5 Colorado Cannabis Laws You Must Know

Co header

Cannabis has been legal in Colorado for medical use since 2000. Adult-use was legalized in 2012.

The state's rules and regulations have evolved over the years and are still regularly changing.

In this post, we cover Colorado’s must-know cannabis laws. You can find the full regulations here.

Is your dispensary business plan ready yet? Get started now!

Dispensary business plan template

Colorado cannabis laws at a glance

  • Cannabis is legal in Colorado for both medical and recreational use.

  • The Marijuana Enforcement Division is the regulatory agency for cannabis in Colorado.

  • Colorado cannabis tracking is done through Metrc.

  • Medical marijuana is subject to a 2.9% state sales tax.

  • Retail marijuana is subject to a 15% state sales tax, levied on retail sales, along with a 15% excise tax, levied on the first transfer of marijuana from a wholesaler to a processor or retailer.

  • Cannabis delivery is legal in Colorado.

Law #1: Packaging and labeling

Legal reference

C. Packaging and Labeling of Regulated Marijuana Flower and Trim, and Regulated Marijuana Concentrate Prior to Transfer to a Patient or Consumer. A Medical Marijuana Store, Retail Marijuana Store, or Accelerator Store shall comply with the following minimum packaging and labeling requirements prior to Transferring Medical Marijuana flower and trim, Retail Marijuana flower and trim, Medical Marijuana Concentrate, or Retail Marijuana Concentrate to a patient or consumer: 1. Packaging of Regulated Marijuana Flower and Trim. Prior to Transfer to a patient or a consumer, Regulated Marijuana flower and trim shall be in a Container that does not exceed the sales limit in Rules 5-115(C) and 6-110(C). The Container may but is not required to be Child-Resistant. Any Regulated Marijuana flower and trim in a Container that is not Child-Resistant shall be placed into a Child-Resistant Exit Package at the point of Transfer to a patient or consumer. 2. Packaging of Regulated Marijuana Concentrate. Prior to Transfer to a patient or consumer, Regulated Marijuana Concentrate shall be in a Child-Resistant Container that does not exceed the sales limit in Rules 5-115(C) and 6-110(C). a. A Pressurized Metered Dose Inhaler, Vaporizer Delivery Device, or syringe-type device that is within an intended use that is listed in Rule 3-1015(B) and is not an Alternative Use Product need not itself be Child-Resistant but must be placed into a Child-Resistant Container prior to Transfer to a patient or consumer. b. A Pressurized Metered Dose Inhaler, Vaporizer Delivery Device, or syringe-type device with an intended use that is listed in Rule 3-1015(B) and that is not an Alternative Use Product must be labeled with at least the Universal Symbol, but is not required to include “Contains Marijuana. Keep away from children.”, prior to Transfer to a patient or consumer. The Universal Symbol shall be legible and no smaller than ¼ of an inch by ¼ of an inch. c. A Marketing Layer or Container for a Pressurized Metered Dose Inhaler or Vaporizer Delivery Device must be affixed with a label that states “Not approved by the FDA.” d. Nothing in this Rule authorizes the use of a syringe for any type of injection involving a needle piercing the skin. 3. Labeling of Regulated Marijuana Flower and Trim, and Regulated Marijuana Concentrate. Prior to Transfer to a patient or consumer, every Container of Regulated Marijuana flower and trim, or Regulated Marijuana Concentrate and any Marketing Layer shall be affixed with a label that includes at least the following information: a. Required License Number(s). The license number for each of the following: i. The Regulated Marijuana Cultivation Facility where the Regulated Marijuana was grown; ii. If applicable, the Regulated Marijuana Cultivation Facility(ies) where the Physical Separation-Based Medical Marijuana Concentrate or Physical Separation-Based Retail Marijuana Concentrate was produced; iii. If applicable, the Regulated Marijuana Products Manufacturer where the Medical Marijuana Concentrate or Retail Marijuana Concentrate was produced; and iv. The Regulated Marijuana Store that sold the Medical Marijuana, Retail Marijuana, Medical Marijuana Concentrate, or Retail Marijuana Concentrate to the patient or consumer, except the Regulated Marijuana Store may affix its license number to the Container or Marketing Layer. v. Retail Marijuana that was designated as Medical Marijuana pursuant to Rule 5-235, 6-230, 6-730 must be labeled with the license number of the Retail Marijuana Cultivation Facility. vi. Retail Marijuana