An official website of the State of Maryland.

Maryland.gov Translate

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Maryland Cannabis Administration

Customer Profiles

Notice |
Updated:

Customer Profiles 

A customer profile is a record created by or on behalf of a dispensary that identifies an adult-use consumer using any combination of the consumer’s personal information (including but not limited to, full or last name, birthdate, contact information) and purchase records. A dispensary may offer an adult-use consumer the opportunity to consent to the creation of a customer profile when they make on-line or in-store purchases provided it complies with Maryland Cannabis Administration (MCA) regulations. It is the licensee’s burden to demonstrate that an adult-use consumer consented to the creation of a customer profile.  

COMAR 14.17.12.04B(10)(a) prohibits a dispensary from using an adult-use consumer’s personal information to create or maintain a customer profile without that individual’s express permission. This provision applies to data collected at the point of sale, as well as any data saved or transmitted by a dispensary’s identification card scanning system. A dispensary should inspect its identification card scanning system and disable any setting that automatically saves or transmits any personal data other than an adult-use consumer’s first name. A dispensary’s identification card scanning system may collect an adult-use consumer’s first name for the limited purpose of identifying them at the point of sale.  

COMAR 14.17.12.04B(10)(b) prohibits a dispensary from denying a sale on the basis that the customer does not consent to the storage and use of their personal information. A dispensary must provide access to a consumer who has presented a qualifying government-issued photo identification card. 

Online, Telephone, or Other Remote Orders 

COMAR 14.17.12.08C requires a dispensary’s online, telephone, or other remote ordering system to collect the name and birthdate of the individual submitting the order. The purpose of this data collection is to compare the customer’s provided name and birthdate to the corresponding data points on the individual’s government-issued identification card at pick-up. A dispensary’s ordering system may offer to save the individual’s name and birthdate to create a customer profile but may not create a record without their express permission. 

Required Signage 

To adequately inform consumers of their rights, and pursuant to COMAR 14.17.12.02C, dispensaries must post an MCA-issued notice reflecting the information below. Once distributed by MCA, the notice must be conspicuously posted at or near the point at which a dispensary agent first greets a consumer and asks for identification. The notice states: 

  • Although ID checks are required by law to ensure customers are 21+, the Maryland Cannabis Administration does not require dispensaries to retain your personal information to create or maintain a customer profile. 
  • If a dispensary offers you the option to save your personal information, you have the right to refuse without being denied service solely on that basis. 

The MCA is further advising that any customer profiles created prior to the date of this notice, without the consumer’s fully informed consent shall be destroyed, unless the licensee is able to gain informed consent for retaining the consumer’s information.