Yes, dispensaries report to the government, and they do it constantly. Every legal cannabis sale is logged in a state-run tracking system in near-real time, dispensaries file federal income tax returns like any other business, and cash transactions above certain thresholds trigger separate reports to the IRS and FinCEN. Your individual purchase is tied to the ID or patient card you showed at the counter, though that record generally stays inside the state system unless law enforcement compels access.
What State Regulators See
The heaviest reporting happens at the state level. Every state with a legal cannabis program requires licensed dispensaries to use an electronic seed-to-sale tracking platform that follows products from planting through harvest, processing, testing, and final retail sale. Metrc, the most widely adopted platform, operates in roughly 20 jurisdictions. Other states use competing systems that work the same way.
Each time you buy, the transaction posts to that system. The record captures the product type, weight, batch number, and the exact date and time of sale. Regulators use the data to enforce daily and monthly purchase limits, audit dispensary inventory against reported sales, flag potential diversion to the illegal market, and calculate the excise and sales taxes owed. A dispensary that lets its records fall out of sync, or loses access to the tracking system, can lose its license.
What the Dispensary Records About You
Before finishing the sale, staff scan or inspect your government-issued ID to confirm you meet the minimum age. That scan captures your name, date of birth, and ID number.
In a recreational market, the ID data is used primarily for age verification and doesn’t always flow into the state tracking system attached to your name. Medical programs work differently. Your patient registry number is linked to each purchase so the state can verify your card is valid and that you haven’t exceeded your possession limit. State health departments maintain the underlying patient registries separately, and access is generally restricted to certifying physicians and pharmacists rather than police.
Anything you volunteer for a loyalty program (phone number, email, purchase history for marketing) stays with the dispensary and isn’t reported anywhere. It could be subpoenaed in a criminal investigation, the same as loyalty data from any other retailer.
Federal Income Tax Filings and Section 280E
Dispensaries file federal returns like any other business. The form depends on entity type: Schedule C for a sole proprietor, Form 1065 for a partnership, Form 1120-S for an S corporation, Form 1120 for a C corporation.1Internal Revenue Service. Instructions for Form 1120-S, U.S. Income Tax Return for an S Corporation Revenue, expenses, and tax liability all go to the IRS, which can cross-reference the return against state-reported sales.
Cannabis retailers then get hit with something no ordinary retailer faces. Section 280E of the Internal Revenue Code bars any business trafficking in a Schedule I or II controlled substance from deducting ordinary business expenses.2Office of the Law Revision Counsel. 26 USC 280E – Expenditures in Connection With the Illegal Sale of Drugs Because marijuana is still Schedule I, a dispensary cannot deduct rent, payroll, advertising, or utilities. The only offset is cost of goods sold. Effective tax rates for cannabis operators often exceed 70 percent as a result.
Rescheduling marijuana to Schedule III would end the 280E problem, since the statute reaches only Schedule I and II substances. As of late 2025, the Department of Justice has proposed rescheduling, but the rulemaking remains pending before an administrative law judge. A December 2025 executive order directed the Attorney General to complete the process as quickly as possible.3The White House. Increasing Medical Marijuana and Cannabidiol Research Until the rule is finalized, 280E applies in full, and the IRS has warned cannabis businesses against taking deductions they aren’t entitled to.
Cash Reporting to the IRS and FinCEN
Dispensaries move a lot of cash because federal banking access remains limited. Most national banks still refuse cannabis accounts, so the operators that do secure banking typically work with smaller state-chartered banks or credit unions willing to shoulder the compliance load.
