed that hemp from Controlled Substances Act control. The same statute explicitly preserved FDA authority under the Federal Food, Drug, and Cosmetic Act (FD&C Act). FDA’s cannabis and CBD FAQ states that Farm Bill hemp status does not exempt an FDA-regulated product from food, drug, dietary supplement, cosmetic, or veterinary rules.

On that FDA page, the agency states that THC and CBD products are excluded from the dietary supplement definition under section 201(ff)(3)(B) of the FD&C Act, and that introducing food (including animal food) to which THC or CBD has been added into interstate commerce is prohibited under section 301(ll), subject to the statutory exceptions FDA says do not apply on the evidence it has reviewed. FDA has evaluated three hemp seed-derived ingredients (hulled hemp seed, hemp seed protein powder, and hemp seed oil) under generally recognized as safe (GRAS) notices for specified human-food uses. Those GRAS conclusions do not change FDA’s position on adding CBD or THC to food.

For cosmetics, FDA states that cannabis or cannabis-derived ingredients are not currently prohibited by cosmetic ingredient regulation, but a product intended to diagnose, cure, mitigate, treat, or prevent disease, or to affect the structure or function of the body, is a drug (or both a cosmetic and a drug). Intended use is established by labeling, advertising, internet claims, and other promotional materials. FDA has repeatedly issued warning letters to firms marketing CBD products with therapeutic claims, and it has published analytical results showing label CBD claims that did not match laboratory measurements.

FDA’s January 26, 2023 stakeholder materials (A New Way Forward for Cannabidiol (CBD) and Other Hemp Products) state that existing food and dietary supplement frameworks are not appropriate for CBD, given CBD’s risk profile and the protective safety standards of those pathways, and that FDA is prepared to work with Congress on a new path. That statement is not a green light to market CBD as a lawful dietary supplement or conventional food on a DTC site.

Operational takeaway. Publishing a COA does not legalize an unlawful product category or a disease claim. COAs and contaminant panels answer composition and purity questions. They do not rewrite FD&C Act category rules.

Separate USDA crop compliance tests from finished-SKU storefront COAs

U.S. Department of Agriculture (USDA) Laboratory Testing Guidelines for the Domestic Hemp Production Program apply to samples taken from hemp crop lots under USDA, State, or Tribal plans. These compliance tests measure total delta-9 THC on a dry weight basis with post-decarboxylation or similarly reliable methods, report measurement of uncertainty, and feed official results (including certificates of analysis returned to producers) into USDA’s Hemp eManagement Platform. USDA encourages ISO/IEC 17025 adherence but does not require ISO accreditation for those crop-compliance labs. After December 31, 2024, labs approved for that THC compliance testing must also be Drug Enforcement Administration (DEA) registered under the Controlled Substances Act framework described in the guidelines.

Those USDA rules are producer and regulator obligations for growing hemp. They are not a federal instruction that every DTC merchant must host a finished-product COA PDF on Shopify or WooCommerce. Ecommerce teams still need finished-SKU documentation because buyers, destination states, processors, and brand partners ask for it, and because crop-lot THC results alone rarely match the bottled, gummied, or topped SKU a customer receives.

Treat upstream lot COAs and finished-batch COAs as different records in the catalog. Link the finished form to the live sellable SKU. Keep the crop record in the supplier file.

What a publishable finished-product COA should show

No single federal statute tells every U.S. hemp DTC site exactly which fields to render on a PDP. State statutes and buyer contracts fill that gap. California’s industrial hemp chapter is a concrete, primary example of finished-product expectations that ecommerce teams shipping into that market must operationalize.

Under California Health and Safety Code section 111925 (testing), a raw hemp product may not be distributed or sold in the state without a COA from an independent testing laboratory confirming that a representative batch sample met total THC limits (including stricter “no THC” pathways for foods, beverages, dietary supplements, and some cosmetics as stated in that article) and did not contain contaminants unsafe for human or animal consumption. Contaminant testing levels for industrial hemp are tied, as of the statute’s effective design, to cannabis contaminant requirements under Business and Professions Code section 26100, with department authority to adjust levels by regulation. Failed batches that cannot be reprocessed or remediated must be destroyed; stale COAs older than twelve months trigger retest rules described in that article.