Concentrate that was designated as Medical Marijuana Concentrate pursuant to Rule 5-335, 6-335, 6-830 must be labeled with the license number of the Retail Marijuana Products Manufacturer. b. Batch Numbers. The Harvest Batch Number(s) assigned to the Regulated Marijuana or the Production Batch Number(s) assigned to the Regulated Marijuana Concentrate. c. Statement of Net Contents. The statement of net contents must identify the net weight of the Regulated Marijuana or net weight or volume of Regulated Marijuana Concentrate prior to its placement in the Container, using a standard of measure compatible with the Inventory Tracking System. d. Universal Symbol. The Universal Symbol on the front of the Container and any Marketing Layer, no smaller than ½ of an inch by ½ of an inch, with the following statement directly below the Universal Symbol: “Contains Marijuana. Keep away from children.” e. Required Potency Statement. i. The potency of Regulated Marijuana flower or trim shall be expressed as: (1) the percentage of total THC and CBD from the test results for that Harvest Batch, or (2) if the Harvest Batch is not required to be tested, either as: (i) a range of percentages of total THC and CBD that extends from the lowest percentage to the highest percentage for each cannabinoid listed, from every test conducted on that strain of Regulated Marijuana cultivated by the same Regulated Marijuana Cultivation Facility during the preceding six months or (ii) an average for each cannabinoid listed, from every test conducted on that strain of Regulated Marijuana cultivated by the Regulated Marijuana Cultivation Facility during the preceding six months. If CBD is not detected in Harvest Batch, then Total CBD potency is not required. ii. The potency of Medical Marijuana Concentrate’s or Retail Marijuana Concentrate’s Total THC and CBD shall be expressed as a percentage. If CBD is not detected in the Production Batch, then Total CBD potency is not required. The potency of Regulated Marijuana, Medical Marijuana Concentrate, and Retail Marijuana Concentrate shall be displayed either: (i) In a font that is bold, and enclosed within an outlined shape such as a circle or square; or (ii) Highlighted with a bright color such as yellow. f. Date of Sale. The Regulated Marijuana Store shall affix the date of sale to the patient or consumer to the Container or Marketing Layer. g. Patient Number. The Medical Marijuana Store shall affix the patient’s registration number to the Container or Marking Layer at the time of Transfer to the patient. h. Solvent List. A list of any solvent(s) used to produce any Solvent-Based Medical Marijuana Concentrate or Solvent-Based Retail Marijuana Concentrate. i. Ingredient List Including Major Allergens. If applicable, a list of all Ingredients used to manufacture the Regulated Marijuana Concentrate including identification of any major allergens contained in the Regulated Marijuana Concentrate in accordance with the Food Allergen Labeling and Consumer Protection Act of 2004, 21 U.S.C. § 343 (2010). The Food Allergen Labeling and Consumer Protection Act of 2004, 21 U.S.C. § 343 (2010) requires disclosure of the following major food allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, and soybeans. i. Note that this Rule does not include any later amendments or editions to the United States Code. The Division maintains a copy of 21 U.S.C. § 343 (2010), which is available to the public for inspection and copying during the Division’s regular business hours. j. Required Warning Statements. Either the label affixed to the Container or the Marketing Layer shall include the following information: i. “This product was produced without regulatory oversight for health, safety, or efficacy.” ii. “There may be long term physical or mental health risks from use of marijuana including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.” k. Vaporizer Delivery Devices and Pressurized Metered Dose Inhalers. i. Ingredient List. A list of all Ingredients, including Additives, used to manufacture the Vaporizer Delivery Device or Pressurized Metered Dose Inhaler. ii. Expiration Date. Effective July 1, 2022, a Marijuana Products Manufacturer that produces a Vaporizer Delivery Device or Pressurized Metered Dose Inhaler shall include an expiration date pursuant to Rule 3-335(M). iii. Storage Conditions. Effective July 1, 2022, a Marijuana Products Manufacturer that produces a Vaporizer Delivery Device or Pressurized Metered Dose Inhaler shall include ideal storage conditions for the Vaporizer Delivery Device or Pressurized Metered Dose Inhaler pursuant to Rule 3-335(M).

