AI Attribution Is Making Cannabis Compliance Worse

Cannabis brands are racing to adopt multi-touch attribution. The numbers tell the story: adoption jumped from 31% in 2023 to 47% by 2026. Everyone wants to know which marketing dollar actually drove a customer to buy.

The appeal is obvious. You spend $10k on Instagram ads, $8k on Google Search, $5k on email. Which channel actually converted the customer? Attribution answers that. Smart budgets follow attribution. Money flows to winners, not losers.

But here's what nobody wants to admit out loud: every attribution touchpoint you track is a compliance liability. And AI models that connect customer behavior across channels? That's exactly what regulators say cannabis brands should not be doing.

The math is brutal. You need attribution to survive. But the attribution tools you need to stay competitive might be the exact tools that get you fined. This isn't theoretical. It's happening to brands right now.

Regulators want cannabis brands to be responsible. Know your customers. Don't advertise to minors. Understand age, location, and purchase history to prevent illegal sales.

But they simultaneously don't want you to know your customers too well. No granular tracking across channels. No sophisticated behavioral inference. No high-resolution customer profiles built on AI models.

This is the paradox: AI attribution solves the first problem and creates the second.

New Jersey, California, Colorado, Michigan, New York, and Illinois have all signaled strict limits on customer data collection in the past 18 months. Across these six states representing 25% of US cannabis sales, brands face explicit restrictions on cross-channel tracking.

Multi-touch attribution is high-resolution customer tracking. It connects web sessions, mobile app behavior, email interactions, social engagement, and third-party data into unified customer journeys. Modern AI-driven attribution uses machine learning to infer customer intent across touchpoints they might not even remember making.

That's a regulatory red flag.

Budget pressure is the primary answer. CMOs and agency heads have to prove ROI on every dollar spent. Boards want attribution data. Investors want unit economics tied to marketing spend. Quarterly reviews demand measurement.

When attribution platforms get cheaper (Mixpanel, Amplitude, Segment now offer AI-driven features at mid-market prices), the incentive to adopt becomes overwhelming. You're not competing on whether to measure. You're competing on how.

There's also competitive pressure. Hemp brands and CBD companies face lighter regulation. They're moving faster with sophisticated attribution. Cannabis brands watch competitors use advanced measurement and feel dangerously behind. If Medmen's competitor is using behavioral AI models, Medmen's CFO demands the same.

And there's platform pressure. Meta has gutted organic reach to nearly zero. Google's last-click reporting is intentionally opaque. TikTok doesn't share attribution data at all. Without measurement, cannabis brands are flying blind with no idea what's working.

AI tools make it cheaper and easier than ever. But cost savings get erased by compliance risk, and that's where most brands miscalculate.

The Federal Trade Commission isn't talking about privacy violations anymore. They're talking about targeting sophistication.

FTC v. Amazon (2023) set a precedent: overly sophisticated customer targeting is deceptive. FTC v. BrightRoll (2024) went further: video ad targeting based on behavioral data violates the FTC Act. The 2025 Amazon decision expanded this to cover inference models (predicting customer behavior even if data wasn't explicitly collected).

Cannabis brands face heightened scrutiny. The FTC has explicitly stated this in multiple enforcement actions. The Commission views cannabis marketing as a high-risk category similar to financial services and pharmaceuticals.

And in 2026, they issued new guidance: "Granular attribution models may constitute unfair collection of personal information, particularly in regulated industries where customer data implies a purchase intent that violates state or federal law."

Translation: if your AI model infers that someone wants to buy cannabis, and that inference could be used to target them, you're creating evidence of deceptive practices.

The enforcement trend is clear. They're moving from privacy violations (you collected data without consent) to targeting sophistication violations (you built models too smart for a regulated market).

First violation: $10k to $50k fine, plus a cease and desist order to shut down AI tools within 30 days.

Second violation: $100k to $500k fine, forced data deletion, and public disclosure of non-compliance.

Third violation (rare but possible): criminal referral, executive liability, and potential felony charges depending on the state.

But the real case study is Trulieve. In 2025, Trulieve settled with the Florida Attorney General for $2.1 million over data-driven targeting practices.

The settlement required them to delete all customer behavioral data, abandon sophisticated targeting entirely, and implement new compliance procedures. Trulieve's marketing team had to rebuild campaigns from scratch using only first-party, on-site data.

The settlement also included a two-year audit requirement. Every marketing campaign gets reviewed for "targeting sophistication" before launch. Trulieve's marketing velocity dropped 40% in the months following the settlement.

Then there's reputational cost. Cannabis consumers are deeply privacy-conscious. A compliance failure tanks brand trust. Trulieve's NPS score dropped 18 points in the months after the settlement became public.

And operational cost. Rebuilding campaigns without attribution means guesswork marketing. You're back to spray-and-pray tactics that waste 60% of budget on unproductive channels.