Two federal cash-reporting rules apply. Any business receiving more than $10,000 in cash from a single buyer, or through a series of related transactions, must file IRS Form 8300 within 15 days.4Internal Revenue Service. IRS Form 8300 Reference Guide The form identifies the customer and describes the transaction, and it goes to both the IRS and FinCEN. Separately, financial institutions serving dispensaries must file Currency Transaction Reports for any cash deposit or withdrawal exceeding $10,000 in a single day, and they file Suspicious Activity Reports on marijuana-related accounts under FinCEN guidance.5Financial Crimes Enforcement Network. BSA Expectations Regarding Marijuana-Related Businesses
Penalties for ignoring Form 8300 are steep. Civil penalties for intentional disregard run at least $31,520 per failure (2024 figure, adjusted annually for inflation) and can reach the full amount of the unreported cash. Willful failure to file carries criminal fines up to $25,000 and up to five years in prison. Filing a materially false Form 8300 exposes the filer to up to $100,000 in fines and three years of imprisonment.4Internal Revenue Service. IRS Form 8300 Reference Guide
When Law Enforcement Can Pull Records
State cannabis regulators already have routine, ongoing access to dispensary data through the tracking system. That access is built into the license. Law enforcement is different and generally requires formal legal process.
Police or prosecutors investigating a crime can compel a dispensary to hand over business records or customer data through a subpoena, search warrant, or court order.6HHS.gov. HIPAA Privacy Rule – A Guide for Law Enforcement A search warrant requires probable cause and judicial approval. A subpoena follows its own procedural rules.
Federal agencies have an extra tool. The DEA can issue administrative subpoenas under its authority to investigate controlled substance violations, and those do not require prior court approval.7Office of the Law Revision Counsel. 21 U.S. Code 876 – Subpenas A dispensary that receives one can challenge it in court, but the initial demand comes from the DEA alone. A Department of Justice Inspector General report confirmed the DEA has used this authority to collect bulk data in controlled substance investigations.8U.S. Department of Justice Office of the Inspector General. A Review of the Drug Enforcement Administration’s Use of Administrative Subpoenas
There is no evidence that federal agencies routinely access state cannabis tracking databases or patient registries. Current federal enforcement has focused on businesses violating state law or diverting product, not on individual consumers buying in compliant state programs.
Privacy Protections on Your Purchase Data
Medical patient registries carry stronger protections than recreational purchase data. States generally restrict registry access to the certifying physician and the patient, and law enforcement cannot browse the database without an active investigation and appropriate legal process. The National Instant Criminal Background Check System used for firearm purchases does not receive medical marijuana registration data.
Whether HIPAA applies to a dispensary depends on how deeply it handles health information. A dispensary that only checks your card against the state registry, without keeping medical records, is unlikely to qualify as a covered entity. A dispensary that maintains diagnoses or physician certifications almost certainly does.
Recreational purchase records contain less sensitive data but still include your name, what you bought, and when. Most legal-cannabis states have enacted some form of confidentiality protection for this data, though the specific rules vary. Your recreational purchase history is not publicly available, and access generally requires legal process.
Federal Consequences You Might Not Expect
The record a dispensary creates can matter well beyond the sale itself, because marijuana remains federally illegal.
Firearms are the clearest example. Federal law makes it illegal for any “unlawful user of or addicted to any controlled substance” to possess firearms or ammunition.9Office of the Law Revision Counsel. 18 U.S. Code 922 – Unlawful Acts Because marijuana is Schedule I, anyone who uses it is considered an unlawful user under federal law, regardless of state legalization. The ATF has stated that a state-issued medical marijuana card is enough for a licensed dealer to refuse a sale, and that buyers must answer “yes” to the drug-use question on ATF Form 4473.10Bureau of Alcohol, Tobacco, Firearms and Explosives. Open Letter to All Federal Firearms Licensees Regarding Medicinal Marijuana Use Answering falsely is a federal felony. The background check system does not pull registry data, but the prohibition still applies.
Federal employment and contracting create similar friction. The Drug-Free Workplace Act of 1988 requires federal contractors and grant recipients to maintain drug-free workplaces, and an employee convicted of a workplace drug violation triggers mandatory reporting to the relevant federal agency within 10 calendar days.11U.S. Department of Labor. Drug-Free Workplace Regulatory Requirements The Act does not mandate drug testing, but many federal contractors implement it voluntarily, and a positive marijuana test can cost someone a job or a security clearance.
If rescheduling to Schedule III is finalized, some of this shifts. Section 280E stops applying to cannabis businesses, and the ATF’s firearms position could change because Schedule III substances are treated differently. Until then, the current framework applies in full, and every purchase at a licensed dispensary generates records that exist within it.