Dispensary ID Verification SOP: A Budtender's Guide

ID verification at a dispensary means confirming three things before you ring up a sale: the customer is old enough to buy, the document in your hand is real, and the person holding it is the person on it.

A scanner covers part of the first one. Your team confirms the other two.

This is the step-by-step SOP for that check. It covers what to look at and in what order, what to do when an ID will not scan, which documents count for a medical customer, how to handle passports, military IDs, tribal IDs, and phone IDs, what changes for delivery and online orders, and when to stop and get a manager. State rules for California, New York, New Jersey, Massachusetts, Michigan, and Minnesota sit inline throughout and in a quick-reference section near the end, so you can find your state fast without reading six rulebooks.

In This Post

• What ID Verification Actually Includes
• The Budtender SOP: ID Verification Step by Step
• Scanning the ID: What It Catches and What It Misses
• When the ID Does Not Scan: Passports and Manual Verification
• Medical Customers: Recommendations, MMICs, and Registry Documents
• Out-of-State Customers and Medical Reciprocity
• Special ID Situations: Military, Tribal, Digital, Expired, Mismatched
• Delivery and Online Order Verification
• Website Age Gates
• What You May Scan, Record, and Keep
• State-by-State Quick Reference
• Manager Escalation: When Not to Complete the Sale
• Common Questions

What ID Verification Actually Includes

ID verification is a workflow, not a single scan. A complete check-in covers nine things:

1. Confirming the customer is old enough to buy, which is 21 and older for adult-use everywhere, with narrow medical exceptions.
2. Scanning the ID, and knowing what the scan does and does not prove.
3. Checking the document by hand: feel, print quality, expiration date.
4. Comparing the photo to the face in front of you.
5. Knowing what to do when the ID will not scan.
6. Confirming medical documents, registry records, and their expiration dates.
7. Handling out-of-state customers and out-of-state medical patients.
8. Running the same check at the door for a delivery and at pickup for an online order.
9. Knowing what you are allowed to scan, record, and keep.

Steps 1 through 4 happen at the counter, and the counter is the part the industry generally does well already. A peer-reviewed study of 50 California outlets found that pseudo-underage buyers were asked for ID at 100% of the licensed recreational retailers visited (Fell et al., Journal of Safety Research, 2022).

Licensed marijuana retailers are clearly keen to follow the rules. They're aware that the industry hasn't won everybody over yet, and they don't want to get shut down.

Angela Eichelberger, Senior Research Scientist, Insurance Institute for Highway Safety

The gaps show up in steps 5 through 9: the passport nobody knew how to handle, the medical recommendation from another state or that expired three months ago, the website that lets anyone order with one click.

The Budtender SOP: ID Verification Step by Step

Run these six steps on every customer, every time, with no exceptions for regulars. This is written to be lifted straight into a handbook or posted at check-in.

Step 1: Ask for ID first

Before the conversation warms up, before they browse, before anything goes in a bag. Asking early is faster and less awkward than asking after you have built rapport or they start ordering.

In some states, you do this twice: once at the door and again at the register (see for example Massachusetts, 935 CMR 500.140).

Step 2: Feel the card

Hold it. You are checking for rigidity, uneven thickness, bumps or air pockets near the photo, and edges that peel or separate. A real card feels like one solid piece, and usually contains obvious anti-counterfeit markers.

Step 3: Check the expiration date

Do this before anything else on the front. Expired is the single most common miss because it is the easiest thing to skim past. An expired ID is not valid proof of age in any of the six states covered here.

Step 4: Look at the photo, then look at the person

Photo against face. Then height and build against what is printed. Then date of birth, and do the math rather than trusting the scanner to have done it.

No machine does this step for you, and it is the first one to go when the line is long.

Step 5: Scan it

Scan after you have looked, not instead of looking. The scan is a second opinion and a record that the check happened, not the check itself. Whatever you confirmed by hand goes into the customer profile, so the record matches the document you actually held.

Step 6: Ask one question, give it back, decide

If you are unsure, ask something the holder should answer instantly: "What's your address?" or "What's your ZIP code?" Someone using their own ID answers without thinking. Someone using a borrowed one hesitates.

