Missouri Requires Cannabis Dispensaries to Remember Every Transaction but Forget Who the Fuck Bought It

New Missouri privacy law threatens dispensaries with $500 fines, while operators scramble to make expensive point-of-sale systems comply with requirements nobody seems able to explain completely.

JEFFERSON CITY, MO — Missouri has once again demonstrated its unmatched ability to take something relatively simple, run it through a legislative wood chipper, and hand the resulting pile of shit to cannabis dispensaries with instructions to figure it out themselves.

This time, the issue is customer privacy.

Beginning November 12, 2026, Missouri cannabis dispensaries will be prohibited from creating or retaining records containing adult-use consumers' identifying information without their affirmative written agreement, subject to applicable exceptions.

The intention? Protect consumer privacy.

The execution? Make dispensaries spend thousands of dollars figuring out how to make their computers forget people exist.

And if they get it wrong?

$500 per occurrence.

Welcome to Missouri cannabis, where the government requires you to track everything, your software remembers everything, and now you're potentially breaking the law if you remember the wrong thing.

Congratulations! Your Expensive Technology Stack Is Now a Liability.

For anyone fortunate enough to have never operated a cannabis dispensary, allow us to explain something.

Cannabis technology is fucking terrible.

Not occasionally terrible.

Not we're working on a patch terrible.

We're talking about an entire industry operating on software that costs a fortune, regularly fails to communicate with other software, and somehow requires three different support tickets to accomplish something a gas station cash register figured out in 1998.

Dispensaries rely on point-of-sale systems to manage customer profiles, transactions, purchase limits, inventory, discounts, loyalty programs, and integrations with state compliance systems.

These platforms aren't optional conveniences. They're the backbone of daily operations.

And now Missouri operators are discovering that the technology they've been paying for may not actually support the state's new privacy requirements.

Take Dutchie, one of the cannabis industry's major point-of-sale providers.

According to a Missouri dispensary operator dealing directly with the issue, Dutchie's existing functionality has not provided the automated solution their stores need to comply with the new requirements.

Instead, the operator is being forced to piece together workarounds involving different systems and procedures to handle customer consent and information retention.

That's right.

The dispensary has to build a solution around the software it already pays someone else to provide.

It's the technological equivalent of buying a brand-new car and being told that, unfortunately, the brakes aren't compatible with Missouri roads.

But don't worry.

You can probably fix it yourself.

What the Fuck Are We Supposed to Do With the Last Five Years?

Here's where the story goes from frustrating to absolutely fucking ridiculous.

Missouri's cannabis industry didn't start collecting customer information yesterday.

Dispensaries have been operating for years.

They have customer databases.

They have loyalty programs.

They have purchase histories.

They have customer accounts created under previous operating procedures.

Some businesses have accumulated hundreds of thousands of customer records.

Consider a dispensary operator with 250,000 existing customer profiles collected over the past five years.

What happens to those records on November 12?

Seriously.

What the fuck happens?

Does the dispensary have to delete every record that doesn't have a qualifying written consent agreement?

Can it retain information collected before the new law?

Does it need to contact a quarter-million customers and ask permission to keep their information?

Can historical transaction records be separated from customer profiles?

What happens to loyalty points?

What happens to purchase histories?

What happens when a customer returns a product?

What happens when the state requires a record to be retained but the new privacy law appears to prohibit retaining identifying information?

These aren't hypothetical philosophical questions for a cannabis conference panel.

These are actual operational questions that determine whether a dispensary can legally open its doors.

And the state's guidance?

It tells operators to consider whether their historical records need to be addressed.

CONSIDER.

A quarter-million customer profiles potentially sitting in a regulatory gray area, and the state essentially says, “You guys should probably think about that.”

Thank you, Missouri.

Incredible stuff.

The law does not expressly establish a detailed procedure for handling historical customer databases, and the available guidance leaves significant questions unanswered about how existing records should be treated when the prohibition takes effect.

Which is particularly comforting when every violation potentially carries a $500 fine.

The Legislature Has Left the Building.

And here's the part that makes this whole situation even more spectacular.

The Missouri legislature isn't currently in its regular legislative session.

The law takes effect November 12.

The people who passed it are not sitting in Jefferson City conducting their regular legislative business, ready to amend the thing if someone discovers a major implementation problem.

Sure, a special legislative session is theoretically possible.

And regulators may be able to provide additional guidance within their legal authority.

But neither option is a guaranteed fix.

So the industry is approaching a statutory deadline with unanswered questions about historical data, consent procedures, and software compatibility.

Imagine building an airplane, announcing that it must fly on November 12, and then going home before checking whether anyone installed the fucking wings.

That's essentially where Missouri dispensaries find themselves.

And there's another question worth asking:

Did anyone writing this legislation actually sit down with the people responsible for implementing it?

Did lawmakers consult dispensary operators?

Did they consult point-of-sale providers?

Did anyone contact Dutchie or other major cannabis technology companies to determine whether the existing systems could accommodate the proposed requirements?

Did anyone ask how consent would be captured at the register?

Or what would happen to years of customer data?

We haven't established the extent of that consultation.

But the operational problems being reported make those questions impossible to ignore.

Because somewhere between drafting this legislation and signing it into law, somebody probably should have asked whether the technology required to run Missouri's cannabis industry could actually support the new rules.

