Cannabis Track-and-Trace & Data Breaches: A Disaster Waiting to Happen

California law requires licensed cannabis businesses to use a “track-and-trace” system that, as its name suggests, tracks the movement of cannabis from seed through final sale.

Cannabis licensees are obligated to meticulously register nearly every data point for cannabis biomass and products (such as harvest date, sale, processing activities, and so on) into the track-and-trace database, or they can face penalties.

In turn, the database is accessible by state regulators, who can use information in the database to determine whether licensees violated rules or whether cannabis was sold into the illicit market.