Then hand it back. If everything passed, move on warmly. If it did not, refuse politely and without debate, tell the customer "we check every customer, no exceptions," and let a manager know. Say it once, stay pleasant, and escalate if the customer pushes.

Steps 2 through 6 are adapted from the California Department of Alcoholic Beverage Control's F-L-A-G method: Feel, Look, Ask, Give it back. State cannabis regulators generally do not publish an equivalent budtender curriculum, so this borrows from alcohol retail as a starting point. Confirm the requirements in your own state before you post it on the wall.

Scanning the ID: What It Catches and What It Misses

A barcode scanner tells you what the barcode says. It cannot tell you whether the barcode is legitimate.

Every US driver's license carries a PDF417 barcode encoded to a published AAMVA standard. Because the specification is public, a counterfeit can carry a barcode that parses cleanly and matches the forged front of the card. Parsing a barcode confirms the data is well-formed. It does not confirm the document is real.

What a scan reliably does for you:

• Reads the date of birth without arithmetic errors.
• Reads the expiration date without you squinting at it.
• Pulls up a returning customer's profile so you are not retyping.
• Creates a record that the check happened.

What a scan cannot do:

• Tell you a genuine ID belongs to the person holding it. A borrowed real license passes every electronic check ever built. Only a person comparing the photo to the face stops it.
• Read a passport. Passports carry a machine-readable zone, not a PDF417 barcode.
• Confirm a medical document is current. That is a separate check.

Stronger verification systems add layers on top of barcode parsing: cross-checking the printed front against the barcode payload, comparing the document to known-good templates for that state and issue year, and checking ultraviolet and infrared security features. Useful, but still blind to the borrowed-ID problem.

When the scanner throws a warning

Situation: the scanner flags the customer as under 21, or flags the ID as expired.

• Check: read the actual printed date on the card yourself before you do anything else. A scanner can misread a worn barcode.
• Do: if the card confirms the warning, stop the sale. If the card contradicts it, the barcode is bad, so verify manually and note it.
• Exception: an under-21 warning is not automatically a refusal. In California a patient 18 or older with a valid physician's recommendation can buy, and in Minnesota an under-21 registry patient can buy at a store with a medical endorsement. Those overrides should require a manager.

💡 How Meadow handles this: Meadow flags an expired ID or an under-21 customer at check-in and lets a manager override the flag for a verified medical patient, so a legitimate sale does not dead-end at a warning. Why Integrated Cannabis POS Software is Essential for Compliance →

When the ID Does Not Scan: Passports and Manual Verification

An ID that will not scan is not automatically an invalid ID. Refusing a passport because your scanner cannot read it turns a legal sale into a lost customer and a bad review.

Passports

Situation: the customer hands you a US or foreign passport.

• Check: photo against face, date of birth, expiration date, and whether the document is intact and unaltered. Passports have no barcode for your scanner to read, so this is entirely manual.
• Do: verify by hand, then use your POS's manual entry or name lookup to create or find the profile. Never refuse a passport just because it will not scan.
• State rules: California, New York, New Jersey and Minnesota list both US and foreign passports as acceptable. Massachusetts and Michigan do not publish a list, so your house policy decides.

Damaged, worn, or unreadable barcodes

Situation: a real-looking license will not read after two or three tries.

• Check: the front of the card, closely. Wear on a barcode is common. Deliberate tampering shows up as scuffing concentrated over the barcode or the date of birth.
• Do: verify the front manually with the feel-look-ask steps, then search the customer by name or phone in your POS rather than forcing the scan. Tell a manager if the card looks tampered with rather than worn.
• Exception: none by state, but note that a store policy of "no scan, no sale" is stricter than any of these six states require and will cost you legal sales. An ID can still be valid and a sale compliant without a scan.

💡 How Meadow handles this: Skip Scanning lets staff search by name or phone and complete check-in manually, so a passport or a damaged barcode does not stall the line. Cannabis Dispensary SOPs: A Guide for Receptionists →

Medical Customers: Recommendations, MMICs, and Registry Documents

A medical customer needs at least two things: a government photo ID, and current proof of their medical status. What counts as that second document is the part that differs most between states, and it is where a new budtender is most likely to get stuck.

