Illinois Dispensary Rules 2026: Stock, Sales, Compliance

Illinois dispensary rules are enforced day to day by the Illinois Department of Financial and Professional Regulation (IDFPR), which licenses and inspects every adult-use and medical dispensing organization. The Department of Agriculture regulates the growers, infusers and transporters who supply you, and the Cannabis Regulation Oversight Office (CROO) runs the state’s seed-to-sale system.

The core idea is a closed, tracked supply chain. Every gram you sell must come from an Illinois-licensed source, arrive on a manifest, carry a Metrc tag, sit in a counted and recorded inventory, and leave only after an ID check and a recorded sale. Adult-use home delivery is still not allowed, but Senate Bill 3222 (Public Act 104-0463) opened the door to drive-through and curbside pickup in June 2026.

This guide is for owners, managers and compliance staff. If you are still applying, start with how to get a cannabis license in Illinois. This guide is general information, not legal advice. Confirm current rules with IDFPR.

Key takeaways

Buy only from Illinois-licensed cultivators, craft growers, infusers or other dispensaries, and never let one supplier dominate your shelves.
Metrc replaced BioTrack as the state system, and your point-of-sale, Metrc and the physical count must match every day.
Home delivery is off the table for adult-use sales, while drive-through and curbside pickup need IDFPR approval first.
The 2026 cannabis law changed store hours, security staffing, camera retention and badging, and IDFPR rules have not all caught up yet.
Rules differ by state and province. Always confirm with your own regulator before changing how you operate.

Who enforces the rules for Illinois dispensaries?

Three state bodies share the work:

IDFPR licenses dispensing organizations, badges agents, approves floor plans and procedures, inspects stores and disciplines licensees. Its rulebook is 68 Ill. Adm. Code 1291 for adult-use dispensaries, with Part 1290 for the older medical rules.
The Illinois Department of Agriculture (IDOA) licenses cultivation centers, craft growers, infusers and transporters, and sets product labeling rules in 8 Ill. Adm. Code 1300.
CROO coordinates the statewide seed-to-sale system and publishes annual oversight reports.

The governing statute is the Cannabis Regulation and Tax Act (410 ILCS 705), mainly Article 15 for dispensaries and Article 55 for advertising and packaging. Medical sales also follow 410 ILCS 130.

Towns set zoning and can approve later hours, lounges and local cannabis taxes.

Buying inventory: who you can buy from

Under Section 15-70, a dispensary may obtain cannabis, infused products and seeds only from Illinois-licensed cultivation centers, craft growers, infusers or other dispensaries. Out-of-state product is banned, and you cannot grow or manufacture anything yourself.

No exclusive deals: you may not sign an exclusive supply agreement, and you must deal with suppliers and transporters on equal terms when they can deliver properly.
Supplier concentration cap: no single cultivation center, craft grower, processor, transporter or infuser group may make up more than a set share of your sellable inventory, measured as a monthly average. Companies that share a principal officer count as one. The cap is in the table below.
No pay-to-play shelving: you may not take money, gifts or credit from suppliers for better shelf, display or website placement.
Pre-packaged only: product must arrive packaged and labeled under the Act.

Manifests, receiving and testing

Product moves between licensees through IDOA-licensed transporters or the supplier’s own agents, on a Metrc manifest. Deliveries must be accepted in a restricted access area unless IDFPR approves otherwise. Before anything goes on the shelf, an agent must inspect and count it and confirm that the product name, strain, weight, ID number and quantity on the manifest match the label and the package, and that Metrc matches too (68 Ill. Adm. Code 1291.310(d)).

Testing happens upstream. IDOA requires suppliers to test each batch at an independent lab, and the label must show the lab, the final test date and pass or fail results. Since Metrc went live, labs report results directly in the system. Reject product with missing or failed results. See how to read lab results.

Returns, recalls and destruction

A return policy needs IDFPR’s prior approval, and Rule 1291.320 limits returns to damaged, inadequate or wrongly dispensed product. Anything with a broken seal or that left the premises can’t be resold and must be destroyed under Section 15-90 of the Act. Expired product found during counts must be quarantined and destroyed, with the reason, method, date and time recorded. The state can order recalls, and under the new hemp law agencies can also issue stop-sale orders and embargoes.

