CBD Testing: Potency, THC Limits & State Compliance 2026

Q: How often am I supposed to test my CBD products?

Every batch. Even if it's the 'same formula' from the 'same farm' you've used for three years. Hemp is an agricultural product. No two harvests are identical. Test every batch.

Subtitle: "It's 0.3% THC, trust me bro" is not a lab report.

CBD is simultaneously the most tested and least regulated supplement category in America. Think about how weird that is. Every state has its own rules. The FDA is still figuring out what it even wants to do. Amazon's CBD policy changes more often than my gym routine. And yet, you're supposed to sell a compliant, tested, legal product across all 50 states.

If you're selling CBD, you already know testing is required. But "testing" isn't one test. It's a stack of different analyses, each catching a different type of problem. Skip one, and you're gambling with your business. I'm going to walk you through what you actually need — not the upsells, not the "wellness panels" that cost extra, but the core testing that separates a legitimate CBD product from a regulatory time bomb.

Cannabinoid Profile (Potency): It's Not Just CBD

Let's start with the obvious one. A cannabinoid profile — usually run on HPLC or UPLC — tells you exactly what's in your oil, tincture, gummy, or topical.

A proper panel should quantify at minimum:

CBD and CBDA (the acid form, which is what you actually extract from hemp and then decarboxylate into active CBD)
THC and THCA — and this is the one that gets people sued. Total THC (THC + THCA × 0.877) must be at or below 0.3% by dry weight. This is federal law. Not 0.31%. Not 0.35%. 0.3%. And if your lab's measurement uncertainty overlaps the legal limit, that's your problem, not the government's.
Minor cannabinoids — CBG, CBN, CBC, CBDV. These matter for marketing ("broad spectrum!" "full spectrum!") and are increasingly required by state regulators.

Critical detail: The method matters. HPLC is the standard for potency. GC is cheaper, but it uses heat — and heat decarboxylates CBDA into CBD. So if a lab runs GC and doesn't account for that conversion, their potency numbers are inflated garbage. Ask which method they use. If they say "it depends," ask more questions.

⚠️ The THC Math That Kills Brands

Here's a nasty surprise that hits a lot of first-time CBD sellers: THCA converts to THC. The legal limit is on TOTAL THC, not just delta-9 THC. The formula is: Total THC = delta-9 THC + (THCA × 0.877). If your COA only lists delta-9 THC and shows 0.25% — but your THCA is sitting at 0.3% — your actual total THC is roughly 0.51%. That's not borderline. That's illegal at the federal level. Every single batch, check the math yourself. Don't trust someone else to do it for you.

Pesticides: The Big Scary One

Hemp is a bioaccumulator. It sucks up everything from the soil — nutrients you want, pesticides you don't. And unlike corn or soybeans, there's no federal tolerance level for pesticides on hemp because the EPA hasn't set them yet. You're in a regulatory gray zone.

What states have done is create their own lists. California's is the most aggressive — they require testing for 66+ pesticide active ingredients with action limits down to parts per billion. Oregon, Colorado, and Florida have their own lists with varying thresholds.

The baseline you should test for even if your state doesn't require it: the big four categories — organophosphates, organochlorines, pyrethroids, and carbamates. Use LC-MS/MS and GC-MS/MS. If your lab offers a "California compliance pesticide panel," that's the gold standard. Take it. The extra cost is nothing compared to a recall.

Also: pesticide contamination in CBD tends to concentrate during extraction. Raw biomass might test clean at 0.5 ppm, but after extraction and concentration, that same batch could be at 5 ppm in the final oil. Always test the finished product, not just the biomass.

Heavy Metals: Lead, Arsenic, Cadmium, Mercury

Remember that bioaccumulator thing? Heavy metals too. Hemp pulls metals from the soil. If the farm used to grow something else — say, cotton that was sprayed with arsenic-based pesticides in the 1970s — that arsenic is still in the dirt, and now it's in your CBD oil.