The check is always the same shape. Confirm the ID as normal, then confirm the medical document is the right type for your state, that the name matches the ID, and that the document has not expired. Medical documents expire quietly, and the customer usually does not know. Their status may be kept in a centralized state registry or managed by their doctor or recommendation service.

What counts as medical proof, by state

California. Sales to patients 18 and older with a valid physician's recommendation (4 CCR § 15404(b)). The Medical Marijuana Identification Card, or MMIC, is separate and voluntary. It does one thing: it triggers the sales and use tax exemption under R&TC § 6369.6, and only when the customer presents both the card and a government ID. Excise tax still applies. Cards can be validated online at mmic.cdph.ca.gov.

New York. Registry ID cards are no longer issued. Patients present a practitioner certification containing a registry number, plus a government photo ID (9 NYCRR § 113.13).

New Jersey. Patients may present a digital Medicinal Cannabis Program ID from their portal, a physical card, or neither, because dispensaries can look them up in the registry (NJ CRC).

Massachusetts. The medical rule uses a closed list of four documents: a driver's license, a government-issued identification card, a military identification card, or a passport (935 CMR 501.140). The patient presents one of those plus a Commission-issued registration card. Note that this list is narrower than the general "government-issued identification" language the adult-use side runs on, so the same store has two different ID standards depending on which door the customer came through.

Michigan. Patients present a valid unexpired registry card plus a driver's license or government photo ID (R 420.505(3)). The CRA warns explicitly that a pending application plus a physician certification is not a substitute for a card, and that patients relying on one risk arrest.

Minnesota. Minnesota issues a "registry verification" rather than a plastic card, and makes it available to endorsed retailers (Minn. Stat. 342.24 subd. 1(c)).

Customers under 21

Situation: the customer is under 21 and says they are a medical patient.

• Check: their government ID, then whether your state allows it at all, then the medical document itself and its date.
• Do: if your state allows it and the document is current, complete the sale and expect the POS to warn you. If you are unsure, get a manager.
• State exception: California permits sales to patients 18 and older with a valid physician's recommendation. Minnesota permits under-21 registry patients to purchase, but only at a store holding a medical cannabis retail endorsement. Massachusetts registers patients under 18, who cannot enter without their caregiver, and an 18 to 20 year old Massachusetts patient cannot shop an adult-use retailer at all, because the adult-use rule bars anyone under 21 from the premises.

Expired medical documents

Situation: the ID is fine, the medical document is expired.

• Check: whether the customer still qualifies as an adult-use buyer.
• Do: in California, a customer 21 or older can still buy, they just lose access to any preferential tax treatment and larger purchase limit. Tell them before the total surprises them. If the customer is under 21 and the medical document has expired, there is no sale.
• Exception: in states where medical status controls access rather than just pricing, an expired document means no medical sale. Confirm your state's treatment with your compliance lead.

💡 How Meadow handles this: Meadow stores the medical document type and its expiration date on the customer profile, separately from the ID, so a tax-exempt flag is tied to a document with a date on it rather than to someone's memory. The Complete Guide to Choosing a Cannabis Dispensary POS System →

Out-of-State Customers and Medical Reciprocity

For adult-use, an out-of-state customer is just a customer. A driver's license or state ID card from any US state is acceptable in all four of the states that publish a list, and the two that do not publish a list use general government-issued ID language that covers it. Check it exactly as you would an in-state license.

Medical is where reciprocity matters, and the answer is different in every state.

Situation: a customer presents a medical card from another state.

