On August 20, 2026, the Food and Drug Administration posted a solicitation seeking a contractor to monitor and analyze cannabis and hemp conversations on TikTok, Reddit, and Instagram. Responses are due September 10, 2026.
Federal agencies buy social listening constantly. Most of it is unremarkable — aggregate sentiment dashboards, trend lines, the kind of thing any consumer brand runs. The specification here is not that.
The solicitation describes capturing data on products, ingredients, claims, consumer conditions, and sentiments, with the ability to filter posts “by age-group, sex, persona, and other attributes… using trained artificial intelligence (AI) modeling, with click-through to verbatim conversation postings.”
Read that last clause again. Click-through to verbatim conversation postings.
That is not a trend line. That is a searchable, demographically filterable index of individual people’s statements about their cannabis use, assembled for a federal agency, in a country where cannabis remains a Schedule I substance while the rescheduling proceeding sits undecided.
What Is Actually Being Procured
Based on the solicitation as reported, the scope has two halves.
Half one: social media monitoring. TikTok, Reddit, and Instagram, expanding an existing FDA program that has tracked Facebook and Twitter since 2024. The analytical targets reported include unverified health claims for CBD and delta-8 products, cross-platform influencer campaigns promoting Schedule I substances, and consumer sentiment regarding FDA enforcement actions.
Half two: a “US Cannabis Consumer Survey.” Focused on dispensary shoppers, capturing product preferences, desired effects, medical conditions, occasions, frequency and history of use, average purchases, and preferred dosages.
Note the second half carefully, because it has been under-covered. A federal agency is procuring a survey instrument that asks cannabis consumers about their medical conditions and dosing. That is health information, collected outside any health privacy framework, from a population whose underlying conduct is federally illegal.
The Legitimate Case, Stated Fairly
FDA has a real regulatory job here and it is worth stating before criticizing the method.
The agency has authority over health claims, and the hemp-derived market is saturated with unverified ones. Delta-8 products marketed as treating anxiety, seizures, or cancer are a genuine public health problem. Influencer campaigns that route around advertising rules are a genuine enforcement gap. Understanding what consumers actually believe about these products is a reasonable input to regulation, and the alternative — regulating on anecdote — is worse.
Public social media posts are, in the ordinary legal sense, public. A person who posts about delta-8 on a public Reddit thread has not been wiretapped.
None of that is in dispute. The objection is narrower and it is about architecture.
Why the Architecture Is the Problem
There is a meaningful difference between “this information is public” and “this information is indexed, demographically attributed, AI-classified, and retrievable at the individual-post level by a federal agency.”
The first is a fact about a post. The second is a capability, and capabilities get used for things other than their stated purpose. This is the same argument the industry has been making about license plate readers — the plate on a public road is not private either, and that turned out to be entirely beside the point once the lookup field existed.
Three specific features escalate this beyond routine market research:
Demographic inference. Filtering “by age-group, sex, persona” means the contractor is inferring attributes about people who never supplied them. Persona classification is a profiling operation. It is applied to individuals discussing a federally illegal substance.
Individual-level retrieval. Click-through to verbatim postings means the deliverable is not a statistic. It is a corpus, with the underlying identifiable posts reachable from the analysis layer.
Contractor custody. The data sits with a vendor, under a contract, on infrastructure the public cannot inspect. The retention period, the access controls, the subcontractor chain, the disposition at contract end, and whether the corpus is retained across option years are all currently unknown. We have watched enough third-party cannabis data custody failures to know that “a contractor holds it” is where risk concentrates, not where it dissolves.
FDA is not a law enforcement agency in the way DEA is, and there is no indication the corpus is intended for enforcement against consumers. But datasets outlive intentions, and the correct time to ask about retention and sharing is during an open response window.
Who This Lands On
Operators running influencer marketing. If cross-platform influencer campaigns are an explicit analytical target, then your paid creator relationships are the thing being indexed. Every unverified effect claim an affiliate made on your behalf is now sitting in a corpus purpose-built to surface exactly that. Most operators do not know what their influencers have actually said.
Brands making health claims anywhere. Including claims made in comments by staff, in QR-code landing pages, and in reshared user content. The distinction between a customer’s testimonial and your marketing collapses the moment you repost it.
Hemp and delta-8 sellers specifically. The reported priority on unverified CBD and delta-8 health claims lands in the middle of a market already facing the intoxicating hemp compliance cliff and state-level bans. Enforcement attention and market contraction are arriving together.
Patients who discuss their conditions online. The population most likely to post detailed medical cannabis experiences — chronic pain, PTSD, epilepsy, cancer treatment — is the population with the most to lose from a federal index of those posts. They receive no notice and have no opt-out.
Dispensaries, if the survey is fielded through retail. Any request to survey your customers about their medical conditions on a federal contract needs to go to counsel before it goes to your floor staff.
What Operators Should Actually Do
1. Respond, or get your association to. The window closes September 10. Trade associations can submit comments raising retention limits, prohibition on individual-level identification, restrictions on onward sharing with law enforcement, and disposition requirements at contract end. These are ordinary procurement questions and they are far easier to get answered now than after award.
2. Audit every health claim your brand and its affiliates have made. Not just current live content — archived posts, influencer content you paid for, comment replies from staff accounts. Assume it is retrievable. Fix what is fixable and document the remediation date.
3. Put real terms in your influencer contracts. Prohibited claim categories, an approval requirement for health-adjacent language, a takedown obligation, and indemnification. Most cannabis influencer agreements are a rate and a hashtag. That is now a compliance exposure with a federal index pointed at it.
4. Separate customer testimonials from marketing. A customer saying a product helped their anxiety is their speech. You reposting it is arguably your claim. Stop amplifying condition-specific testimonials until counsel has drawn that line for your market.
5. Do not collect condition data you do not need. If a federal survey is asking dispensary customers about medical conditions, that is a reminder of how sensitive the field is — and how much of it you may already be storing in your POS and loyalty systems without a reason. Apply verify, don’t store to health attributes.
6. Tell patients the truth about social media. A short, factual privacy note — public posts about cannabis use are collected and analyzed, including by federal contractors — is accurate, useful, and costs you nothing. Patients consistently respond well to operators who treat them as adults.
7. Watch for the award. Who wins the contract, what the period of performance is, and whether a Privacy Act system-of-records notice accompanies it will tell you more about the real exposure than the solicitation does.
Bottom Line
The industry has spent years building privacy programs around a model where the operator is the custodian and the dispensary is the risk. Two things this month broke that model in the same direction: the CDC’s proposal to put cannabis use questions in the national health survey, and FDA buying an AI-classified, demographically filterable, individually retrievable index of what cannabis consumers say online.
Neither of those datasets is yours. Neither is governed by your privacy policy. Neither can be minimized by a retention setting in your POS. And both are being assembled while cannabis remains federally illegal and the scheduling question stays open.
You cannot fix that from a dispensary. What you can do is make sure that when the corpus gets searched, your brand’s contribution to it is a set of compliant claims rather than four years of influencer copy nobody reviewed — and that your own systems aren’t quietly holding the medical-condition data a federal contractor is currently paying to go find.
FDA’s solicitation was posted August 20, 2026, with responses due September 10, 2026; it was first reported by Marijuana Moment. Details of the priority analytical areas are drawn from secondary reporting on the solicitation and should be confirmed against the contract documents.