The standard heavy metals panel is lead (Pb), arsenic (As), cadmium (Cd), and mercury (Hg). Limits vary by state, but the strictest reference points are:

Lead: <0.5 ppm (USP), <0.5 μg/day (California Prop 65 for oral)
Arsenic: <1.5 ppm (USP)
Cadmium: <0.5 ppm (USP)
Mercury: <1.5 ppm (USP)

Method is ICP-MS. No substitutes. If a lab offers you a heavy metals panel using ICP-OES instead of ICP-MS, the detection limits won't be low enough for the trace levels you need. You'll get "not detected" results that really mean "our instrument couldn't see it" — not the same as "clean."

Residual Solvents: The Extraction Hangover

Most CBD is extracted using solvents, so residual solvent testing is essential — CO2 (clean but expensive), ethanol (common), butane or propane (cheap, sketchy), or hexane. After extraction, those solvents are supposed to be removed. They're not always fully removed.

USP Chapter <467> defines limits for residual solvents across three classes:

Class 1 (benzene, carbon tetrachloride): These should NEVER be present. Cancer-causing, neurotoxic, absolutely banned.
Class 2 (hexane, methanol, methylene chloride): Have limits, usually in ppm. Some are unavoidable in trace amounts but must be below thresholds.
Class 3 (ethanol, acetone, isopropanol): Generally regarded as less toxic, with limits around 5,000 ppm.

Testing method is headspace GC-MS. If your product was ethanol-extracted, the ethanol residual should still be negligible in the final product. If it smells like a shot of Everclear, that's not "full spectrum" — that's incomplete processing.

Terpenes: Optional but Smart

Terpenes are the aromatic compounds that give different hemp strains their distinct smells and flavors — myrcene, limonene, pinene, linalool, beta-caryophyllene. Testing for terpenes isn't required by any state regulation I'm aware of, but it's genuinely useful:

It verifies your "full spectrum" or "broad spectrum" marketing claims.
It helps you understand flavor consistency batch-to-batch.
Some terpenes have their own biological activity that supports your product's positioning.

A terpene panel costs extra. If you're on a tight budget, put your money into pesticides, metals, and solvents first. Terpenes are a nice-to-have, not a must-have.

FAQ

Q: Which states have the strictest CBD testing requirements? California, Oregon, and Colorado. California is the most demanding — over 66 pesticides, strict heavy metal limits, and mandatory mycotoxin testing. If you can pass California, you can pass anywhere.

Q: Is third-party testing required or can I use in-house results? For most states with hemp programs, testing must be done by an ISO 17025-accredited, independent third-party lab. Your own in-house numbers don't count for compliance. For selling online through your own Shopify store, technically nobody's checking — but your payment processor and your lawyer will both tell you to get third-party COAs.

Q: What's the difference between full spectrum, broad spectrum, and CBD isolate testing? Full spectrum has all cannabinoids including trace THC. Broad spectrum has everything except THC. Isolate is pure CBD (99%+). Testing is similar across all three, but broad spectrum sellers need to prove THC is actually removed (not just "below 0.3%" but ideally non-detectible), and isolate sellers need purity testing to confirm that 99%+ claim.

Q: How often am I supposed to test my CBD products? Every batch. And before you ask — yes, even if it's the "same formula" from the "same farm" you've used for three years. Hemp is an agricultural product. No two harvests are identical. Test every batch.

Q: Do I need to test CBD topicals differently than ingestibles? The core panels are the same, but the acceptable limits might differ because topicals aren't ingested. That said, CBD absorbs through skin. Most labs and regulators test topicals to the same standards as ingestibles just to be safe. Also: your topical base (lotions, balms) adds another variable. Make sure your lab knows the matrix they're testing.

The Bottom Line

CBD testing isn't one test — it's a full suite: cannabinoid potency (by HPLC), pesticides (by LC-MS/MS and GC-MS/MS), heavy metals (by ICP-MS), and residual solvents (by headspace GC-MS). Terpenes if you want to flex. Skip any of these and you're leaving a door open for problems you can't see until it's too late.

At LabQuotes, we'll match your product type with labs that specialize in hemp and CBD testing. Whatever state your product needs to comply with, we'll find you a lab that knows those rules — because there's nothing worse than getting your entire batch tested, passing, and then realizing the lab wasn't certified for your state's program.

Get CBD testing quotes →

CBD Testing: Potency, THC Limits, and the Tests That Keep Your Product Legal