Cannabis packaging explained:

  • Packaging must not appeal to children or target individuals under the age of 21.

  • Packaging can’t make false or misleading statements regarding health benefits.

  • Font size must be at least 1/16 of an inch.

  • Labels must be clearly written/printed in English.

  • Labeling cannot be obstructed or conspicuous. While you can add multiple labels to a container, all required information must be clearly visible at first glance.

Law #2: Security

Legal reference

Security Alarm Systems and Lock Standards A. Security Alarm Systems – Minimum Requirements. The following Security Alarm Systems and lock standards apply to all Regulated Marijuana Businesses, unless stated otherwise by these rules. 1. Each Licensed Premises shall have a Security Alarm System, installed by an Alarm Installation Company, on all perimeter entry points and perimeter windows. 2. Each Licensee must ensure that all of its Licensed Premises are continuously monitored. Licensees may engage the services of a Monitoring Company to fulfill this requirement. 3. A Licensee shall maintain up-to-date and current records and existing contracts on the Licensed Premises that describe the location and operation of each Security Alarm System, a schematic of security zones, the name of the Alarm Installation Company, and the name of any Monitoring Company. See Rule 3-905 Business Records Required. 4. Upon request, Licensees shall make available to agents of the Division or relevant Local Licensing Authority or Local Jurisdiction or state or local law enforcement agency, for a purpose authorized by the Marijuana Code or for any other state or local law enforcement purpose, all information related to Security Alarm Systems, Monitoring, and alarm activity. 5. Any outdoor or Greenhouse Medical Marijuana Cultivation Facility or Retail Marijuana Cultivation Facility is a Limited Access Area and must meet all of the requirements for Security Alarm Systems described in this Rule. An outdoor or Greenhouse Medical Marijuana Cultivation Facility or Retail Marijuana Cultivation Facility must provide sufficient security measures to demonstrate that outdoor areas are not readily accessible by unauthorized individuals. It shall be the responsibility of the Licensee to maintain physical security in a manner similar to a Medical Marijuana Cultivation Facility or Retail Marijuana Cultivation Facility located in an indoor Limited Access Area so it can be fully secured and alarmed. The fencing requirements shall include, at a minimum, perimeter fencing designed to prevent the general public from entering the Limited Access Areas and shall meet at least the following minimum requirements: a. The entire Limited Access Area shall be surrounded by a fence constructed of nine gauge or lower metal chain link fence or another similarly secure material. The fence shall measure at least eight feet from the ground to the top, or in the alternative, the fence may measure six feet from the ground to the top with a 1 foot barbed wire arm with at least three strands along the entire fence. All support posts shall be steel and securely anchored. b. All gates of ingress or egress shall measure at least eight feet from the ground to the top of the entry gate, or in the alternative, the gate may measure six feet from the ground to the top with a 1 foot barbed wire arm with at least three strands, and shall be constructed of nine gauge or lower metal chain link fence or a similarly secure material. c. The fence shall obscure the Limited Access Area so that it is not easily viewed from outside the fence. d. All areas of ingress and egress of the fence shall be illuminated including a 20 foot radius from the point of ingress or egress. The required lights may be, but are not required to be, motion sensing. See Rule 3-225(C). e. A Licensee or Applicant for initial licensure may, in writing, request that the Division waive one or more of the security requirements described in this subparagraphs (a) through (d) of this Rule, by submitting on a form prescribed by the Division a security waiver request for Division approval. The Division may, in its discretion and on a case-by-case basis, approve the security waiver if it finds that the alternative safeguard proposed by the Licensee or Applicant for initial licensure meets the goals of the above security requirements or that the security requirements are in conflict with a local ordinance of general applicability. Approved security waivers expire at the same time as the underlying License and may be renewed at the time the License renewal application is submitted. The Licensee’s or Applicant for initial licensure’s request for a waiver shall include: i. The specific rules and subsections of a rule that is requested to be waived; ii. The reason for the waiver; iii. A description of an alternative safeguard the Licensee will implement in lieu of the requirement that is the subject of the waiver; and iv. An explanation of how and why the alternative safeguard accomplishes the goals of the security rules, specifically public safety, prevention of diversion, accountability, and prohibiting access to minors. B. Lock Standards – Minimum Requirement 1. At all points of ingress and egress, the Licensee shall ensure the use of a commercialgrade, non-residential door locks. 2. Any outdoor or Greenhouse Medical Marijuana Cultivation Facility or Retail Marijuana Cultivation Facility must meet all of the requirements for the lock standards described in this Rule. Video Surveillance A. Minimum Requirements. The following video surveillance requirements shall apply to all Regulated Marijuana Businesses, unless stated otherwise in these rules. 1. Prior to exercising the privileges of a Regulated Marijuana Business, an Applicant must install a fully operational video surveillance and camera recording system. The recording system must record in digital format and meet the requirements outlined in this Rule. 2. All video surveillance records and recordings must be stored in a secure area that is only accessible to a Licensee’s management staff. 3. Video surveillance records and recordings must be made available upon request to the Division, the relevant Local Licensing Authority or Local Jurisdiction, or any other state or local law enforcement agency for a purpose authorized by the Marijuana Code or for any other state or local law enforcement purpose. 4. Video surveillance records and recordings of point-of-sale areas shall be held in confidence by all employees and representatives of the Division, except that the Division may provide such records and recordings to the Local Licensing Authority or Local Jurisdiction, or any other state or local law enforcement agency for a purpose authorized by the Marijuana Code, or for any other state or local law enforcement purpose. B. Video Surveillance Equipment 1. Video surveillance equipment shall, at a minimum, consist of digital or network video recorders, cameras capable of meeting the recording requirements described in this Rule, video monitors, digital archiving devices, and a color printer capable of delivering still photos. 2. All video surveillance systems must be equipped with a failure notification system that provides prompt notification to the Licensee of any prolonged surveillance interruption and/or the complete failure of the surveillance system. 3. Licensees are responsible for ensuring that all surveillance equipment is properly functioning and maintained, so that the playback quality is suitable for viewing and the surveillance equipment is capturing the identity of all individuals and activities in the monitored areas. 4. All video surveillance equipment shall have sufficient battery backup to support a minimum of four hours of recording in the event of a power outage.

