Every state that has regulated adult-use cannabis has mandated some type of seed-to-sale tracking among licensees, but, importantly, the details vary greatly. Some states, like Colorado, have tried to roll out a fully state-run tracking system with predictably disastrous results. Most states, however, have taken a lighter approach and contracted with a private vendor with whom all licensees (and third-party tracking systems) are required to connect.
California has generally taken the latter approach, given the provisions included in Proposition 64, which forbid unreasonably restricting alternative systems. However, like so many of the other areas of the state’s emerging cannabis laws, some regulatory agencies and officials appear poised to disregard the limits of statutory authority or even the business and basic economic needs of industry participants.
Lately, a group of county officials has charged way past their legal authority. In 2018, a group of counties including Monterey, San Luis Obispo, Humboldt, Mendocino, and others, entered into a Joint Powers Authority (JPA) named the California Cannabis Authority (CCA). The CCA was ostensibly formed to facilitate tax collection and enforcement among licensed cannabis businesses, and, supposedly, to facilitate licensees access to banking servers through a mandated track-and-trace system. Then, late last year, the CCA began sending letters to licensed businesses, demanding an immediate direct connection (via API) with the CCA system by January 15 in order to maintain legal operating status.
While counties may permissibly establish a JPA, even for purposes like regulatory safety or licensee compliance, the actual demands made by CCA vastly exceed that scope. Notably, the letters sent by the CCA to licensees claim that its legal powers originated in a county resolution. Not only does such a resolution fail to appear on county websites, but it would also be insufficient to vest the JPA with such legal authority. Further, the track-and-trace system that CCA attempts to require would have no bearing on licensees’ access to banking services, since those requirements are generally set forth under the federal Banking Secrecy Act.
Further, tracking system mandates are the sole authority of state regulators in California, specifically the Department of Food and Agriculture and the Bureau of Cannabis Control (see e.g. BPC §26069(d)). While local governments have the power to license cannabis businesses and may establish restrictions for health and safety, environmental protection, security, and other limited reasons (§26201), their powers do not include inventory tracking or anything similar. Such delegated powers would require a separate agreement with the Bureau of Cannabis Control (§26202(b)), which has not been executed.
Finally, the initiative passed by the people clearly states that no cannabis regulations may prohibit a licensee from using alternative technologies or procedures to achieve substantive statutory purposes. (§26013(c)). This limit applies as a separate check on the substantive impact of the regulations themselves and was drafted specifically to prevent single-mandated tracking systems (at the state level), among other concerns.
Perhaps even more worrisome than all these extralegal actions, it appears the CCA associates itself only with two specific providers of seed-to-sale software: Biotrack and GrowFlow. We can find no evidence of public agencies following proper procurement rules to select these vendors. This elicits suspicion regarding their level of involvement since the CCA is attempting to require licensees to purchase their products.
To our knowledge, the CCA has yet to attempt true enforcement actions beyond the warning letters it has sent to licensees. But any attempted action by the CCA to impair the operations of a licensee would be patently illegal. Any licensee, or association of licensed businesses, would easily have standing to file for a declaratory judgment that the CCA is unlawful as applied.
It’s entirely possible that counties are unaware of these legal issues and the problems to which they may subject themselves through association with the CCA. So we urge great caution on behalf of regulators to ensure their attempts to regulate fall within their scope of authority, lest they become liable for damages to businesses they have regulated improperly.