Book a Call
Meta Ads Compliance · CBD

Meta Ad Compliance for CBD/Hemp Brands

CBD is the vertical Meta enforces most aggressively. Health-claim language triggers a predictable cascade to Business-Manager-wide restriction within six weeks. This page maps how CBD brands stay live at scale.

Book a Call →Learn more ↓
5,000+ ad accounts in the corpusLegitScript + Meta auth required in chainUS-only Meta authorization scope
Sections in this guide

Read in order, or jump to the section that answers your question.

SECTION 01 · Eligibility

What Meta permits on CBD/Hemp, and what is structurally out of reach

Before we talk about enforcement, we have to talk about eligibility. Meta gates CBD at the product level first. The enforcement system only applies to products that are allowed to advertise in the first place.

Three buckets define what can and cannot run.

The three eligibility buckets:

Permitted . US only
Non-ingestible CBD topicals

Permitted on Meta in the US only, with LegitScript Product + Website Certification plus per-account Meta authorization.

Eligible productslotions, creams, patches, salves, soaps, candles, cosmetics.

Permitted . US, Canada, Mexico
Hemp products with no CBD content

Hemp products with no CBD content and ≤0.3% THC, the federal Farm Bill threshold defining hemp vs cannabis. No LegitScript required.

Prohibited everywhere
Structurally unreachable on Meta

Ingestible CBD of any form (oils, tinctures, gummies, capsules, sublingual). CBD supplements, CBD vapes, pet CBD products. Any product exceeding 0.3% THC (cannabis).

The prohibited list is not Meta's discretion. LegitScript, the third-party authority Meta recognizes for CBD, excludes ingestible, pet, vape, and high-THC products from its CBD Certification Program. Without LegitScript, Meta CBD authorization cannot be requested. A brand whose primary line is ingestible CBD does not have a compliance problem on Meta. It has a channel-fit problem.

For those operators the answer is unambiguous. Not Meta, not at the ad layer, not through any internal-review workaround. Retail, organic search, email, and influencer channels remain open. Paid social on Meta does not.

May 23, 2026·3 min readRead more
SECTION 02 · Authorization chain

Two authorizations you need before an ad can run

Eligibility tells you what you can sell. Authorization is the two-step chain that turns an eligible product into an ad that can actually run. Both authorizations are required, in order. Skipping one or assuming they are the same step is the most common reason CBD launches stall before they spend a dollar.

Authorization 01

LegitScript certification

LegitScript is an outside company that certifies businesses selling regulated products. For CBD, it issues two certs together: a Product Certification for each SKU you sell (LegitScript sample-tests the product), plus a Website Certification that requires every CBD product on your site to be product-certified.

One uncertified item in your catalog blocks the website cert. Both certs require annual retesting and continuous monitoring. Treat LegitScript as an ongoing operational state, not a one-time application.

Authorization 02

Per-ad-account Meta authorization

LegitScript is not a Meta approval. It is a prerequisite for one. Once you have LegitScript, you request Meta authorization inside Meta Business Suite, under "Authorizations and verifications, CBD advertisements." This is US-only. There is no equivalent path for other markets. Meta asks for your LegitScript Website Certification URL during the request; that is the proof input it expects.

The two are sequential, not the same step. LegitScript certifies the business and the domain. Meta authorization is granted per ad account. If you have five ad accounts, each one needs its own Meta authorization; the LegitScript cert applies to the domain once. Subscribers who assume LegitScript alone is enough get stopped at the second gate.

May 24, 2026·4 min readRead more
REFERENCE · Meta ad policy

Meta's CBD, Hemp, and THC advertising policy

The rules below map directly to Meta's Drugs and Pharmaceuticals policy and the federal Farm Bill hemp classification. These are the exact policy inputs advertisers should build ad creative and landing pages against.

Hemp advertising

Rules for hemp ads

  • Video and image creators should reference hemp, not CBD, in ad copy.
  • Non-ingestible and ingestible hemp may be promoted in ads, targeted to permitted countries: United States, Canada, and Mexico.
  • Hemp products being promoted must not contain more than 0.3% THC content and must have no presence of CBD. If products contain THC, the disclaimer “Less than 0.3% THC” or “<0.3% THC” must appear in the product description on the website or product page.
  • Ads for hemp products may not carry claims that expressly state or imply that the featured products can treat, cure, prevent, mitigate, or diagnose a disease or medical condition in humans or animals.
  • Hemp ads must comply with all other Meta Advertising Standards and Community Standards, plus all applicable laws and regulations.
CBD and THC advertising