Dispensary security explained:

  • Every licensed premise must have a security alarm system installed by an alarm installation company, on all perimeter entry points and windows, with continuous monitoring.

  • Prior to beginning operations, a Company must install fully operational video surveillance and camera recording system. The surveillance system must adhere to specifications required by the MED.

  • Companies must maintain up-to-date, current records and existing contracts on the licensed premises that detail the location and operation of each security alarm system, a schematic of security zones, the name of the alarm installation company, and the name of any monitoring company being used.

Law #3: Taxes

Legal reference

See full details on cannabis taxes in Colorado here.

Cannabis taxes explained:

  • Medical marijuana is subject to a 2.9% state sales tax.

  • Retail marijuana is subject to a 15% state sales tax, levied on retail sales, along with a 15% excise tax, levied on the first transfer of marijuana from a wholesaler to a processor or retailer.

Law #4: Delivery

Legal reference

G. Regulated Marijuana Delivery Requirements. 1. A Medical Marijuana Store, Retail Marijuana Store, Medical Marijuana Transporter, or Retail Marijuana Transporter shall not deliver Regulated Marijuana to patients, parents, guardians, or consumers while also transporting Regulated Marijuana between Licensed Premises in the same Delivery Motor Vehicle. 2. Delivery of Medical Marijuana and Retail Marijuana. a. A Medical Marijuana Store and Retail Marijuana Store, both of which hold a valid delivery permit, and which have identical Controlling Beneficial Owners, may complete deliveries of Medical Marijuana and Retail Marijuana using the same Delivery Motor Vehicle and without returning to the Medical Marijuana Store or Retail Marijuana Store between deliveries. b. A Medical Marijuana Transporter and Retail Marijuana Transporter, both of which hold a valid delivery permit, and which have identical Controlling Beneficial Owners may complete deliveries of Medical Marijuana and Retail Marijuana using the same Delivery Motor Vehicle and without returning to the Medical Marijuana Store or Retail Marijuana Store between deliveries. c. A Medical Marijuana Transporter holding a valid delivery permit may make deliveries for multiple Medical Marijuana Stores that also hold valid delivery permits using the same Delivery Motor Vehicle and without returning to a Medical Marijuana Store between deliveries. d. A Retail Marijuana Transporter holding a valid delivery permit may make deliveries for multiple Retail Marijuana Stores that also hold valid delivery permits using the same Delivery Motor Vehicle and without returning to a Retail Marijuana Store between deliveries. 3. An Owner Licensee or Employee Licensee delivering Regulated Marijuana shall not open any Container of Regulated Marijuana in the Delivery Motor Vehicle and is prohibited from packaging or re-packaging Regulated Marijuana once the Delivery Motor Vehicle has departed from the Licensed Premises of a Medical Marijuana Store or Retail Marijuana Store. 4. A Medical Marijuana Store or Retail Marijuana Store shall not accept delivery orders for Regulated Marijuana Product that is perishable unless the Delivery Motor Vehicle that will make the delivery has the ability to secure the Regulated Marijuana Product in climate-controlled storage. 5. A Medical Marijuana Store, Retail Marijuana Store, Medical Marijuana Transporter, or Retail Marijuana Transporter must maintain a transport manifest that documents the following: a. The time of delivery; b. The name, and identification number of the valid, acceptable identification (e.g. driver’s license) presented by the patient or consumer; c. Address of the private residence; d. Acknowledgement of receipt of delivery by the person receiving the delivery; e. If applicable, patient registry number; f. If applicable, primary caregiver registry number of the patient’s parent or guardian; and g. For every Regulated Marijuana delivery that could not be completed, the reason the delivery could not be completed. 