How to advertise CBD online in 2026 without losing your ad account
What Google and Meta actually permit for CBD and hemp, which products qualify, and the channel mix that keeps working when a platform review goes against you.
You can advertise CBD online in 2026, but only narrowly on the two big ad platforms. Google allows ads for topical, hemp-derived CBD products with 0.3 percent THC or less, after LegitScript certification and Google’s own CBD certification. It limits FDA-approved pharmaceutical CBD advertisers to California, Colorado and Puerto Rico (Google Ads policy). Meta allows CBD ads only in the United States, only with LegitScript certification and Meta’s prior written authorisation, and never to people under 18 (Meta Transparency Center).
Everything outside those lines has to come from channels no ad reviewer can switch off: search content on your own site, an email list you hold, and publications that accept the category in writing. This post sets out the rules as the platforms state them on 30 September 2026, and the order we would build the rest in.
The short version
- Google allows topical, hemp-derived CBD with 0.3 percent THC or less, such as creams, sprays, roll-ons and lotions, after LegitScript certification and Google’s CBD Ads Certification form.
- Google limits FDA-approved pharmaceutical CBD advertisers to California, Colorado and Puerto Rico, and asks topical advertisers to target only approved locations.
- Meta allows CBD ads in the United States only, with LegitScript certification, prior written authorisation from Meta, no health or medical claims and no targeting of people under 18.
- Neither platform allows ads for THC or marijuana products. A CBD brand that also sells THC products needs to keep those out of every ad and landing page.
- Payment and messaging providers set their own rules. Stripe treats low-THC CBD as a restricted business, and Klaviyo lists CBD as prohibited content in SMS and MMS.
- Claims are the constant constraint. The FDA treats a product intended for a therapeutic or medical use as a drug, so copy that says a product treats or cures a condition is where the legal risk starts.
Google and Meta CBD rules side by side
| Rule | Google Ads | Meta |
|---|---|---|
| Which CBD products | Topical, hemp-derived CBD with 0.3% THC or less, and FDA-approved pharmaceutical CBD | CBD products with prior written authorisation. Meta’s July 2023 announcement described non-ingestible CBD |
| Where ads may run | Topical advertisers in a location that allows CBD promotions. FDA-approved pharmaceutical advertisers: California, Colorado and Puerto Rico only | United States only |
| Certification | LegitScript, then Google’s CBD Ads Certification form | LegitScript, plus written authorisation from Meta |
| Audience and claims | Approved locations only. Some ad formats, such as the YouTube Masthead, cannot serve CBD ads | Not to people under 18. No health or medical claims |
| THC and marijuana | Not allowed under the recreational drugs policy | Not allowed: THC products and cannabis products with psychoactive components |
What does Google allow for CBD ads in 2026?
Google’s recreational drugs policy says ads for “topical, hemp-derived cannabidiol (CBD) products with THC content of 0.3% or less are allowed”. It gives creams, sprays, roll-ons, lotions, bath bombs and candles as examples (Google Ads policy). Retailers apply for certification with LegitScript first, then submit Google’s CBD Ads Certification form.
Geography is where most confusion sits, so here is the exact wording. Google’s unapproved substances policy says FDA-approved pharmaceutical CBD advertisers must apply for certification and that their “location targeting is limited to California, Colorado, and Puerto Rico” (Google Ads policy). For non-pharmaceutical topical CBD, the same page says the advertiser must be “in a location that allows CBD promotions”, and the recreational drugs page tells advertisers to “only target approved locations”. Google does not print a list of those locations for topical retailers on either page, so confirm the approved locations for your products during the certification process, in writing.
Two things follow. Certification is only worth pursuing if your catalogue includes qualifying topical products. And a campaign serving outside the approved locations is a policy violation, not a targeting inefficiency.
What does Meta allow for CBD ads?
Meta’s advertising standard says ads for CBD “are only allowed with prior written authorization”. It says advertisers must be “actively certified with LegitScript”. It also says ads “may only promote or offer the sale of CBD in the United States, and must not be targeted to people under 18 years of age” (Meta Transparency Center). Hemp products without CBD may be advertised in Canada, Mexico and the United States. THC products are not allowed anywhere.
