Virginia's Hemp COA Rule: The QR Is Not Required, But a Printed URL Is Not Enough

This one is worth getting exactly right, because plenty of summaries say "Virginia requires a QR code" and the statute says no such thing. What Virginia requires is that a certificate of analysis accompany the product. State guidance then names the two acceptable ways to do that — and names printing a bare website address as one of the ways that does not count.

What is law and what is guidance. The requirement below is statutory. The "two acceptable ways" framing is from a VDACS guidance document, not from the Code of Virginia. We have kept those separate on this page on purpose, because the difference matters if anyone ever asks you to justify a labelling decision.

What the statute actually says

Va. Code § 3.2-4123 (Product packaging, labeling, and testing) sets three conditions before a regulated hemp product may be offered for retail sale. In summary: subsection (A)(1) requires child-resistant packaging for any product containing THC; (A)(2) requires a label, in English and in a font no smaller than 1/16 of an inch, listing all ingredients, the amount of substance in a single serving, the total percentage and milligrams of all tetrahydrocannabinols, and an age-restriction statement; and (A)(3) requires the product be:

"accompanied by a certificate of analysis, produced by an independent laboratory that is accredited pursuant to standard ISO/IEC 17025 by a third-party accrediting body"

…stating the total tetrahydrocannabinol concentration of the substance or the batch from which it originates. Subsections (B) and (C) then prohibit products shaped like humans, animals, vehicles or fruit, and products bearing another manufacturer's marks.

The words "QR", "barcode" and "scannable" do not appear anywhere in the section.

Source: Va. Code § 3.2-4123, Virginia Law Portal.

Where the QR guidance comes from

The Office of Hemp Enforcement at VDACS published Guidance for Inhalable Hemp Products in October 2025. Its wording on this point is unusually direct, so here it is verbatim:

"The use of a QR code is not specifically required. What is required in law is that a COA, representative of the product batch, must accompany each product sold to consumers. Two acceptable ways to meet this requirement: 1) QR Code that takes the consumer to the COA in a reasonably convenient manner; 2) Hard Copy that is included with each packaged product sold. The following methods do not meet the requirement: Merely having the COA available for review at the retail location or printing only a website address on the label for the consumer to manually search for the COA."

The same document also states that a batch code must be on the product label to match it to the certificate required by § 3.2-4123(A)(3).

Source: VDACS Office of Hemp Enforcement, "Guidance for Inhalable Hemp Products," October 2025 (PDF).

The line that surprises people: printing only a website address does not meet the requirement. A URL on a label feels like it should count — it is right there, anyone can type it. The guidance treats it as making the consumer do the searching, which is the thing it is trying to prevent. A QR that lands them on the certificate does count.

Two honest caveats

Scope. That guidance document is titled, and written for, inhalable hemp products. The statutory duty in § 3.2-4123(A)(3) is written for regulated hemp products generally. Whether the same two-methods reading is being applied identically to edibles and other categories is not something we can establish from the document itself — so if you make edibles, ask before you rely on it.
This is mid-handover. Following the 2026 General Assembly session, responsibility for regulated hemp products moves from VDACS to the Virginia Cannabis Control Authority in August 2026, and beginning August 15, 2026 a product with more than two milligrams of total THC per package cannot be produced or sold as a hemp product in Virginia. Section 3.2-4123 itself carries a repeal date of July 1, 2027. Existing hemp product retail facility registrations remain valid until they expire. Guidance issued by the outgoing agency should therefore be treated as a strong indication of the current reading, not as a permanent one.

Sources: Virginia Cannabis Control Authority — Virginia's New Marijuana and Hemp Laws · VDACS press release, July 2026.

The practical trade between the two methods

Of the two accepted routes, the hard copy is the expensive one. A printed certificate in every package means a new insert for every batch, a reprint whenever a lab re-issues a report, and paper that goes stale the moment anything is corrected. The QR route costs nothing per unit, which is why most brands choose it — but it moves the risk onto whether the link still resolves. Drive links get tidied, media libraries get reorganized, sites get redesigned, and the labels are already in the field.

The batch-code requirement points the same way: the printed batch code and the certificate the scan reaches are meant to name the same batch, which is easier to keep true when one page owns both.

A permanent, batch-specific link the scan can rely on

BatchLink gives each batch a permanent URL plus a printable QR code that opens the certificate directly, with the batch number and lab shown on the page. Swap the certificate later without reprinting. Free for your first two batches, no card.

Create a free batch page

Virginia's Hemp COA Rule: The QR Is Not Required, But a Printed URL Is Not Enough

What the statute actually says

Where the QR guidance comes from

Two honest caveats

The practical trade between the two methods

A permanent, batch-specific link the scan can rely on

Related reading