Under section 111926.2 (dietary supplement, food, or beverage labeling) and section 111926.3 (cosmetic labeling), California requires packaging and labeling that include a label, scannable barcode, internet website, or QR code linked to the independent laboratory COA for the final-form product batch (or final-form extract for cosmetics). That linked COA must identify product name; manufacturer, packer, or distributor name, address, and telephone number; a batch number matching the product; cannabinoid concentrations including at minimum total THC and marketed cannabinoids (plus other labeled hemp derivatives as required); and contaminant levels required by the testing article. Food, beverage, and dietary supplement labels also require child and pregnancy caution statements and the exact FDA disclaimer text required by statute. Cosmetics require the FDA disclaimer as well.

For multi-state catalogs, treat California’s public COA-link requirement as a design pattern, not a substitute for every destination statute. Build PDP and packing-slip flows that can attach a batch-matched final-form COA URL to every sellable unit, then layer destination-specific fields and warnings as counsel maps them.

A storefront-ready COA package commonly includes, at minimum:

Independent laboratory identity and accreditation or license status required by the destination (ISO/IEC 17025 is widely preferred by buyers even where USDA crop rules do not mandate it).
Sample and batch identifiers that match the bottle, jar, or softgel lot in the warehouse management system.
Cannabinoid panel covering total THC (and delta-9 THC / THCA math where the destination requires it), CBD or other marketed cannabinoids, and units that match the label (mg per serving and per container, or percent).
Contaminant panel results required by destination law or buyer specification (often residual solvents, heavy metals, pesticides, mycotoxins, and microbial limits for ingestible forms).
Test date, report date, method notes sufficient for an auditor to see that the report is for the finished form, not only a flower lot.
Pass/fail or quantified results against the limits the seller claims to meet.

Do not publish a crop-only USDA compliance slip as if it were a finished gummy COA. Do not publish a COA whose batch ID does not match the unit shipping today.

Contaminant testing is mostly state, contract, and safety driven

FDA’s cannabis FAQ does not publish a national finished-product contaminant panel that every CBD DTC merchant must run and post. FDA does state that cosmetics may be adulterated if they bear or contain a poisonous or deleterious substance that may render them injurious under labeled or customary use, and that no cannabis-derived cosmetic ingredient may cause adulteration or misbranding. Warning-letter practice and FDA’s historical analytical tables focus heavily on unlawful therapeutic claims and on label-versus-lab potency mismatches.

States and buyers fill the contaminant gap. California’s industrial hemp testing article expressly requires contaminant confirmation on independent COAs and points to cannabis contaminant frameworks as the starting point. Processors and specialty hemp acquirers often ask for the same panels before approving a merchant ID, even when their public acceptable-use pages do not spell out every analyte.

Ecommerce practice. Store contaminant results as structured metafields or attributes (pass/fail plus numeric values) next to the PDF. Block fulfillment when a required contaminant line is missing, expired under destination rules, or fails. Do not invent a “federal USP hemp panel” in site copy.

On-site label claims that create FDA drug problems

FDA’s FAQ and warning-letter hub are consistent on intended use. Any product (other than a food) intended to affect the structure or function of the body, or intended for therapeutic or medical use, is a drug and generally needs FDA approval or an applicable OTC monograph pathway. CBD was not an ingredient considered under the OTC Drug Review. Unapproved new drugs may not be introduced into interstate commerce.

Disease and therapy claims on PDPs, collection pages, blogs, chatbots, influencer briefs, and paid ads are therefore high-risk even when a COA is perfect. FDA warning letters have cited claims about cancer, Alzheimer’s disease, pain, opioid withdrawal, autism, ADHD, and similar conditions, and have separately objected when CBD products were labeled as dietary supplements despite the section 201(ff)(3)(B) exclusion.