• Check: whether your state honors out-of-state medical status at all, and what document it requires.
• Do: if your state honors it, verify the out-of-state document is unexpired and the name matches the photo ID. If your state does not, explain the adult-use option if the customer is 21 or older, or explain the registration path if they are not.
• State exceptions:
  • New York accepts out-of-state medical patients who present proof of their home-state certification or registration along with a valid government photo ID (OCM).
  • Michigan recognizes visiting qualifying patients with a valid unexpired out-of-state registry card plus a photo ID (R 420.505(3)).
  • Minnesota accepts visiting patients from other states, districts, and tribal nations, and requires weekly reporting of every visiting-patient transaction (Minn. Stat. 342.51 subd. 2a).
  • New Jersey does not honor another state's card at the counter. A visiting patient must first obtain a nonrenewable six-month New Jersey card, which requires consulting a New Jersey health care provider (NJ CRC).
  • California has no reciprocity rule for visitors. A visiting patient 21 or older buys adult-use at full tax.

One Minnesota trap worth training on. Minnesota's visiting-patient ID list is not the same as its adult-use list. Subd. 2a accepts a photo ID issued by the patient's medical cannabis program, a driver's license, or a state ID card. It does not mention passports or tribal identification cards, both of which are valid at the adult-use register in the same store on the same shift.

Special ID Situations: Military, Tribal, Digital, Expired, Mismatched

Six situations that come up on almost every shift, in the order they cause trouble.

Photo does not match the person

• Check: face shape, ears, eye spacing, and the printed height and build. People change hair and weight, not bone structure.
• Do: refuse. This is the one failure no scanner catches, and it is the reason the manual look exists. Hand the ID back, decline without arguing, and tell a manager.
• Exception: none. There is no state where a mismatch is a judgment call you should make alone.

Expired ID

• Check: the printed expiration date, and whether it is a real expiration or a renewal sticker situation.
• Do: refuse the expired document, then offer the alternative. A passport works if they have one. So does an unexpired ID from another state.
• Exception: none among these six states. Expired is not valid proof of age anywhere here.

US military ID

• Check: whether your state's list includes it before you decide.
• Do: accept it in states that list it. In states that do not, follow your written house policy rather than improvising.
• State exception: California and New York both list military identification cards. New Jersey's list covers passports, driver's licenses, and state ID cards only. Minnesota's statute says proof of age may be established "only by" five documents, and a military ID is not among them. California also asks for less data on a military ID than on a general government document: name, date of birth, and photo, versus name, date of birth, height, gender, and photo (4 CCR § 15404(c)). Staff trained on a single five-item checklist will wrongly refuse valid military IDs and valid passports.

Tribal identification card

• Check: your state's list.
• Do: accept where listed. Where it is not listed, ask a manager rather than deciding at the counter.
• State exception: Minnesota expressly lists tribal identification cards. California, New York, and New Jersey do not list them. Massachusetts and Michigan do not publish a list, so this falls to house policy.

Digital or mobile ID on a phone

• Check: whether the state issues a digital ID, and if so where you can find a verifier app or compliant reader.
• Do: ask for the physical card. Never accept a screenshot or a photo of a license, which is not an ID anywhere.
• State exception: of these six states, only California and New York issue a mobile driver's license. None of the six states' cannabis regulations name a digital or mobile credential among acceptable documents. New York's liquor authority authorized mobile ID for alcohol sales in SLA Advisory 2024-2, requiring an embedded DMV key for real-time authentication and barring licensees from requiring a mobile ID over a physical one. New York's cannabis rules say nothing comparable. Until that changes, requiring a physical credential is the safer standard, and if you do accept a mobile ID, accept it only through a verifier app or compliant reader.

Under-21 format cards and name changes

• Check: the printed date on a vertical or portrait-format license, which many states issue to holders under 21, and whether that date has passed.
• Do: read the date, not the card shape. A vertical card whose 21st birthday has passed is still a valid unexpired ID.
• Exception: if the name on a medical document does not match the ID because of a marriage or legal name change, that should be decided by a manager or store policy.

Delivery and Online Order Verification

All six states apply the in-store ID standard at the customer's door. The document check does not get easier because the setting changed. It gets harder: nobody is watching, the driver is behind schedule, and the person who ordered online is not always the person who answers the door.

