Cannabis Ecommerce Built for Arizona's New Advertising Law
Arizona's cannabis advertising statute, A.R.S. § 36-2859, was replaced effective July 1, 2026 by HB2179. It is nine weeks old. Most Arizona dispensary websites were built against the previous version, which had no content rules, no audience rule and no mandatory warning. The new one has all three, and it turns the age gate from a compliance checkbox into the wall between two legally distinct websites.
Book a DemoHB2179
What changed on July 1, 2026
The old § 36-2859 was thin. The replacement adds a content rulebook, an audience-composition test and a verbatim warning, and it hands enforcement to a second agency.
Content bans under § 36-2859(C)(1) now cover names resembling food or drink brands marketed to children; toys, cartoons, animated or fictional characters — the statute names Santa Claus explicitly; images of consumption; and any medium with special attractiveness to people under 21. The mandatory warning under § 36-2859(D) reads, verbatim: "Do not use marijuana if you are under twenty-one years of age or pregnant. Keep marijuana out of reach of children." Printed warnings must occupy at least 10% of the advertising area, black font on white background.
Scope matters here, because § 36-2850(1) defines advertising as "any public communication in any medium that offers or solicits a commercial transaction involving the sale, purchase or delivery of marijuana." A public menu with prices meets that definition. Your storefront is not adjacent to the advertising statute; it is inside it.
Two agencies, one violation
The Arizona Department of Health Services (ADHS), Bureau of Marijuana Licensing, regulates the license. Advertising violations, though, are enforced by the Arizona Attorney General, and ADHS then disciplines the license separately. There are 14 days to cure after notice, license discipline through ADHS, and $20,000 per violation for non-licensees. One bad page can produce two proceedings.
§ 36-2859(C)(3)
The 73.6% rule, and why a checkbox does not satisfy it
Arizona prohibits advertising "on a website" unless at least 73.6 percent of the audience is expected to be at least twenty-one years of age. Read that carefully: it is a test about who your audience is, not about what a visitor clicks. An age checkbox in front of the menu does not answer the question the statute asks.
The number has an odd provenance worth knowing. 73.6% is the Beer Institute and Brewers Association adult-audience advertising standard, revised upward from 71.6% using 2020 Census data. Arizona lifted an alcohol-industry self-regulatory figure into binding cannabis statute.
Practically, satisfying an audience-composition expectation is an evidence exercise: who your traffic actually is, where it comes from, and what you can show if the Attorney General asks. That argues for documented analytics on your own domain rather than a menu iframe whose traffic you cannot characterize, and for search visibility built on adult-intent terms rather than on whatever a third-party widget happens to attract.
Compelled and restricted at once
Arizona's potency paradox
Arizona requires potency on the physical label under R9-18-310, and § 36-2854.01 requires a per-product QR page publishing strain and extraction data. The state compels potency disclosure on the package and in a scannable product record.
At the same time, § 36-2859(C)(1)(d) lists advertising "with the potency or tetrahydrocannabinol levels" among prohibited forms. So the same figure the state makes you print is named in the advertising prohibitions.
We are not going to tell you that is an absolute ban, because the text does not clearly say so. The subsection is structured as a prohibition on advertising to under-21s, "including advertising... with the potency." Whether it reaches all advertising or only advertising directed at minors is a genuine, litigable ambiguity in a nine-week-old statute, and no ADHS or Attorney General guidance interprets it yet. Anyone selling you certainty on this point is guessing.
The way to handle an unresolved risk is to make it a switch rather than a rebuild. THC and potency fields should be controllable per audience tier and per template, so that if guidance lands one way you suppress them from public pages in an afternoon, and if it lands the other way you turn them back on. That is a page builder and field-visibility requirement, not a legal opinion.
§ 36-2859(M)
The two-tier website Arizona law implies
This is the provision that reorganizes the whole site. Section 36-2859(M) removes from the definition of advertising any communication "targeted only to the established customer base or that is requested by a customer or potential customer pursuant to an opt-in with an age affirmation."
In other words, content behind a genuine opt-in with age affirmation is not advertising, and the advertising rules therefore do not reach it. Your site becomes two legally distinct surfaces:
| Public tier (is advertising) | Gated tier (§ M, not advertising) | |
|---|---|---|
| THC / potency figures | Prohibited or high-risk under (C)(1)(d) | Outside the definition |
| 73.6% audience test | Applies | Does not apply |
| Mandatory warning | Required | Not required as advertising |
| Consumption imagery | Prohibited | Outside the definition |
| Entry condition | None | Opt-in plus age affirmation |
The design consequence is real. The public tier is a discovery layer: store pages, brands, categories, hours, education, warning present, imagery conservative, potency handled cautiously. The gated tier is where the detailed shopping experience lives, entered through a real opt-in with age affirmation rather than a dismissible modal. The two need separate templates, separate field visibility and separate analytics — one site with a popup on top of it does not implement this.
§ 36-2859(G)
Age affirmation before the conversation starts
Advertising "involving direct, individualized communication or dialogue" requires age affirmation before the communication begins. Not after the first message, and not at the point of purchase.
That captures more of a modern storefront than operators expect: live chat and AI assistants, SMS marketing, email programs, and loyalty signup. Each of those is an individualized channel, and each needs the affirmation gate ahead of the first exchange rather than bolted on at the end.
It pairs neatly with the § M split, because the same opt-in-plus-affirmation moment that starts a compliant dialogue is also what moves content out of the advertising definition. Build it once, correctly, and it does two jobs. That gate is where personalization and loyalty should begin in Arizona.