Structure/function claim rules under the Dietary Supplement Health and Education Act (DSHEA) apply to qualifying dietary supplements. They are not a safe harbor that converts CBD into a lawful dietary supplement under FDA’s current interpretation. Cosmetic-only claims (cleansing, beautifying, moisturizing, altering appearance) stay closer to cosmetic intended use, but pain relief, anti-inflammatory therapy, hair growth, or disease treatment language can push a topical into drug territory, as FDA’s cosmetic-versus-drug guidance and CBD warning letters illustrate.

Storefront claim QA.

Strip diagnose, cure, mitigate, treat, prevent, and disease-name language from every surface that markets the SKU.
Do not label CBD SKUs as “dietary supplements” or display Supplement Facts panels as if FDA recognizes CBD as a lawful dietary ingredient.
Do not market CBD-added foods or beverages as lawful conventional foods under federal law.
Keep cosmetic copy appearance-focused unless counsel documents a different pathway for that exact SKU.
Align milligram claims on the PDP with the batch COA. FDA’s published analytical tables exist because label claim mismatches are an enforcement-visible problem.

Payment rails and processors care about the same files buyers want

Stripe’s Prohibited and Restricted Businesses list treats cannabis products and dispensaries as prohibited, lists CBD products with THC above the applicable local jurisdiction’s legal limit (including CBD edibles) as prohibited, and lists CBD products containing only negligible THC (per local limits) as restricted businesses that require additional due diligence. Shopify Payments eligibility materials state that regulated or illegal products such as cannabis and related products are among high-level prohibited categories, with country-specific lists applying.

Mainstream aggregators do not publish a universal “upload these five COA analytes and you are approved” checklist. Underwriters still ask for licenses, formulas, COAs, and claim screenshots when a specialty processor will support hemp. Missing or non-batch-matched COAs are a common reason reviews stall or accounts pause. Treat the public COA library as both a buyer trust asset and an underwriting packet that can be regenerated on demand.

Implementation checklist for DTC teams

SKU master data. For every sellable unit, store product form (ingestible, topical, inhalable, other), marketed cannabinoids, destination eligibility flags, and the current finished-batch ID.
COA object. Attach laboratory name, report ID, test date, PDF or hosted URL, cannabinoid table, contaminant table, and pass/fail. Expire or quarantine SKUs when the COA ages past destination or buyer limits.
PDP publishing. Surface a human-readable summary and a link or QR target to the full COA. Match California-style public link requirements when shipping into jurisdictions that require them.
Label and pack artwork. Keep milligram claims, batch codes, required state warnings, and FDA disclaimer text (where required by destination law) in the same content system as the PDP.
Claims firewall. Run automated scans for disease and therapy phrases before publish. Hold influencer and email copy to the same rules.
Warehouse gate. Pick/pack should fail if the physical batch does not match the COA attached to the order line.
Acquirer packet. Keep a current export of COAs, licenses, and claim screenshots for restricted-business reviews.

What this article deliberately omits

Any claim that FDA requires every U.S. hemp DTC merchant to publish a finished-product COA.
Any invented federal contaminant panel, action limit table, or “FDA-approved CBD supplement” pathway.
Any suggestion that structure/function claims make CBD a lawful dietary supplement under FDA’s current reading of section 201(ff)(3)(B).
A 50-state matrix of hemp finished-product rules (destination statutes change and must be verified per ship-to).
CMS Medicare-program enforcement-discretion letters as a general DTC marketing permission (those materials, when issued, are program-specific and are not a storefront license).
Medical, dosing, or therapeutic advice of any kind.

Those omissions keep the North Star clear. Ecommerce teams selling regulated hemp products need maintainable COA, contaminant, and claim controls tied to primary sources and destination law, not a blog post that invents federal testing mandates.

Hemp-Derived Product Labeling and Lab Testing Requirements for DTC Sites