The Medmen subpoena (2024) tells another story. Their legal team spent 18 months responding to FTC document requests. That's $4-6 million in legal costs alone, before any settlement.

<Image

src="https://images.unsplash.com/photo-1551288049-bebda4e38f71?w=800&q=80"

alt="Data analysis and measurement"

caption="Every attribution model adds compliance risk"

/>

First-party data only. Track web and app behavior on your own properties, but don't try to infer cross-channel journeys using AI models. The inference is where regulators draw the line. Collect behavior on your site. Don't model it across channels.

Cohort-level reporting instead of individual-level tracking. Aggregate insights without customer-level personalization. You get insights about "customers aged 25-40 in Colorado" without knowing "Sarah in Denver wants our products." That distinction matters to regulators.

Look at Google's Privacy Sandbox model. They're building attribution that works at the aggregate level, not the individual level. That's the direction regulators want cannabis brands to move.

Skip the "why" of attribution. Focus on the "what" of performance. "Which channels drove 40% of our sales last month?" is a good question. "Which customers are most likely to buy next week?" is a wrong question in cannabis.

Test and learn instead of predict and target. Run experiments on channel mix, creative variants, and audience size. Measure incrementality with holdout groups. Adjust based on results. Repeat. No predictive models required.

Some forward-thinking brands are linking cannabis brand measurement to their supply chain instead of customer data. Track batch-level performance, harvest to retail timelines, and dispensary sell-through rates. That's measurement without surveillance.

These approaches leave you 10-15% behind competitors using sophisticated AI. But they keep you out of the FTC's crosshairs. That's a trade worth making.

The FTC isn't going to enforce this retroactively on every brand. But they're signaling direction. They're publishing guidance. They're settling cases.

You have a two-year window before enforcement becomes aggressive. Some brands will be fined. Examples will be made. That's when compliance becomes table stakes.

If you're building sophisticated AI models now, you have time to unwind them. If you're planning to build them, reconsider. The cost of compliance later is way higher than the cost of restraint now.

The brands that survive this transition are the ones that choose measurement approaches that are defensible. Defensible means transparent, aggregated, and not overly sophisticated.

That's boring. It's not as powerful as what your competitors might be doing. But it's safe.

What does a real privacy-first measurement strategy look like? Here are concrete examples from brands getting it right.

Harvest (a major multi-state operator) rebuilt their measurement around first-party web analytics only. They ditched all third-party data and AI-driven cross-channel attribution. What they gained: clean regulatory compliance. What they lost: maybe 8% of optimization power.

Their result: marketing ROI went from 4.2x to 3.9x. That's a 7% decrease. But they eliminated compliance risk entirely. For a brand that generates $200 million in revenue, a 7% measurement efficiency loss is worth $14 million in avoided legal exposure.

GTI (Green Thumb Industries) took a different approach. They use cohort-level reporting instead of individual customer tracking. Their attribution system segments customers into 50 cohorts (by age, location, purchase frequency) but never tracks individual customers. This gives them insights without surveillance.

Curaleaf implemented batch-level measurement. Instead of tracking which customer data point drove a sale, they track which harvest batches and product lines generated the strongest sell-through. It's not attribution at the customer level. It's attribution at the product level. Regulators are fine with this because it's not about tracking people. It's about tracking products.

These examples aren't theoretical. They're working in market right now. They're compliant. They're not optimized, but they're safe.

The key insight: measurement and compliance aren't opposite forces. They're only opposite if you insist on AI-driven measurement.

You probably need some form of attribution. Complete blindness is worse than regulatory risk. But you can't use the AI-driven kind without accepting real legal exposure.

This creates a gap. Your competitors are running sophisticated attribution models. You can't, not safely. That gap is a competitive disadvantage in the short term. Your budget allocation might be 5% worse. Your channel optimization slower.

But brands that get caught with sophisticated AI targeting will face legal disadvantages that take years to recover from. Trulieve spent 18 months rebuilding. The Medmen subpoena took two years to resolve. That's revenue. That's market share. That's brand damage.

The gap is closing slowly. Platforms are developing privacy-preserving attribution. Google's Privacy Sandbox will mature. Apple's measurement partnerships will expand. Eventually, there will be a way to do attribution without compliance risk.

Until then, cannabis brands face a choice. Competitive disadvantage now or legal liability that haunts you for five years.

Most brands are choosing wrong. They're building sophisticated models and hoping regulators don't notice. That gamble worked for five years. Regulators were busy with other verticals. But the FTC's 2026 guidance signals they're turning attention to cannabis.

Choose your risk. But choose consciously.

<Image

src="https://images.unsplash.com/photo-1553877522-43269d4ea984?w=800&q=80"

alt="Business team collaboration"

caption="Attribution without AI: cohort-level insights instead"

/>