How product moves through an Illinois dispensary

Every package follows this path from supplier to recorded sale.

Flow of cannabis through an Illinois dispensary: licensed Illinois supplier, Metrc manifest and licensed transporter, receiving in the restricted access area with manifest and label checks, vault storage with counts and reconciliation, and sale with ID scan, limit check and recorded transaction — How product moves through an Illinois dispensary, from supplier to sale. Sources: 410 ILCS 705/15-70 and 15-75; 68 Ill. Adm. Code 1291.310.

Seed-to-sale tracking: Metrc in Illinois

Illinois signed with Metrc in February 2025, and it became the official inventory tracking system on July 1, 2025, replacing BioTrack. Packages carry Metrc RFID tags, which the state pays for within set limits.

What you must log under Section 15-75 and Rule 1291.310:

Every sale at the time of sale.
Daily beginning inventory, acquisitions, sales, disposals and ending inventory.
Each acquisition: product, quantity, strain, batch number, supplier and transporter IDs, receiving agent and date.
Each disposal: product, quantity, batch, reason, method, date and time.

Your point-of-sale must be real-time, web-based, connected to Metrc and open to IDFPR around the clock. The agent-in-charge (AIC) must physically count all non-bulk inventory every day, reconcile Metrc, the POS and the shelf, and certify the review on IDFPR’s form. You may not operate while cameras, the POS or the state system is down. Watch for joint IDFPR and IDOA guidance on Metrc updates for SB 3222. Our explainer on seed-to-sale tracking covers the basics.

Selling to customers

ID checks: verify ID before anyone enters the limited access area. Scan government-issued IDs with an electronic reader where possible, and don’t accept expired IDs. Passports and consular IDs count (Rule 1291.301). Don’t record extra personal information without the buyer’s consent.
Sale limits: limits are tied to possession limits, and residents and nonresidents have different caps, so your POS must know which ID type was scanned.
Medical counters: since September 10, 2026, adult-use stores can opt in to a medical license, which cannot be separated from the adult-use license. Verify patient registrations online and sell within each patient’s allotment at the medical tax rate.
Pricing: no bundling cannabis items with each other or with other goods for one price, and itemize every cannabis product on the receipt.
Discounts and loyalty: the statute and rules don’t set a discount cap, but IDFPR has disciplined staff for unapproved deep discounts. Put your discount policy in writing and ask IDFPR before launching anything unusual. See dispensary loyalty program ideas.
Samples and gifts: giving away cannabis to promote sales is banned under Section 55-20(d).
Exit packaging: every product leaves in a sealed, odor-proof, child-resistant container.
No vending machines, and oldest stock goes out first.

Drive-through and curbside pickup

SB 3222 lifted the drive-through ban. Before you start, send IDFPR an updated floor plan, security plan and standard operating procedures and wait for approval. ID checks, limits and Metrc recording apply at the window just as they do inside.

Delivery rules in Illinois

Adult-use delivery is not allowed. Section 15-70 bars dispensaries from transporting cannabis to homes or other places where buyers may be, and from arranging for anyone who is not an agent to deliver to buyers. SB 3222 did not change this, according to IDFPR’s fact sheet. Bills to license delivery (SB 1966, HB 2926 and HB 3074, all filed in 2025) have not passed. Medical delivery is also not set in the rules; ask IDFPR before offering it.

So driver permits, vehicle lockboxes and cash caps don’t apply to Illinois dispensaries. Our guide on starting a delivery business covers states where it is legal.