The driver's check:

• Check: the same feel, look, photo-match, and expiration steps as the counter, plus whether the person receiving is the person who ordered (if your state requires it).
• Do: make the door-side check a hard, non-skippable step in the driver workflow, and give drivers explicit authority to refuse and return. A refused delivery costs one order.
• State exceptions:
  • Massachusetts runs a two-stage model. Customers pre-verify before ordering, in person or through a Commission-approved electronic process. At the door, the agent confirms the ID matches the pre-verified ID, views proof of the order, and collects a signature that matches the identification presented (935 CMR 500.140(2)(d), 500.145).
  • New York requires both identities to be recorded in the point-of-sale system where the person receiving the delivery is not the person who ordered. Scanning is expressly permitted at the door (9 NYCRR § 123.10(d)(4)).
  • California applies § 15404 unchanged at the door, requires delivery employees to be at least 21, and requires deliveries to be made in person (4 CCR § 15415).
  • New Jersey repeats its no-copy rule for delivery (N.J.A.C. 17:30-15.2).
  • Michigan requires the recipient to be the registered patient, the caregiver, or the person 21 or older who placed the order (R 420.207).
  • Minnesota applies the same accepted ID list at delivery (Minn. Stat. 342.42).

Online orders and in-store pickup. An online order is not verified until someone checks a physical document. Re-verify at pickup exactly as you would a walk-in, and re-check that any medical document on file is still current, because a profile created in March may be sitting on a recommendation that expired in June.

Website Age Gates

Many states require an age gate on a dispensary website. Massachusetts treats operating a website that fails to verify the entrant is 21 or older as a prohibited advertising practice (935 CMR 500.105(4)(b)(13)). New York requires a mechanism designed to require a visitor to verify they are 21 or older, and OCM has confirmed a checkbox satisfies it (Parts 128 and 129, adopted). Others, including California, New Jersey, Michigan, and Minnesota, regulate the age composition of your advertising audience more than the door itself.

Either way, the gate is usually the easiest and weakest link in the chain.

Three inexpensive fixes, whatever your state requires:

• Replace the Yes/No button with a month and year date-of-birth field.
• Set a cookie so a visitor cannot back-button and re-enter a different age.
• Verify during processing and again at pickup or delivery, not only at the website door.

Then open your own menu in a private browser window. If a determined seventeen-year-old reaches checkout with one click and an invented birthday, that is your cheapest fix. If you are also working on the storefront side of your site, start with Dispensary SEO: The Truth About E-Commerce, Google Rankings, and Online Sales.

What You May Scan, Record, and Keep

Scanning to verify age is permitted in all six states. Feeding that scanned data into a marketing list is a violation in most of them. Many retailers handle this with a voluntary opt-in, usually a loyalty program, so the customer gets something in exchange for consenting. None of the six states requires you to photograph a customer's ID for an ordinary adult-use sale.

• New Jersey is the strictest. A retailer "shall not keep a copy of the consumer's photographic identification," but must still log that the examination and age confirmation occurred (N.J.A.C. 17:30-14.3).
• Massachusetts bars recording consumer personal information beyond what a retail transaction typically requires, absent the consumer's voluntary written permission (935 CMR 500.140(2)(c)).
• California permits electronic scanning to verify age or document authenticity, then prohibits retaining or using that data for any other purpose (Civil Code § 1798.90.1).
• New York applies a consent standard: a dispensary may not acquire or record consumer personal information without consent, beyond what is typically acquired in a sales transaction (9 NYCRR § 123.10(d)(5)).

If you cannot say where your scanned ID data goes after check-in, that is a compliance gap, not an IT question. Meadow keeps ID verification data inside the customer record and out of marketing exports by default. Book a Call to Learn More

State-by-State Quick Reference

Use this to find your state fast. Every line here is drawn from the sections above, and every citation is listed there in full. Confirm current requirements with your state regulator before you set store policy, because these rules change and local ordinances often add requirements on top.

California

• Adult-use documents: driver's license or state ID from any state, US and foreign passports, military ID (4 CCR § 15404). Tribal ID not listed. Issues a mobile driver's license, but cannabis rules do not name it.
• Medical proof: valid physician's recommendation, patients 18 and older (§ 15404(b)). MMIC is voluntary and only triggers the sales and use tax exemption (R&TC § 6369.6). Excise tax still applies.
• Visiting medical patients: no reciprocity. A patient 21 or older buys adult-use at full tax.
• Scan and retention: scanning permitted to verify age or authenticity; retaining or reusing that data for any other purpose is prohibited (Civil Code § 1798.90.1).
• Delivery: § 15404 applies unchanged at the door. Delivery employees must be 21 or older and deliveries must be in person (4 CCR § 15415).