Rules for CBD and THC ads

  • CBD products are not permitted to be promoted in ads unless the product is a topical CBD treatment with LegitScript certification. Hemp is the word to use in all ad copy.
  • THC products (for example, marijuana) are not permitted to be promoted in ads. Products themselves may contain less than 0.3% THC as long as the product page carries that disclosure. THC should not be referenced in the ad.
Product examples

What's permitted vs. what's not permitted in ads

Allowed

Permitted in ads

  • Hemp < 0.3% THC
  • Hemp Heart
  • Hemp Seed Oil
  • Hemp Fiber (for clothing)
  • Full-spectrum Hemp
Not allowed

Prohibited in ads

  • Cannabidiol (CBD)
  • CBD Oil
  • CBD Isolate
  • PCR (phytocannabinoid-rich)
  • Cannabis Sativa Seed Oil
Jul 3, 2026 · 5 min read
SECTION 03 · Enforcement pattern

The CBD enforcement pattern

If you have eligible products and both authorizations, you still have to survive Meta's enforcement system, which behaves differently than Meta's written policies suggest. The gap between what Meta publishes and what Meta enforces is what catches CBD brands who read the rules and assume compliance follows.

The cascade mechanism itself is not unique to CBD. It is how Meta enforces across every regulated vertical. What is specific to CBD is the trigger: health-claim language. Here is the sequence Meta's enforcement system runs on CBD accounts:

Sequence . six-step cascade
CBD trigger: health-claim language
An ad goes live using health-claim language.
Anxiety relief, pain reduction, sleep improvement, inflammation. Sometimes the ad gets rejected immediately. Sometimes it runs for several days first, then gets pulled retroactively.
The rejection counts against the account.
Every rejection adds to a running score that measures the account's ad quality over a rolling window.
Rejections accumulate faster than expected.
For CBD, the density crosses Meta's internal threshold within weeks, not months.
The Business Manager gets flagged.
This is when enforcement stops being ad-by-ad and becomes account-wide.
Every ad account under the Business Manager loses spend capacity.
The cascade reaches all connected accounts. A brand with one healthy account and four rejected ads in a fifth can lose spend across all five.
Individual ad fixes no longer restore spend.
Once the Business Manager is flagged, ad-level corrections do not reverse the restriction. Recovery has to happen at the Business Manager level.

That is what "the CBD enforcement pattern" means. It is not a single bad ad. It is a trajectory that takes weeks to complete and gets harder to reverse the further along it goes.

May 25, 2026·2 min readRead more
SECTION 04 · Flagged policies

What Meta’s enforcement system flags on CBD ads

These are the policies Meta's enforcement system is actively flagging on CBD ads this quarter. Observed across 5,000+ ad accounts in the same vertical (ComplyAi Intelligence Graph, Q2 2026).

Flagged Flag 01

Health-claim language

Anxiety, depression, pain, inflammation, insomnia, arthritis, PTSD. Any explicit therapeutic claim reads as treatment. Softer language ("calm," "relief," "wellness") lands in a gray zone. Sometimes it survives. Sometimes it triggers review. Which side of the line it falls on shifts week to week depending on what Meta's review system is treating as borderline.

Flagged Flag 02

Personal-attributes framing

Second-person language that names a condition the reader has: "Lose your anxiety." "Stop suffering." "Tired of pain?" Meta treats this as more serious than third-person claims about a product, because it attributes a condition to a specific viewer.

Flagged Flag 03

Quantified efficacy

Specific numbers that promise a result: percent improvement, guaranteed sleep hours, cortisol reduction. Quantified claims trigger heightened review even when the numbers are accurate and study-cited.

Flagged Flag 04

Brand-name drug references

Mentioning prescription drugs the CBD product is positioned to replace: Xanax, Ambien, Oxycodone. Auto-rejected at high rates.

Flagged Flag 05

Drug imagery

Pills, syringes, dropper bottles styled like medicine, gummies that look pharmaceutical. Visuals carry as much enforcement weight as text.

Flagged Flag 06

Landing-page propagation

A clean ad pointing to a landing page with health-claim language re-triggers the rejection when Meta reads the destination. Fixing the ad without fixing the landing page does not resolve the flag. Both surfaces have to be clean.

May 26, 2026·3 min readRead more
SECTION 05 · Operational discipline

How CBD brands stay compliant at scale

With authorizations in place and the flagged policies as an avoidance map, four operational patterns actually keep spend live through enforcement waves.

Doesn't survive
VS
Survives
Therapeutic-claim language. "Treats insomnia."
Pattern 01
Wellness-state language. "Supports a balanced evening routine."
Why it works

The brands that hold spend write at the wellness-state layer, describing what someone does with the product, not what condition it treats.