Operating rules at a glance

Rule	Requirement	Where it comes from
Store hours	6 a.m. to 10 p.m.; until 2 a.m. with local approval and notice to IDFPR	410 ILCS 705/15-70(j), as amended June 12, 2026
Per-customer limit, Illinois residents	60 g flower, 10 g concentrate, 1,000 mg THC in infused products	410 ILCS 705/10-10(a)
Per-customer limit, nonresidents	30 g flower, 5 g concentrate, 500 mg THC in infused products	410 ILCS 705/10-10(b)
Medical patient allotment	2.5 oz in 14 days unless a waiver applies	410 ILCS 130/10 and 130/55
Staff on site	At least 2 people whenever open, plus security on duty during all hours	410 ILCS 705/15-70
Minimum age of staff	21	410 ILCS 705/1-10
Single-supplier share	No more than 40% of sellable inventory	410 ILCS 705/15-70(p)(5); Rule 1291.70
Camera footage retention	60 days (was 90 before June 12, 2026)	410 ILCS 705/15-100(i)(4)
General records	5 years, locked on site	410 ILCS 705/15-75(e)
Inventory adjustment records	2 years, with IDFPR approval before adjusting	Rule 1291.310(e)(1)
Inventory counts	Daily physical count; bulk stock opened and counted monthly	Rule 1291.310(e)
Unexplained shortage	Notify IDFPR if cause not found within 2 calendar days; finish review in 10 business days	Rule 1291.310(e)(2)
Theft or suspected crime	Written notice to IDFPR and State Police within 24 hours	Rule 1291.310(e)(3)
Customer returns	Entered in the state system within 5 calendar days	Rule 1291.320
Responsible vendor training	Within 90 days of hire, plus 8 hours of annual training	410 ILCS 705/15-40; IDFPR agent FAQ
Agent terminations	Report within 5 business days	410 ILCS 705/15-40(h)

Note that Rule 1291.300 still says 90 days of footage. The statute now controls, and IDFPR says formal rulemaking is coming.

Packaging and labeling

Suppliers package and label, but you are responsible for what you sell. Section 55-21 requires:

A sealed, odor-proof, child-resistant container meeting federal poison prevention standards.
Edibles and drinks capped at 100 mg of THC per package, scored or wrapped into servings of no more than 10 mg, with total THC and CBD stated.
Labels with the producer, product name, serial number, harvest and use-by dates, weight, lab results and cannabinoid ranges.
State warnings, including the delayed-onset warning on edibles and “DO NOT EAT” on topicals.

IDOA’s labeling rule (8 Ill. Adm. Code 1300.930) bans packaging that shows cannabis leaves, people under 21 or cartoons, or that resembles candy. As of our check, neither the statute nor IDOA’s rule requires a universal THC symbol; ask IDOA if a supplier’s labels look off. Since June 12, 2026, your dispensary name no longer has to appear on products. Since September 10, 2026, products sold to medical patients need a federally mandated warning label applied before sale (Section 55-22). See packaging and labeling requirements.

Advertising and marketing rules

Section 55-20 applies to any cannabis business and to anyone advertising for one. Ads may not:

Be false or misleading, promote overconsumption or depict actual use.
Show anyone under 21 using cannabis.
Make health claims of any kind.
Show a cannabis leaf or bud.
Use cartoons, toys, animals, children or other images likely to appeal to minors.

Placement is limited too. No cannabis ads within 1,000 feet of school grounds, playgrounds, recreation centers, child care centers, public parks, public libraries or arcades open to minors, and none on public transit or public property. Giveaways, consumption games and promotional materials that appeal to children are banned. The statute sets no audience-percentage test for digital ads, so target 21+ audiences and ask IDFPR if a platform can’t guarantee that. Educational messages are exempt. Read dispensary marketing and local SEO for compliant ways to grow.

Security, staff and records

Rule 1291.300 sets the physical security standard:

Facial-recognition-quality cameras at every exterior door and every POS terminal, recording around the clock with date and time stamps, viewable by IDFPR and State Police.
Perimeter alarms, alerts to designated agents when surveillance fails, equipment tested at least monthly, and backup power for doors and video.
A reinforced vault for all cannabis and cash after hours, with an electronic log of everyone who enters.
Any security outage reported immediately, with a written report within 5 calendar days.

Since SB 3222, you may hire your own security guards instead of a contract firm, but they must be badged agents with access to all areas and present whenever you are open. Agents need a valid badge before working, and badges can now be shown electronically and move with the agent between dispensaries. See dispensary security requirements and budtender training requirements.

Taxes your dispensary collects

You collect and remit several taxes to IDOR. Rates are covered in our consumer guide; here is the filing side.