6. Proof of Patient Medical Registry and Identification. a. Prior to Transferring possession of the order, the Owner Licensee or Employee Licensee delivering Medical Marijuana to a patient or a patient’s parent or guardian must: i. Inspect the patient’s or parent’s or guardian’s identification and registry identification card; ii. Verify the possession of a valid registry identification card; iii. Verify that the information provided at the time of order match the name and age on the patient’s or parent or guardian’s identification; and iv. Verify that the identification and registry identification card belong to the person receiving the delivery. b. The Owner Licensee or Employee Licensee must refuse delivery of Medical Marijuana if the person attempting to accept the delivery order cannot establish all of the requirements of subparagraph (F)(6)(a)(i) through (iv) above. 7. Proof of Consumer Identification. a. The Owner Licensee or Employee Licensee delivering Retail Marijuana to a consumer must first verify that the natural person accepting the delivery has an acceptable form of identification demonstrating the person is at least 21 years of age and that the person is the same as the person that placed the order for delivery with the Retail Marijuana Store. b. The Owner Licensee or Employee Licensee must refuse delivery of Retail Marijuana if the natural person attempting to accept the delivery order cannot establish all the requirements of subparagraph (F)(5)(a) above. 8. Daily Delivery Limits. a. A Medical Marijuana Store or Medical Marijuana Transporter must not deliver individually or in any combination, more than two ounces of Medical Marijuana, eight (8) grams of Medical Marijuana Concentrate, or Medical Marijuana Products containing more than 20,000 milligrams of THC to a patient in a single business day. b. A Medical Marijuana Store or Medical Marijuana Transporter must not deliver to a patient, parent, or guardian or private residence where the Licensee knows or reasonably should know that the patient, parent or guardian, or private residence has already received a delivery during that same business day. This does not prohibit delivery to more than one patient at the same time and private residence. c. A Retail Marijuana Store or Retail Marijuana Transporter must not deliver individually or in any combination, more than one ounce of Retail Marijuana, 8 grams of Retail Marijuana Concentrate, or Retail Marijuana Products containing more than ten 80 milligram servings of THC to a customer in a single business day. d. A Retail Marijuana Store or Retail Marijuana Transporter must not deliver to a consumer or private residence where the Licensee knows or reasonably should know that the consumer or private residence has already received a delivery during that same business day. This does not prohibit delivery to more than one consumer at the same time and private residence. 9. An Owner Licensee or Employee Licensee who cannot complete a delivery order for any reason must return the Regulated Marijuana to the Medical Marijuana Store, Retail Marijuana Store, or off-premises storage facility from which the delivery order originated. If the Container is unopened and has not been tampered with, the Medical Marijuana Store, Retail Marijuana Store, or off-premises storage facility may return the Regulated Marijuana into its inventory and reconcile it with the Inventory Tracking System by the close of business that same day. Otherwise, the Regulated Marijuana must be destroyed in accordance with this Rule and Rule 3-235. H. Confidentiality of Patient and Consumer Personal Identifying Information. A Medical Marijuana Store, a Retail Marijuana Store, a Medical Marijuana Transporter, a Retail Marijuana Transporter, and their respective Owner Licensees and Employee Licensees must keep all personal identifying information and any health care information obtained from patients and consumers confidential and must not disclose such personally identifiable information and any health care information to any person other than those who need that information to take, process, or deliver the order or otherwise as required by the Marijuana Code, or Title 18, or Title 25 of the Colorado Revised Statutes.

