1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

California prohibits the use CBD oil and CBD products in food, dietary supplements, cosmetics and other products sold to the public, but legislation is currently making its way through the State legislature which is expected to pass that would make it legal to sell products containing CBD oil.

The Sherman Food, Drug & Cosmetic Law, California Health & Safety Code § 109875 et seq., prohibits the manufacture, sale, delivery, holding, or offer for sale of adulterated foods, beverages, or cosmetics, including products containing industrial hemp or cannabinoids, extracts, or derivatives from industrial hemp.

California Assembly Bill 228 (AB-228), introduced January 17, 2019, if passed would change existing law to state that “a food, beverage, or cosmetic is not adulterated by the inclusion of industrial hemp or cannabinoids, extracts, or derivatives from industrial hemp, and would prohibit restrictions on the sale of food, beverages, or cosmetics that include industrial hemp or cannabinoids, extracts, or derivatives from industrial hemp based solely on the inclusion of industrial hemp or cannabinoids, extracts, or derivatives from industrial hemp.” AB-228 passed the State Assembly 77-0 and, as of June 26, 2019, is making its way through the State Senate where it is expected to be passed and signed in to law by the governor. Assembly Bill 228 (Cal., Legis. Digest, 2019) “Food, Beverage, and Cosmetic Adulterants: Industrial Hemp Products.”

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

The California Consumer Privacy Act (CCPA) becomes effective January 1, 2020 and applies to any company which does business in California and either: 1) has annual gross revenue in excess of $25,000,000; 2) possesses the personal information of 50,000 or more consumers, households, or devices; or 3) earns more than half its annual revenue from selling consumers’ personal information.
The CCPA empowers California residents to: 1) know what categories of personal information a business collects about them and if that information is shared with other entities; 2) submit “verifiable consumer requests” to a business to have it provide more information as well as produce to them the specific pieces of personal information the business has collected; 3) demand that the business delete the personal information it holds about them; and 4) demand that a business not “sell” their personal information to third parties.

The CCPA requires that: 1) companies update privacy policies with a description of California residents’ rights (California Civil Code § 1798.135(a)(2)); 2) provide a “Right to Say No to Sale of Personal Information” (Civil Code § 1798.102); 3) preclude requesting opt-in consent for twelve months after a California resident opts out (Civil Code § 1798.135(a)(5)), and; 4) designate methods for submitting data access privacy requests, including a toll-free telephone number (Civil Code § 1798,130(a)).