Missouri's Newest Cannabis Job: Professional Customer Forgetter

Here's where the situation becomes particularly ridiculous.

If a customer declines permission to retain their identifying information, the dispensary needs a compliant way to process that transaction without improperly keeping their personal details.

Sounds reasonable.

Until the POS system doesn't have a practical automated way to accomplish it.

Now operators may be looking at manual processes, additional integrations, staff training, record audits, and potentially even employees whose responsibilities include cleaning up customer information.

Imagine explaining that job during an interview.

Interviewer: So, you'll be responsible for customer data management.

Applicant: Like marketing analytics?

Interviewer: No.

Applicant: Loyalty programs?

Interviewer: Not exactly.

Applicant: What would I be doing?

Interviewer: Deleting people.

Applicant: Excuse me?

Interviewer: Digitally. Mostly.

The absurdity isn't that consumer privacy matters. It absolutely does.

The absurdity is that the cannabis industry has spent years being forced into expensive, highly specialized technology systems, only to discover that operators may need to create their own patchwork solutions when the rules change.

And unlike the software company, the dispensary is the one facing the statutory fine if it gets things wrong.

The State Wants Records. The State Doesn't Want Records. Good Luck.

Missouri dispensaries already operate under extensive recordkeeping and reporting obligations.

Inventory has to be tracked.

Transactions have to be documented.

Purchase limits have to be enforced.

State reporting requirements have to be satisfied.

And certain records must be retained under other applicable laws and regulations.

Now operators must distinguish between information they are legally required to maintain and identifying customer information they cannot retain without affirmative consent.

Those are not necessarily contradictory legal requirements. A properly designed system can separate mandatory transaction records from optional customer profiles and marketing data.

The problem is that the software has to actually fucking do that.

And when it doesn't, the burden falls on the dispensary to figure out the distinction, implement the necessary processes, and hope nobody makes a mistake.

It's like being required to keep a diary of everything that happened while simultaneously being told to remove everyone's name from it.

Except the diary costs thousands of dollars a month, and the people who sold it to you aren't the ones paying the fines.

Dutchie, We Have a Problem.

Let's be clear: the experience of one operator doesn't establish that every Dutchie customer faces the same technical limitations.

But it raises a serious question for one of the cannabis industry's most prominent technology providers.

Why are dispensaries having to build workarounds for basic compliance functions in software specifically sold to one of the most heavily regulated retail industries in America?

Cannabis operators don't get to tell regulators their software isn't ready.

They don't get to explain that their vendor has a development backlog.

They don't get to submit a support ticket to the state and request that the law be temporarily disabled.

The compliance obligation remains theirs.

Which creates a rather convenient arrangement for technology providers.

When everything works, they collect subscription fees.

When something breaks, they collect subscription fees.

When a state changes its rules and operators need new functionality, they continue collecting subscription fees while dispensaries scramble to figure out what to do next.

It's a business model so beautiful that somebody should probably organize a cannabis conference panel about it.

“The Future of Cannabis Technology: Empowering Operators Through Innovative Solutions.”

Sponsored by a company whose software currently requires the operator to develop the innovative solution.

Privacy Shouldn't Require a Second Payroll.

There's nothing inherently unreasonable about giving consumers control over their personal information.

In fact, requiring businesses to obtain meaningful consent before retaining customer data is a defensible policy objective.

But privacy protection should not depend on whether an individual dispensary has enough money, technical expertise, and available labor to engineer a workaround.

A well-functioning system should allow a customer to decline data retention, process a compliant transaction, preserve records required by law, and avoid creating or retaining unnecessary identifying information.

Automatically.

Reliably.

Without requiring a store manager to perform digital surgery on a customer profile after every purchase.

And certainly without forcing dispensaries to choose between expensive operational workarounds and the risk of regulatory penalties.

If the law requires a particular outcome, regulators and technology providers should be working to make that outcome technically achievable.

Instead, operators are left trying to make systems built around customer identification behave as though customers never existed.

Another Day, Another Problem the Dispensary Has to Solve.

The cannabis industry loves talking about innovation.

Every conference has an innovation panel.

Every software company has an innovation department.

Every CEO has a LinkedIn post about leveraging innovation to unlock operational efficiencies.

Yet somehow, in 2026, a Missouri dispensary may have to pay someone to manually manage customer information because its point-of-sale system cannot adequately automate a new privacy requirement.

And this time, the problem comes with a statutory deadline, a potential $500 fine, and unresolved questions about what to do with years of customer records.

That's not innovation.

That's paying extra money to make expensive technology do its fucking job.

Missouri's new rules may ultimately provide consumers with meaningful privacy protections.

But until the systems used by dispensaries can reliably accommodate those protections, operators are left holding the bill, absorbing the labor, managing the risk, and explaining to customers why buying a pre-roll has somehow become an exercise in information technology.

And when the next regulatory change comes along?

Don't worry.

There will undoubtedly be another software update.

Another integration.

Another support ticket.

Another compliance consultant.

Another invoice.

And somewhere, in a beautifully furnished executive office, a cannabis technology CEO will publish a LinkedIn post about how proud they are to be “empowering operators to navigate an evolving regulatory landscape.”

Meanwhile, back at the dispensary, somebody is getting paid to delete a guy named Steve.

And potentially thousands of other people.

Because Steve bought an eighth five years ago, and Missouri still hasn't clearly explained what the computer is supposed to remember about him.