What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

Cannabidiol (CBD) is a chemical derived from the Cannabis sativa L. plant and may be used in products sold to the public. CBD is a different chemical than tetrahydrocannabinol (THC), which is the primary psychoactive component of cannabis. This means that CBD, unlike THC, does not cause intoxication. CBD, as a derivative of hemp, may be sold at retail. 6 V.S.A. § 563. The sale of CBD products in Vermont is subject to sales tax as tangible personal property unless an exemption applies. 32 V.S.A. § 9771(1).

Vermont law distinguishes between “hemp” and “marijuana,” and the concentrations usually found in CBD oil place it in the hemp category. Hemp is recognized as an agricultural product that may be lawfully grown as a crop, produced, possessed, and commercially traded in the state. 6 V.S.A. § 563; see, Vermont Attorney General’s Office, “Vermonters Need Not Fear State Prosecution for Simple Possession of Hemp Oil Products” (April 15, 2015).

The distinction between hemp and marijuana under Vermont law is based on the concentration of tetrahydrocannabinol (THC) in the plant. Hemp is defined under Vermont statute as “the plant Cannabis sativa L. and any part of the plant, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.” 6 V.S.A. § 562(3). Marijuana, on the other hand, while also being defined under Vermont statute as all parts of the plant Cannabis sativa L., excludes hemp, and therefore always has a THC concentration above the limit imposed on hemp. 18 V.S.A. § 4201(15).

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

Yes. The Vermont Legislature passed H.764, “An act relating to data brokers and consumer protection,” without the Governor’s signature, on May 22, 2018. This law requires that a credit reporting agency, upon request and proper identification of the consumer, disclose credit scores, predictor ratings, and a list of who has requested information pertaining to the consumer in the last twelve months. Further, it requires that credit reporting agencies make disclosures to consumers regarding their rights and regularly update their information in telephone directories. 9 V.S.A. § 2480b. It also prohibits data brokers from charging a fee for a credit freeze. 9 V.S.A. § 2480b.

In addition, the new law requires that data brokers register with the Vermont Secretary of State and pay $100 as an annual fee. They must also disclose customer data collection, storage, and selling practices. The law requires data brokers to have a clear privacy policy explaining their data security system and the technical, physical, and administrative protections for consumer data. There are also additional requirements about collecting, storing, and sharing information about minors. 9 V.S.A. § 2480b. Much of the language in the new law mirrors that of GDPR.