Product-ingredient framing leads. Cannabinoid content and milligram figures in the hero.
Pattern 02
Wellness-state framing leads. Outcome and use-case in the hero; product detail sits in the product-detail section.
Why it works

Meta's auto-review system evaluates ads and landing pages based on the framing that lands on the initial view. Product-ingredient framing (cannabinoid content and milligrams as the headline message) routes the ad to a more scrutinized review path than wellness-state framing (outcome and use-case as the headline message). The licensed CBD authorization applies regardless; the framing choice governs how the review layer routes the ad.

Lead with the wellness-state layer in ad copy and above-the-fold landing page content. Describe what the product supports (evening routine, calm, recovery), not what is inside it.

Keep product-detail information in the product-detail section of the landing page, the standard place any consumer-goods brand lists ingredients, cannabinoid content, and milligrams. This is copywriting hierarchy, not concealment: the full product data stays available to any customer looking for it.

Missing disclaimer. No FDA disclaimer on the landing page.
Pattern 03
FDA disclaimer on every claim page. CBD, hemp, or supplement.
Why it works

"This statement has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease." Required not just on CBD landing pages but on any hemp or supplement landing page making a claim. The disclaimer changes how Meta's enforcement system reads the destination, and its absence is a common trigger even when the ad itself looks clean.

Non-US or state-blind targeting. Canada, UK, EU delivery, or California-vs-Texas ignored.
Pattern 04
US-only, state-fenced. Federal ceiling, state-level discipline beneath.
Why it works

Meta's CBD authorization is US-only. There is no path for Canada, the UK, the EU, or any other market. Within the US, state law still varies. What is permitted in California is not permitted in Texas, and CBD ads that ignore state-level legality get flagged faster than ads that respect it. Brands running at scale accept the US-only ceiling on Meta and geo-fence at the state level beneath it.

May 27, 2026·2 min readRead more
SECTION 06 · Recovery paths

When CBD ads get flagged

Recovery is the highest-stakes moment on this page. For accounts already in the cascade, the difference between 5 business days and 15+ days of no spend can be the difference between a quarter and a full runway.

CAI-monitored CBD accounts resolve enforcement actions in 5 business days versus 15+ days industry-wide. That gap exists because ComplyAi appeals against the underlying enforcement signal Meta exposes through its APIs, not the vague message that shows up in Ads Manager. 30 to 35% of adjudicated Meta enforcement decisions overturn when the appeal is anchored to the underlying signal rather than the policy clause cited in the rejection (ComplyAi Intelligence Graph, Q2 2026).

Recovery depends on which stage of the cascade the account has reached.

A note on current timelines (2026-Q2)

The 5-day figure reflects the operational standard when Meta's review pipeline is functioning at baseline. As of Q2 2026, Meta review latency has extended due to review-team capacity changes. Actual resolution times during backlog periods may exceed the standard.

01
Ad rejected

A single ad got caught by an enforcement signal

Visible event, not the cascade itself.

Recovery anchor

Find the underlying signal (not the vague Ads Manager message) and anchor the appeal against it. 30 to 35% overturn when anchored correctly.

02
Account restricted . Highest leverage

The pattern is accumulating, but the Business Manager has not tipped yet

Rejections accumulating faster than the account can absorb. Business Manager at the threshold. 75 to 80% of eventual suspensions passed through this stage first.

Recovery anchor

Fix the pattern producing the rejections before it reaches the Business Manager. The difference between a 5-day resolution and a multi-week unwind.

03
Account suspended

The cascade has reached the full account

Meta may already be applying enforcement to connected surfaces: other ad accounts, the Business Manager, Pages, ownership identities, payment methods.

Recovery anchor

Recovery has to address the full connected surface (the ad, the Business Manager, the Page, the ownership identity, the payment method), not just the ad. The appeal anchor changes at this stage. Fixing only the ad does not restore spend.

04
Daily spend limit reduced

The quietest signal

Meta silently reduces how much you can spend per day, without an explicit rejection message. The visible symptom is not being able to spend to your usual level. The actual cause is an underlying enforcement signal.

Recovery anchor

Look for the underlying signal (not the reduced spend cap) and address it before it escalates into Stage 1, 2, or 3. Spend-cap reductions almost always precede a more visible enforcement state if left alone.

Two operating principles behind the 5-day resolutions

ComplyAi's approach to appeals differs from generic recovery advice in two ways.

  • Appeal against the enforcement signal, not the policy clause. The message Meta shows in Ads Manager matches the underlying cause only 25 to 30% of the time. The signal that actually caused the rejection is exposed through Meta's APIs but not surfaced in the manager UI. Appeals anchored to the API signal overturn far more often than appeals anchored to the visible message.
  • Map the connected surface before the appeal goes in. When Meta flags an account, the flag can propagate across the connected surface: the ad, the Business Manager, the Page, the ownership identity, the payment method. Fixing only the surface that is visibly broken often leaves the underlying flag unaddressed. Mapping all connected surfaces first, then anchoring the appeal to the full picture, closes the loop faster than surface-by-surface appeals can.

