On August 17, 2026, the Attorney General announced a final rule that does something the federal government has not done in more than thirty years: actually process applications to restore firearm rights.

The mechanism has existed since 1968. Title 18 U.S.C. § 925(c) lets a person barred from possessing firearms petition for relief. Congress defunded ATF’s ability to act on those petitions in 1992 and renewed that appropriations rider every year since, leaving the statute technically alive and practically dead. The new rule routes the function to the Office of the Pardon Attorney, which sits outside the appropriations restriction, and stands up a formal application process — five- or ten-year waiting periods depending on the underlying conviction, tiered presumptive disqualifiers, and a burden on the applicant to show they pose no danger to public safety.

For the cannabis industry, one paragraph matters more than the rest. The rule defines “controlled substance” for restoration purposes by reference to existing federal regulations and expressly excludes marijuana. A person whose unlawful drug use or addiction consists only of cannabis no longer faces a presumption against restoration on that basis.

That is a genuine, substantive improvement, and it deserves to be described as one. It is also, from a records perspective, the beginning of a different problem.

What the Carve-Out Does and Does Not Do

Read narrowly, because the narrow reading is the correct one.

The carve-out governs the restoration process. It changes how the Pardon Attorney weighs a history of cannabis use when deciding whether to give someone their rights back. It does not amend the underlying federal prohibition.

18 U.S.C. § 922(g)(3) still bars firearm possession by any person who is “an unlawful user of or addicted to any controlled substance,” and marijuana remains a controlled substance for that purpose regardless of state law. ATF Form 4473 still asks the buyer whether they are an unlawful user of marijuana, and still notes that state authorization does not change the federal answer. Answering that question falsely is a federal felony; answering it honestly is a denial.

So the position of a state-legal medical patient in August 2026 is unchanged at the point of sale, and improved at the point of asking for relief. Those are different doors. Anyone reading the headline as “cannabis patients can buy guns now” has misread it, and operators who repeat that framing to customers are creating liability for people who trust them.

The rescheduling proceeding is the thing that would move § 922(g)(3), and it has not concluded.

The Part That Belongs on This Site

Every relief mechanism is also a collection mechanism.

To apply under the new process, a person submits a file to the Department of Justice. That file establishes identity, criminal history, and — because the rule turns on whether unlawful drug use was “only” marijuana — the applicant’s own account of their substance use. The carve-out is favorable, but you cannot invoke it silently. Claiming it means telling a federal law enforcement agency, in writing, that you used cannabis.

That produces a durable federal record, held by DOJ, tied to a named individual, describing conduct that is still a federal offense and still a firearms disqualifier under a separate subsection of the same statute.

We do not yet know the retention schedule for these files, which components may query them, whether denials are retained differently from grants, or how the records interact with NICS. Those are exactly the questions that determine whether this is a privacy problem or merely a privacy curiosity, and the rule’s announcement did not answer them. Applicants and their counsel should be asking.

Where State Cannabis Data Enters the Picture

Here is the connection operators keep missing.

A restoration decision requires the adjudicator to assess drug use. Criminal history databases capture convictions. They do not capture lawful state-program participation — a medical cannabis registry entry is not a conviction and does not appear in NICS.

But state registries exist, they identify patients by name, and the question of who may query them has never been stably settled. We have written before about the structural HIPAA gap that leaves registry data governed by state cannabis statutes rather than health privacy law, and about how Texas’s CURT registry sits with DPS — a law enforcement agency — rather than a health department.

A federal process that adjudicates cannabis use creates, for the first time, a concrete federal reason to want state registry data. There is no indication in the rule that DOJ intends to seek it. There does not need to be. Demand for a dataset tends to precede access to it, and the industry’s habit has been to notice the request only after it arrives.

The defensive posture is the same one we have argued for repeatedly: registry and dispensary records should be minimal enough that a future request, however lawful, retrieves very little.

Who This Actually Affects

Patients and consumers in prohibition-adjacent situations. Someone weighing a restoration application now has to decide whether documenting cannabis use to DOJ is worth the relief. That is a real decision with real downside, and it is not one a budtender should be advising on.

Cannabis employees. Industry workers in states where employment itself implies use — or where a security-guard, transport, or armored-carrier role requires a firearm — sit at the intersection of an employment record and a federal disqualifier. Facility staffing files that document cannabis use for HR purposes are now adjacent to a federal adjudication standard.

Licensed operators with armed security. If your contracted guards or transport crews are subject to § 922(g)(3) analysis, your vendor files may contain the disclosures. Check what your vendor onboarding actually collects and whether you need to hold it.

Expungement-adjacent populations. Social equity programs frequently require applicants to document prior cannabis convictions to qualify. Those files, held by state regulators, now describe conduct a separate federal process also adjudicates.

What Operators Should Actually Do

1. Do not give legal advice about this rule. The single highest-risk behavior available to a dispensary right now is a staff member telling a customer that DOJ “fixed” the gun thing. Form 4473 has not changed. Train staff to say they cannot advise on firearms law and to refer the question to counsel. Fold it into your employee training program as a scripted refusal, not an improvised one.

2. Audit what your HR files say about employee cannabis use. Many operators collect more than they need — self-disclosures, accommodation requests, program enrollment. Ask what business purpose each field serves and delete the ones that serve none. An HR file is discoverable.

3. Treat registry and patient identifiers as the sensitive category they are. Minimize at collection, cap retention, and segregate. This is the verify, don’t store principle applied to program status rather than age.

4. Write down how you respond to federal records requests. Not just subpoenas from local police — federal administrative requests, which look different and often arrive without the urgency cues staff are trained to recognize. Who reviews legal sufficiency, whether you require process rather than a phone call, whether you notify the subject where permitted, what you log. Attach it to your incident response plan.

5. Watch what DOJ publishes next. The announcement is not the rule. The retention schedule, the application form itself, and any Privacy Act system-of-records notice covering these files will tell you far more about the exposure than the press release did. A SORN is the document to read.

6. Push your state association on registry access rules. The right time to establish that a state medical registry cannot be queried for a federal firearms adjudication is before anyone tries. That is a legislative and rulemaking conversation, and it is winnable now precisely because it is hypothetical.

Bottom Line

DOJ did something good here. Removing cannabis from the presumption against restoring firearm rights is a correction to a genuine injustice, and the industry should say so plainly rather than reflexively hunting for the catch.

The catch is not in the policy. It is in the paperwork. A relief process that turns on whether your drug use was “only marijuana” is a process that requires cannabis consumers to build a federal file describing their cannabis use — under a statute that still treats that use as disqualifying in a different subsection, in a year when the rescheduling question remains open.

For operators, the practical duty is narrow and unglamorous: don’t advise on it, don’t collect more than you need, and know in advance what you’ll do when someone with a federal badge asks what you know about a customer’s use. The rule creates a new reason for that question to be asked. It does not create a new answer.

The final rule was announced by the Attorney General on August 17, 2026, transferring § 925(c) restoration authority to the Office of the Pardon Attorney. Analysis of the marijuana carve-out draws on contemporaneous reporting from Marijuana Moment and practitioner summaries; readers evaluating an application should consult counsel and the rule text directly.