Illinois Makes You Delete the Customer Data Most Platforms Are Built to Keep

68 Ill. Adm. Code § 1291.308 is short and unusually direct. "Dispensing organizations are prohibited from obtaining, collecting, maintaining, recording, and/or storing a purchaser's personal information from the transaction itself without the purchaser's consent." Then: "Dispensaries shall ensure their internal systems delete all purchaser personal information within 24 hours after any purchase is completed." And the scope: "Personal information includes, but is not limited to, a purchaser's name, address, birthdate, and/or email address."

Read that against the standard ecommerce playbook and most of it stops working. A customer account that keeps a name and email indefinitely. Order history a shopper can browse next month. An email list assembled from checkouts. A CRM record enriched from every visit. Analytics dashboards keyed to purchase records. Each of those is a system designed to accumulate exactly what the rule tells you to purge.

The obligation is on your internal systems, which means it is an architecture question, not a policy document you file. A retention window has to be a configurable setting that a compliance lead can prove is running, with a defensible record of what is retained, what is derived, and what is destroyed.

It is unlawful for a dispensary to accept money or anything of value from a cultivator, craft grower, infuser or transporter "in exchange for preferential placement on the dispensing organization's shelves, display cases, or website." Illinois is one of very few states that names the website directly in a pay-to-play statute. No sponsored menu slots. No paid featured-brand carousel. No sold sort order. 15-70(r) separately bans exclusive-supply contracts.

We should be plain about what that means for us. Buddy sells sponsored placements and brand ad monetization to retailers in other states, and those placements are not available to Illinois dispensaries under 15-70(q). We would rather say that in writing than sell you a revenue feature that puts your license at risk.

The requirement this creates is per-state control. A platform running one storefront in Michigan and another in Illinois has to be able to disable monetized placement for the Illinois locations while leaving it on elsewhere, and keep merchandising rules editable as an operator adds states. A vendor whose monetization is baked in at the platform level cannot do that, and that is a liability rather than an upsell.

Illinois does not set an audience-composition percentage for advertising. Several states do; Illinois does not. With no audience-share threshold to satisfy, the entire compliance burden shifts onto content and placement.

On content, 410 ILCS 705/55-20(a) prohibits advertising containing a statement or illustration that is false or misleading, promotes overconsumption, depicts actual consumption, depicts a person under 21 consuming, makes health, medicinal or therapeutic claims, includes the image of a cannabis leaf or bud, or includes any image or phrase designed or likely to appeal to minors. On placement, § 55-20(b) prohibits advertising within 1,000 feet of school grounds, a playground, a recreation center, a child care center, a public park, a public library, or a game arcade not restricted to 21 and over, and bars ads on or in public transit vehicles and shelters and on publicly owned or operated property.

There is an unresolved question inside that list worth naming. Neither the CRTA nor the IDFPR rules define "advertising," so whether a dispensary's own menu falls inside § 55-20 is not settled — and that determines whether product photography showing bud runs into the leaf-and-bud image ban. It is a real ambiguity, it affects every product tile you publish, and anyone who tells you the answer with confidence is guessing. Your counsel should make the call; your platform should let you switch imagery policy site-wide when they do.

On age: Illinois has no statutory website age gate. Verification is a point-of-sale duty. That does not make skipping a gate acceptable — it means the platform rather than the statute is what stands between a minor and your menu. Product labeling separately carries mandated verbatim warnings under 410 ILCS 705/55-21, including "This product contains cannabis and is intended for use by adults 21 and over. Its use can impair cognition and may be habit forming." and "CAUTION: This product contains cannabis, and intoxication following use may be delayed 2 or more hours," alongside a ban on packaging bearing reasonable resemblance to commercially available candy.

IDFPR's Combined License List, updated January 9, 2026, shows 274 active Adult Use Dispensing Organization licenses. Date-stamp that figure if you quote it — IDFPR reissues the PDF at the same URL. License types include Early Approval for legacy medical converts, Early Approval Secondary Site, Conditional, and full Adult Use Dispensing Organization, with an ownership cap of 10 and a social equity standard requiring 51% ownership and control by qualifying individuals.

The composition has shifted. Per the 2025 Annual Cannabis Report, social-equity-owned licenses now surpass the number of legacy operators, and 93 dispensaries received operational licenses in FY2025, the most of any year. The typical Illinois buyer today is a first-location social equity operator rather than a legacy multistate chain.

That reader needs different things than an MSO does: a storefront live quickly, compliance defaults that are correct out of the box rather than assembled from an agency retainer, and no dependence on an in-house developer. Illinois retailers run on IDFPR licensing and Metrc traceability, official since July 1, 2025 after the April-to-June dispensary migration from BioTrack, so POS and inventory integration is the first thing to get right. Our guide to cannabis ecommerce software covers what to ask, and compliance covers what ships in the box.