New York

• Adult-use documents: driver's license or state ID, US and foreign passports, military ID. Tribal ID not listed. Issues a mobile driver's license, but cannabis rules do not name it.
• Medical proof: practitioner certification with a registry number plus a government photo ID. Registry ID cards are no longer issued (9 NYCRR § 113.13).
• Visiting medical patients: accepted with proof of home-state certification or registration plus a valid government photo ID (OCM).
• Scan and retention: consent standard. No acquiring or recording consumer personal information without consent beyond what a sales transaction typically requires (9 NYCRR § 123.10(d)(5)).
• Delivery: both identities recorded in the POS when the recipient is not the person who ordered. Scanning at the door is expressly permitted (§ 123.10(d)(4)).
• Website age gate: required mechanism; OCM has confirmed a checkbox satisfies it (Parts 128 and 129).

New Jersey

• Adult-use documents: passports, driver's licenses, and state ID cards only. Military ID and tribal ID not listed.
• Medical proof: digital Medicinal Cannabis Program ID, a physical card, or a registry lookup by the dispensary (NJ CRC).
• Visiting medical patients: not honored at the counter. The patient must first obtain a nonrenewable six-month New Jersey card, which requires consulting a New Jersey health care provider.
• Scan and retention: the strictest of the six. No copy of the consumer's photographic identification may be kept, but the examination and age confirmation must still be logged (N.J.A.C. 17:30-14.3).
• Delivery: the no-copy rule repeats for delivery (N.J.A.C. 17:30-15.2).

Massachusetts

• Adult-use documents: no published list. General government-issued identification language, so passports, military IDs, and tribal IDs fall to house policy. ID is checked twice, at the door and at the register (935 CMR 500.140).
• Medical proof: a closed list of four documents (driver's license, government-issued ID card, military ID card, or passport) plus a Commission-issued registration card (935 CMR 501.140). Narrower than the adult-use standard in the same store.
• Under-21 patients: patients under 18 cannot enter without their caregiver, and an 18 to 20 year old patient cannot shop an adult-use retailer at all.
• Scan and retention: recording consumer personal information beyond what a retail transaction typically requires is barred absent voluntary written permission (§ 500.140(2)(c)).
• Delivery: two-stage. Pre-verification before ordering, then an ID match, proof of order, and a matching signature at the door (§§ 500.140(2)(d), 500.145).
• Website age gate: a site that fails to verify the entrant is 21 or older is a prohibited advertising practice (§ 500.105(4)(b)(13)).

Michigan

• Adult-use documents: no published list, so passports, military IDs, and tribal IDs fall to house policy.
• Medical proof: valid unexpired registry card plus a driver's license or government photo ID (R 420.505(3)). A pending application plus a physician certification is not a substitute, per the CRA.
• Visiting medical patients: recognized with a valid unexpired out-of-state registry card plus a photo ID (R 420.505(3)).
• Delivery: the recipient must be the registered patient, the caregiver, or the person 21 or older who placed the order (R 420.207).
• Scan and retention: not addressed in the rules cited above. Confirm with your compliance lead.

Minnesota

• Adult-use documents: the statute says proof of age may be established "only by" five listed documents, which include a driver's license, a state ID card, US and foreign passports, and tribal identification cards. Military ID is not among them.
• Medical proof: a "registry verification" rather than a plastic card, made available to endorsed retailers (Minn. Stat. 342.24 subd. 1(c)). Under-21 registry patients may purchase only at a store holding a medical cannabis retail endorsement.
• Visiting medical patients: accepted from other states, districts, and tribal nations, with weekly reporting of every visiting-patient transaction (Minn. Stat. 342.51 subd. 2a). The visiting-patient ID list is narrower than the adult-use list: a program-issued photo ID, a driver's license, or a state ID card only.
• Delivery: the same accepted ID list applies at delivery (Minn. Stat. 342.42).