When Meta introduced the policy in July 2023 it described allowing “legally permissible, non-ingestible CBD in the U.S.” (Meta for Business). The current standard does not separate topical from ingestible products in its wording. If you sell ingestibles, ask Meta directly when you request authorisation, and keep the answer.
A campaign that has not been rejected yet is not the same as a compliant campaign. Treating a few weeks of delivery as proof is how an account gets disabled with a live budget attached.
Photo: SHVETS production on Pexels.
Can I advertise CBD gummies, tinctures or capsules?
Not through Google’s CBD route. Google’s allowed examples are all topical products, and ingestibles such as gummies, tinctures and capsules are not among them (Google Ads policy). On Meta, the 2023 announcement described non-ingestible CBD, so treat ingestibles as unlikely to be approved unless Meta confirms otherwise in writing.
If ingestibles are your whole catalogue, paid search and paid social are closed to you for practical purposes. The budget belongs in the channels below.
What else can be taken away besides the ad account?
Payment processing and messaging. Stripe lists “CBD products containing only negligible amounts of THC, per local limits” as a restricted business that needs extra review, and prohibits cannabis products outright (Stripe). Klaviyo lists CBD, THC and marijuana among the prohibited content for SMS and MMS messages (Klaviyo Help Center). Email rules differ from one provider to the next.
A brand can lose its ad account and its ability to message customers in the same quarter. If both happen, there is no paid traffic and no way to reach the people who bought before. So before anything else, get written confirmation from your email and payment providers that they accept your specific products, and keep a current export of your customer list somewhere you control.
Where does CBD demand come from if the ads are this narrow?
From what people type into search. They ask what full spectrum and broad spectrum mean, how many milligrams to take and whether CBD shows on a drug test. They also ask whether it is legal where they live and what a certificate of analysis should show. Those questions do not depend on any ad platform’s approval, and a page that answers one well keeps working after a policy review.
The sites we review in this category are often built as if paid traffic will always exist: a homepage, a shop, product pages listing a spectrum and a milligram figure, and a thin blog. The certificates of analysis, which are the strongest trust signal the brand owns, often sit in a PDF with no page of their own. Giving each one a page, with the lab named and the results explained, answers the trust question at the moment a buyer asks it.
What can I say about CBD without making a health claim?
Anything that describes the product rather than what it does to a condition. The FDA says that “any product intended to have a therapeutic or medical use” is a drug. It also says it has sent warning letters to companies selling CBD products that claimed to prevent, diagnose, treat or cure serious diseases (FDA). Meta separately bars health or medical claims in CBD ads.
The permitted range is wider than most brands use. You can describe sourcing, extraction, spectrum, milligrams per serving, third-party testing and what the lab found. You can publish the certificate of analysis and explain how to read it. You can answer legality and drug-testing questions carefully. The line is attaching words like treats, cures, relieves or prevents to a condition.
Photo: Thirdman on Pexels.
What a realistic plan looks like
If we were rebuilding a CBD brand’s customer acquisition from scratch, this is the order we would use.
- Secure the list. Written confirmation from an email provider that accepts your products, and an export you hold.
- Fix the claims. A pass over every product page, title tag and meta description to remove anything that reads as a disease claim. It protects the business and prevents ad rejections later.
- Build the content that ranks. Spectrum and dosage explained, state legality, drug testing, and a real page for every certificate of analysis.
- Build the reorder programme. People who find a CBD product that works tend to stop searching for it. Repeat orders are an email job.
- Then test paid, narrowly. If you have qualifying topical products, pursue certification and run inside the approved locations. If you sell ingestibles, look at publications and networks that accept the category and confirm it in writing.
How often do these rules change?
Often enough that this post carries a date. Google, for example, is running a Search-only pilot for licensed cannabis businesses in Canada from 25 August 2025 through 31 December 2026 (Google Ads policy update). The rules described here are as the platforms stated them on 30 September 2026.
