Florida's Hemp Label QR Code Rule: The Scan Has to Outlive the Product

Florida is one of the few states that requires a scannable code by statute rather than by guidance — and then tells you how deep the link may be and how long it has to keep working. The second of those is the one that catches people: the code has to stay operational for at least 90 days after the product's expiration date.

The statute

The requirement starts in Fla. Stat. § 581.217(7)(a), part of Florida's hemp program. Hemp extract may be distributed and sold in the state only if the container includes, among other things:

"A scannable barcode or quick response code linked to the certificate of analysis of the hemp extract batch by an independent testing laboratory"

The same subparagraph list also requires the batch number, the internet address of a website where batch information may be obtained, the expiration date, and the number of milligrams of each marketed cannabinoid per serving.

Source: Fla. Stat. § 581.217 (2025), The Florida Senate.

The two conditions the rule adds

Rule 5K-4.034, F.A.C. (Hemp Extract for Human Consumption), administered by FDACS, then puts limits on that code. Verbatim:

(6)(k) "The scannable barcode or quick response code required in Section 581.217(7)(a)2., F.S., shall be conspicuously marked and link directly to a webpage where the required certificate of analysis may be found in three or fewer steps."
(6)(l) "The scannable barcode or quick response code required in Section 581.217(7)(a)2. F.S., shall be operational for at least 90 days after the expiration date of the product."

Subsection (6)(m) separately requires the certificate itself to name the independent testing laboratory, including its address and ISO certification number.

Source: Fla. Admin. Code R. 5K-4.034 · rule history and current status: flrules.org, Rule 5K-4.034.

The 90-day clause, in plain English. A label is designed once. The expiration date printed on it might be twelve or eighteen months out. Florida then asks the link on that label to still resolve for three months after that date. So the address you print today has to survive every website change you make between now and roughly two years from now. That is a long time for a Drive link or a page in a media library.

Status note

Rule 5K-4.034 has been amended more than once recently. The COA-link conditions quoted above came in with the amendment effective March 12, 2025; a further amendment took effect November 2, 2025, which addressed the definition of "cartoon" and packaging attractive to children rather than the certificate provisions. Because this rule moves, treat any summary — including this one — as a starting point and confirm the live text with FDACS before a print run.

What has to be on the other end of the scan

Three or fewer steps is a real constraint, not a figure of speech. A scan that opens a homepage, then a "lab results" index, then a folder listing, then the file, has already spent four. A shared Drive folder that a person has to search by product name is worse, because there is no defined number of steps at all. The clean reading is: scan, and the certificate for that batch is in front of you.

It also has to be the right batch. The batch number is a separate statutory label element, so the number printed on the package and the certificate the code reaches are meant to name the same thing.

The practical failure mode

Almost nobody falls out of compliance on purpose. It happens because the certificate lives somewhere that can move: a Drive link, a PDF in the site media library, a page that gets reorganized during a redesign. The label is already printed and in the field, so there is no cheap fix — the only real remedy is a relabel. The structural answer is one address per batch whose only job is showing that batch's certificate, and which does not change when the rest of the website does.

One permanent link per batch, built to still work later

BatchLink gives each batch a permanent URL plus a printable QR code that opens the certificate directly, with the batch number, lab and dates on the page. Swap the certificate anytime without reprinting. Free for your first two batches, no card.

Create a free batch page

Related reading

Sources reviewed August 2026, against the primary sources linked above rather than a secondary summary. Rules in this space change — confirm the current text with the agency before a print run. This is general information, not legal advice.