Manager Escalation: When Not to Complete the Sale

Refuse the sale, no manager needed, no discussion:

• The photo does not match the person.
• The ID is expired.
• The customer presents a screenshot or phone photo of a license.
• The card is visibly altered, laminated over, or coming apart.
• The customer is under 21 with no valid medical document in a state that allows under-21 patients, or under 21 anywhere that does not.

Stop and get a manager:

• The document is a type your state does not list and your house policy does not cover.
• The medical document is a type you have not seen before, or the name does not match the ID.
• The customer is under 21 and claims medical status.
• The scanner and the printed card disagree.
• The customer becomes aggressive, or a second person is coaching them.

What managers owe budtenders. A written compliance policy covering every document type, so nobody improvises under pressure. Avoid overriding a refusal in front of a customer. A POS warning that requires a manager rather than a dead end. And an owner who has said out loud that a slower line is always the right trade.

Then two habits worth putting on the calendar: run your own secret shops quarterly with an unfamiliar face and an expired ID, and audit a week of check-ins for expired documents that got through. It is the same discipline you already apply to inventory reconciliation and physical security, pointed at the control that protects your license most directly.

More Resources for Dispensaries

• Cannabis Dispensary SOPs: A Guide for Receptionists
• Budtender Training Best Practices for your Dispensary
• Why Integrated Cannabis POS Software is Essential for Compliance
• How to Build a Dispensary Security Plan: 7 Expert Strategies

Common Questions

What do I check on an ID at a dispensary?

Expiration date, photo against the customer's face, date of birth, and whether the card feels solid and unaltered. Scan it after you have looked at it, not instead. The scan reads the barcode, but only you can confirm the person holding the ID is the person on it.

How do dispensaries verify age?

Age verification at a dispensary is a document check, not a single scan. Staff confirm a government-issued photo ID in person, compare the printed date of birth and the photo against the person holding it, then scan the ID as a second opinion and a record that the check happened. Adult-use sales are 21 and older everywhere, with narrow medical exceptions in states like California and Minnesota. Delivery drivers run the same check at the customer's door.

What do I do if an ID will not scan?

Verify it by hand and complete the sale if the document is valid. Passports have no PDF417 barcode for a dispensary scanner to read, and worn licenses often fail too. Refusing a document your state accepts because your hardware cannot read it is a lost sale, not a compliance win.

Can someone under 21 buy cannabis?

Only as a medical patient, and only where the state allows it. California permits sales to patients 18 and older with a valid physician's recommendation, and Minnesota permits under-21 registry patients at stores holding a medical retail endorsement. Adult-use sales are 21 and older everywhere.

Do dispensaries accept out-of-state medical marijuana cards?

It varies by state. New York, Michigan, and Minnesota recognize visiting patients with the right documents, and New Jersey requires a visiting patient to obtain its own six-month card first. California has no reciprocity, so a visiting patient 21 or older buys adult-use at full tax.

Can a dispensary keep a copy of a customer's ID?

New Jersey explicitly prohibits it, and requires a record confirming the ID was examined instead. Other states regulate collection, scanning, retention, and use differently, and none of the six covered here requires photographing an ID for an ordinary adult-use sale. Check your state's current rule before storing an image or scan data.

This article is general information for cannabis operators, not legal or tax advice. Regulations change and local ordinances often add requirements on top of state rules. Confirm current requirements with your state regulator and your compliance counsel before setting store policy. Accurate as of the writing of this article.

Train Your Team Once, Then Let the System Hold the Line

The stores that pass compliance checks are not the ones with the strictest budtenders. They are the ones where the system catches the expired document, flags the under-21 profile, and keeps check-in fast enough that nobody is tempted to skip a step.

Meadow has built cannabis retail software since 2014, as Y Combinator's first cannabis startup, and supports operators across California, New York, New Jersey, Massachusetts, Michigan, and Minnesota. If your ID and medical document tracking currently lives in someone's memory or a shared spreadsheet, we should talk.

Book a Call to Learn More