Hemp Product Label Requirements: A Complete Checklist
State hemp laws differ on the details, but after reading through ten states' actual rule text, the same handful of elements show up again and again. Here's what to check for, regardless of which state you're shipping to.
The elements that show up almost everywhere
- Batch or lot number — printed on the label, and it has to match the batch number on the certificate of analysis. This is the single most consistent requirement across every state we checked — without it, a COA is just a generic document that doesn't prove anything about the specific unit in someone's hand.
- A way to access the certificate of analysis — most states now want this as a QR code, scannable barcode, or URL rather than a physical insert, though a few (Georgia, Virginia) still accept a printed copy as an alternative.
- Test date — how recent the results are. Some states (Florida, Georgia) put an explicit shelf-life on how long a COA stays valid.
- Manufacturer/distributor contact info — name, address, and often phone number of who actually made or packed the product.
- Cannabinoid profile — the percentage or milligram amount of the relevant cannabinoids, most importantly a delta-9 THC compliance statement (federal threshold: 0.3% or less by dry weight).
- Independent lab accreditation — the testing lab itself usually has to carry ISO/IEC 17025 accreditation, so the results actually mean something.
Where states actually differ
The variation is mostly in the mechanism, not the substance:
- QR code vs. plain URL — most states that require electronic access accept either a scannable code or a plain web address
- Mandatory vs. optional QR code — Georgia lets you print the full COA directly on the label instead of using a QR code at all. Virginia goes further and doesn't require a QR mechanism in the first place — a physical certificate available on-site satisfies its law
- How long the link has to keep working — Florida is explicit: 90 days past the product's expiration date. Most other states don't specify a duration, which arguably makes it a permanent obligation by default
- Extra required content behind the link — Tennessee and Louisiana want the full testing methodology disclosed, not just the pass/fail cannabinoid numbers
The part every state gets wrong by omission
Not one of the ten states we reviewed specifies what happens if the link breaks. That's a gap you have to close yourself: if a QR code stops resolving — a website redesign, an expired file host, a Google Drive link that got moved — nothing in the letter of these laws tells you whether that's a labeling violation in progress or not. The safe assumption is that it is. A batch number pointing at a dead link is functionally the same as no COA at all.
One link per batch, built not to break
Generate a permanent page + QR code for each batch — covers the "access to a COA" requirement in every state above. First 2 are free.
Create my batch page →This page is informational, not legal advice — confirm current requirements with your own state agency before finalizing packaging.