Cannabis delivery explained:

  • Responsible vendor certification is required prior to conducting the first delivery.

  • An inventory tracking system is also required for delivery.

  • Orders can be accepted from patients at least 21 years of age, parents of patients under 18, or consumers at least 21 years of age at a private residence. Deliveries cannot be made to patients ages 18-20.

Law #5: Purchase limits

Legal reference

Full details of cannabis purchase limits in Colorado can be found here.

Cannabis purchase limits explained:

Recreational cannabis customers can purchase 1 ounce or 28 grams of flower or equivalent amount of another product.

Note: 1 ounce of flower is equivalent to 8 grams of concentrate, 800 milligrams of edible product, or 6 seeds and clones.

Medical patients are allowed to purchase 2 ounces of flower, 40 grams of concentrate, 6 immature plants, or 20,000 milligrams of medical marijuana products.

    Colorado cannabis laws FAQs

    Is recreational cannabis legal in Colorado?

    Recreational cannabis has been legal in Colorado since 2012.

    How is marijuana taxed in Colorado?

    Medical marijuana is subject to a 2.9% state sales tax.

    Retail marijuana is subject to a 15% state sales tax, levied on retail sales, along with a 15% excise tax, levied on the first transfer of marijuana from a wholesaler to a processor or retailer.

    How much weed can I buy in Colorado?

    Adults 21 and older can purchase up to 1 ounce of retail marijuana, 8 grams of retail marijuana concentrate, or marijuana products containing up to 800 milligrams of THC in a single transaction. A single transaction includes multiple sales to the same customer during a single business day.

    Medical marijuana patients can purchase up to 2 ounces of medical marijuana, 8 grams of marijuana concentrate, or marijuana products containing up to 20,000 milligrams of THC in a single transaction. A single transaction includes multiple sales to the same customer during a single business day.

    Is Flowhub compliant with Colorado’s medical marijuana regulations?

    Yes! Flowhub was the first integrator with Metrc, so we have a deep understanding of how to keep your dispensary compliant. We also are compliant with Colorado's cannabis regulations.

    Disclaimer: The material contained on this website and any attached or referenced pages has been compiled by Flowhub for informational purposes only. It is not intended to be and is not considered to be legal advice. This post is current as of 5/19/2022. Cannabis regulations are rapidly changing, and legal advice of any nature should be sought from legal counsel.

    Maui action

    Is your POS made for CO cannabis?

    Book a demo to see how Flowhub helps you stay compliant.

    Maui action

    Discover a new way to sell cannabis

    Flowhub helps dispensaries run fast, smooth, and compliant business operations.