Check the current policy text against your specific products before you commit budget. That applies to this post as much as anything else. Read the policy page itself, save a dated copy, and compare it with the last one before each new campaign.
The bottom line
Paid ads for CBD are a narrow, revocable channel, open to certain products in certain places. Build the parts no reviewer can take away first, your list, your claims and your search content, and treat paid campaigns as a bonus you test once those are in place.
Questions people ask about this
Can I advertise CBD gummies on Google?
Not through the standard route. Google’s CBD policy allows topical, hemp-derived CBD products with 0.3 percent THC or less, such as creams, sprays and lotions, after LegitScript certification, plus FDA-approved pharmaceuticals limited to California, Colorado and Puerto Rico. Gummies, tinctures and capsules are not on the allowed list. If ingestibles are your whole catalogue, put the budget into search content, email and publications that accept the category instead.
What does LegitScript certification involve?
It is a third-party certification that both Google and Meta require before CBD ads can run. LegitScript reviews the business and its products against its own standards, and you then apply to the ad platform separately. It is only worth starting if your catalogue includes products the platforms allow. Check the current requirements on LegitScript’s own site before applying, because the criteria move with the platforms.
What should I do if Meta disables my ad account?
Stop running anything else from the same business manager, then appeal once through the official process with a plain explanation of your products and where they were sold. Do not create a new account to get around the block. That is what gets business pages removed as well. While you wait, this is the moment your email list and organic search pay for themselves.
How do I know if my email provider accepts CBD?
Read the acceptable use policy in full and search it for hemp and CBD, including any separate rules for SMS. Then ask support in writing whether your specific products are accepted, and keep the reply. If the answer is unclear, move before you are forced to. Export the list every month regardless, so you own the contacts whatever happens.
How do I write product copy without making a health claim?
Describe what the product is, not what it does to a condition. Sourcing, extraction method, spectrum, milligrams per serving, third-party testing and how to read the certificate of analysis are all fair game. Words like treats, cures, relieves or prevents attached to any condition are the line. Read every title tag and meta description too, because those are the lines platforms and regulators see first.
Should each certificate of analysis have its own page?
We recommend it. A certificate buried in a PDF is hard for a searcher checking your product to find, and it rarely ranks. A page per batch, with the lab named, the results explained in plain words and a link to the product, answers the trust question at the moment it is asked. It also gives you a page that competitors with a PDF folder do not have.
Does search content work for a small CBD catalogue?
It can work well, because the questions people ask are about dosage, legality, drug testing and spectrum, not about your range. A brand with three products and thirty pages that answer those questions properly can outrank a brand with a hundred products and thin listings. Start with the questions your customers already email you.
Are native ad networks safe for CBD?
Safer than the big platforms, not risk-free. Networks and publications that accept the category still enforce claim rules, and a network can change its policy the same way a platform does. Get the acceptance in writing, keep the disease-claim pass applied to every ad, and never let one network become the only source of new customers.
Can I run certified ads outside the listed states?
No. Google limits FDA-approved pharmaceutical CBD advertisers to California, Colorado and Puerto Rico, and tells topical advertisers to target only approved locations. Serving outside them is a policy violation rather than a targeting mistake, and it puts the certification and the account at risk. Set location targeting to the approved locations only, exclude the rest explicitly, and check again before every new campaign.
How often should I recheck platform policy?
Before every new campaign and at least once a quarter, even if nothing has been rejected. A campaign that is still running is not proof it is compliant. Read the policy text itself rather than a summary, save a dated copy, and compare it against the last one. If something changed, review the live ads the same week.
What should I ask an agency before they run CBD ads?
Ask which products they believe qualify and under which policy line, in writing. Ask whether they have taken a brand through LegitScript before and what happened. Ask what they will do the week an account is disabled. If the answer is that competitors run ads so it must be fine, they have not read the policy, and the account at risk is yours.
Free review
Want this looked at on your own site?
Send the address. A person reads it and writes back with the two or three things that would move your enquiry number first. Free, and yours to keep whether you hire us or not.