Full step-by-step reinstatement playbook lives at Meta Ad Account Reinstatement.

May 28, 2026·3 min readRead more
SECTION 07 · Cross-account observation

What the Intelligence Graph observes that single-account monitoring cannot

The recovery approach above runs on cross-account observation. Here is what that observation surface actually sees, and why watching your own account alone structurally misses the earliest signal.

What the Intelligence Graph is

ComplyAi's Intelligence Graph is a cross-account enforcement database. It indexes 5,000+ ad accounts across regulated verticals over three years of continuous observation, recording every ad rejection, every restriction, every appeal outcome, and the pattern connecting them. It is how ComplyAi detects enforcement behavior that no single-account view can see.

Policy classes indexedDrugs & Pharmaceuticals · CBD Advertisements sub-policy · Cannabis/THC · Prescription Drugs · Personal Attributes · Unacceptable Business Practices.

A CBD brand watching its own Ads Manager sees only its own rejections. The pattern that signals a coming enforcement wave, a phrase that was borderline for six weeks suddenly getting auto-rejected across the entire vertical, is only visible from the cross-account layer.

For CBD specifically, the Graph surfaces:

  • Which copy patterns are flagging similar accounts this week, before they reach your account.
  • Which landing-page elements are propagating risk back to ads across the vertical.
  • Vertical-wide enforcement waves before they hit any single subscriber.
  • The Enforcement Signal Layer. The intelligence layer that reads what Meta's enforcement system exposes through its APIs but does not render in Ads Manager, keyed to CBD-specific patterns.

This is what "Trifecta" observation means: watching the ad, the account, and the landing page at the same time, against the cross-account pattern set. Single-surface monitoring catches single-surface problems. CBD enforcement does not sit on a single surface.

May 29, 2026·3 min readRead more
Pillar FAQ

Common questions from CBD advertisers

Why does my CBD ad get rejected even though I am LegitScript certified?
LegitScript unlocks the vertical-specific review filter. Without it, CBD topical ads do not survive baseline review. With it, individual ads can still be flagged for two reasons. First, LegitScript and Meta authorization are separate. LegitScript certifies your business and your domain; Meta authorization is granted per ad account. You need both. Second, even with both authorizations, individual ads can still be flagged for health-claim language, personal-attributes framing, quantified efficacy, or landing-page propagation. Authorization unlocks the channel; it does not pre-approve creative.
Can CBD brands run ads outside the United States on Meta?
No. Meta's CBD authorization is US-only. This is enforced at the request UI as a single-country dropdown. There is no internal-review workaround for Canada, the UK, the EU, or other markets. Hemp products with no CBD content and 0.3% THC or less have a wider geo scope (US, Canada, Mexico), but the ad and landing page must accurately represent the product being advertised. A hemp ad has to run against a hemp product with no CBD content; an ad that promotes CBD pointing to a landing page classified as hemp (or vice versa) triggers Meta's destination-match review and gets pulled regardless of authorization scope.
Can CBD brands use health-related language anywhere?
Softer, wellness-focused language ("supports better sleep") survives more often than direct therapeutic claims ("treats insomnia"). Landing pages with FDA disclaimers survive more often than pages without. But there is no location on the funnel where health-claim language is uniformly safe. Meta reads the entire visible surface, and what counts as a therapeutic claim shifts week to week.
What is the difference between CBD topicals and CBD ingestibles on Meta?
Topical CBD with LegitScript certification is broadly permitted in the US. Ingestible CBD is grayer. Meta's policy text prohibits it, but the enforcement system applies that policy with variance. The Intelligence Graph observes some ingestible CBD ads surviving on accounts with rigorous landing-page hygiene and conservative copy, while the same setups on other accounts get rejected. Outcomes track operational discipline more than policy text.
How quickly does Meta restrict a CBD account once rejections start accumulating?
Across the CBD accounts in the Intelligence Graph, rolling rejection density typically crosses the Business Manager restriction threshold within a few weeks of the first rejection. Once the Business Manager is restricted, individual ad fixes do not restore spend. Recovery has to happen at the Business Manager scope.
Meta Ads Compliance · CBD

Find out where your CBD account is in the cascade, before the next rejection lands.

Connect your Meta account and run a free assessment. The infrastructure scores your ad inventory, landing-page health-claim exposure, and BM-level cascade trajectory against the current enforcement pattern across the CBD vertical.

Book a Call →