One more, for anyone running ads through a marketplace or partner: under § 36-2859(F) a platform may host a licensee's advertising only if authorized by the licensee, and the ad must identify the licensee by name and license number.
§ 36-2854(A)(4)
Arizona has no state traceability mandate
This is genuinely unusual. Arizona requires licensees to "procure, develop, acquire and maintain" their own compliant tracking system. The state mandates neither Metrc nor BioTrack, and there is no state API to integrate with.
In most states, the traceability system is the referee: inventory truth lives there, and the website reads from it through the POS. In Arizona, the systems you choose are the record. Your POS and your commerce platform are effectively the system of record for what you had, what you showed and what you sold.
That raises the stakes on data integrity in the storefront itself. Inventory accuracy, price accuracy, audit trails on menu changes, and a defensible history of what was published when all become your responsibility rather than the state's. It also raises the cost of a menu you do not own: an embedded third-party widget is a record you cannot produce. Our guide to cannabis ecommerce software covers what to ask a vendor about data ownership, and compliance covers the controls that ship with Buddy.
Worth noting alongside it: § 36-2854(A)(1)(b) caps licenses at one marijuana establishment license for every ten pharmacies registered in the state. As of August 1, 2026, ADHS reports roughly 170 licensed adult-use retail establishments, most of which also hold a medical registration.
R9-18-312.01(B)
What delivery actually requires at checkout
Arizona delivery is permitted, and the rule dictates the shape of your checkout form more than most operators realize.
Design the form for it
An ID-number field is unusual, sensitive, and abandonment-prone if it appears without explanation. Ask for it at the right step, say why the state requires it, and keep the rest of the flow short. See checkout for how required fields are configured per fulfillment type and per store.
Ordering window
The order must be received during posted business hours.
Data captured up front
The consumer must provide name, date of birth, the identifying number on the ID that will verify their age at delivery, and street address including apartment. The ID number is collected at order time, not at the door.
Agent documentation
A facility agent documents the order, including the agent's own name.
Signature at handoff
The recipient's hand-written signature on the order is required. No fully contactless flow exists in Arizona.
Arizona retailers on Buddy
More than 300 cannabis retail websites run on Buddy, rated 4.9 out of 5, with a typical storefront live in about 24 hours once the POS connection is in place. We are not publishing an Arizona-specific store count or client names until those numbers and permissions are confirmed.
More on how this works: Buddy for retailers, cannabis ecommerce software, compliance, cannabis SEO and the page builder.
FAQ
Arizona questions, answered.
What changed in Arizona cannabis advertising law on July 1, 2026?
HB2179 replaced A.R.S. § 36-2859. The previous version had no content rules, no audience rule and no mandatory warning. The new statute adds content prohibitions under § 36-2859(C)(1), a 73.6% adult-audience test for website advertising, and a verbatim warning under § 36-2859(D). Advertising violations are enforced by the Arizona Attorney General, with separate license discipline by ADHS.
Does an age checkbox satisfy Arizona's 73.6% rule?
No. Section 36-2859(C)(3) prohibits advertising on a website unless at least 73.6 percent of the audience is expected to be at least twenty-one years of age. That is an audience-composition test, not a click-through gate, so satisfying it is a matter of who your traffic is and what you can evidence. The 73.6% figure comes from the Beer Institute and Brewers Association adult-audience standard, revised from 71.6% using 2020 Census data.
Can an Arizona dispensary show THC percentages on its menu?
This is unresolved and we will not claim otherwise. Section 36-2859(C)(1)(d) lists advertising with the potency or THC levels among prohibited forms, but the subsection is framed as a prohibition on advertising to under-21s, and no ADHS or Attorney General guidance interprets the scope. Meanwhile R9-18-310 requires potency on the label and § 36-2854.01 requires a per-product QR page with strain and extraction data. Treat potency visibility as a configurable field and take your counsel's reading.
What is the § 36-2859(M) exemption and how does it change a website?
Section 36-2859(M) removes from the definition of advertising any communication targeted only to the established customer base, or requested by a customer or potential customer pursuant to an opt-in with an age affirmation. Content behind a genuine opt-in with age affirmation therefore sits outside the advertising rules, including the 73.6% test and the mandatory warning. In practice that implies two tiers: a conservative public discovery layer and a gated shopping experience.
Does Arizona require age verification before live chat or SMS?
Yes. Section 36-2859(G) requires age affirmation before advertising involving direct, individualized communication or dialogue begins. That covers live chat and AI assistants, SMS and email marketing, and loyalty signup, and the affirmation has to come before the first exchange rather than at purchase. Separately, § 36-2859(F) allows a platform to host a licensee's advertising only with authorization, and the ad must identify the licensee by name and license number.
Which traceability system does Arizona require?
None. A.R.S. § 36-2854(A)(4) requires licensees to procure, develop, acquire and maintain their own compliant tracking system, and Arizona mandates neither Metrc nor BioTrack. With no state API to integrate against, your POS and commerce platform are effectively the system of record, which raises the importance of inventory accuracy, audit trails and owning your own menu data.
See an Arizona storefront built for the statute as it reads today.
Bring your POS and one store's menu. We will walk the public and gated tiers, the mandatory warning placement, potency fields you can switch per tier, age affirmation ahead of chat and SMS, and a delivery checkout that captures the ID number the rule requires. This page is informational and is not legal advice; the Arizona Department of Health Services (ADHS) licenses establishments and the Arizona Attorney General enforces advertising violations, and your counsel should confirm anything you act on.
Book a Demo