Nearly every channel a normal ecommerce brand relies on is either closed to you or conditional. Google Ads has allowed a narrow set of topical, FDA-cleared hemp products in certain US states through LegitScript certification, and ingestibles remain broadly prohibited. Meta has taken a similar shape, permitting some topical hemp advertising while ingestible CBD stays out.
Payment processors reserve the right to drop you, and several of the large email platforms name CBD in their prohibited use policies, which means a brand can lose its list and its store at the same time through no fault of its own. Channels you own outrank channels you rent, by a wider margin here than in any other industry worked in.
Organic search, an email list on a provider that has agreed in writing to take you, and a first-party data setup that survives a platform ban are not the cautious option in this market. They are the only option that compounds. And because policy moves, anything written about it, including this page, needs checking against the current policy text before you spend money against it.