On January 1 of this year, it became legal under state law for California adults to purchase cannabis products for recreational use. But the more than 5,000 cannabis operators who are already licensed are amassing sensitive data about their customers. That’s why EFF supports a bill to stop vendors from sharing this data without customers' consent. 

Without controls on how consumers’ cannabis-related data gets passed around, lawful cannabis customers could face discrimination when seeking work, housing, or government benefits. To prevent that, EFF is supporting A.B. 2402, a proposal to prevent state-licensed cannabis sellers from selling or sharing customers’ personal information without their consent. The bill also prohibits dispensaries from discriminating against a customer who chooses to withhold that consent.

This isn’t a theoretical problem. Recent news reports have found that dispensaries are, in fact, keeping computer databases with customer profiles in them. A survey by Politifact California found that most dispensaries scan customer driver licenses, and require names and phone numbers to be filled out before purchases are made. EFF’s letter to the bill’s sponsor goes into more detail on these reports.

As the legal marijuana market in California develops, consumer privacy will be a critical area to protect. That’s doubly true as marijuana vendors turn to apps and websites to market themselves, which will give them the ability to collect data about the most minute customer choices and preferences. That information will be increasingly valuable to data brokers. Not only could such data be used for invasive marketing, it could ultimately be acquired and used by federal law enforcement.

For the tens of thousands of Californians who use medical cannabis, A.B. 2402 will ensure their medical marijuana cards are treated as confidential medical information.

Last month, A.B. 2402 was overwhelmingly approved by the California Assembly on a 61-5 vote. We hope the Senate also passes this proposal, which is an important step forward in consumer data privacy.