Cannabis Purchaser Excise Tax: imposed on the buyer, reported by you on Form CD-1, with CD-3 for multiple sites. The tier depends on product type and adjusted THC (delta-9 THC plus 0.877 times THCA).
Retailers’ Occupation Tax: report on Form ST-1, deducting cannabis receipts on Schedule A, with CD-2 for multiple sites.
Local cannabis taxes: reported on the CD-1; check IDOR’s Tax Rate Database for your address.
Medical exemption: since September 10, 2026, qualifying patient purchases at a medical-licensed dispensary are exempt from the excise tax and local cannabis taxes.

Returns are due by the 20th of the following month and must be filed electronically. Larger filers make quarter-monthly payments on the 7th, 15th, 22nd and last day of the month.

Inspections and penalties for dispensaries

Grounds for discipline under Section 15-145 include audit discrepancies, accepting product from an unauthorized source, failing to prevent diversion or theft, letting unbadged staff work, missing training deadlines, short or unqualified staffing, ignoring a written IDFPR request for 30 days, and breaking your own submitted procedures.

Penalties run from reprimand to revocation. Rule 1291.70 caps fines at $20,000 per violation, payable within 60 days, and IDFPR may accept a corrective action plan when you cooperate and self-report. IDFPR’s June 2026 enforcement report shows how agent conduct is policed: one agent’s license went to refuse-to-renew status for stealing vape cartridges, and another’s for buying medical products at an unapproved discount and passing them to a non-patient.

Illinois compliance at a glance

755Dispensary inspections by IDFPR in fiscal year 2026, up from 625 the year before (IDFPR, October 2026)

16IDFPR cannabis inspectors in fiscal year 2026, up from 11 (IDFPR, October 2026)

0Mandatory cannabis product recalls in fiscal year 2026 (IDFPR, October 2026)

29New operational dispensary licenses issued in fiscal year 2026 (IDFPR, October 2026)

Your Illinois dispensary compliance checklist

Daily: scan every ID, check resident or nonresident limits at the POS, count and reconcile inventory against Metrc and the POS, quarantine expired product, and confirm cameras and alarms work.
Weekly: review discrepancy logs, returns and destruction records, and the single-supplier share.
Monthly: open and count bulk inventory, test security equipment, and file IDOR returns by the 20th.
Annually: submit your policies and procedures to IDFPR, file the CPA-reviewed compilation report within 60 days after year end, complete the required annual training and responsible vendor refreshers, and renew badges on time.
Every two years: renew the adult-use license, which expires March 31 of even-numbered years.

See our dispensary compliance checklist and seed-to-sale tracking guide.

Get found on WhereLeaf

Shoppers compare hours, pickup options and medical service before they drive, and a WhereLeaf listing shows them yours. Add your dispensary for free, or see our featured listing packages. For the consumer side, read our Illinois cannabis laws guide, and browse all cannabis license guides.

Frequently asked questions

Can a dispensary buy from another dispensary in Illinois?

Yes. The Act lists other Illinois dispensaries as an allowed source, alongside cultivation centers, craft growers and infusers. The transfer still needs a manifest, Metrc recording and receiving checks.

Can Illinois dispensaries deliver to medical patients?

No delivery route is set in the current rules. Bills to allow patient delivery were filed in 2025 but did not pass, so ask IDFPR before offering any off-site handoff.

Do we still need a third-party security company?

No. Since June 2026 you may employ guards directly, but review the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004 and badge them as agents.

What happens to hemp THC products in our store after the hemp law changes?

Hemp products above the new per-container THC limit become cannabis under the Act, so they can only be sold through licensed dispensaries and are expected to follow the same sourcing and tracking rules as other cannabis. Ask IDFPR and IDOA about any hemp products already on hand.

Can we change our floor plan or hours without asking?

Generally no. Section 1291.200 sets IDFPR’s process for non-cosmetic changes to operations, and drive-through or curbside setups need approval first. Later hours need your town’s approval plus an email to IDFPR’s enforcement inbox with proof.

Sources

Last updated: November 2026. Rules change; always confirm current requirements with IDFPR.