Hawaii’s Act 269 — passed in July 2025, effective January 2026, and enforced by the Department of Health beginning July 1, 2026 — requires every retailer and distributor of manufactured hemp products to register with the state. That includes online sellers and out-of-state sellers shipping into Hawaii.

The teeth are real: up to $10,000 per offense, registration suspension, and product destruction by law enforcement for registered vendors selling products that fail the state’s testing standards. Edibles, topicals, and beverages can qualify as legal manufactured hemp products if they meet total THC limits, lab testing, ingredient restrictions, and child-safety packaging rules. Vapes, smokable hemp, and anything made with artificially derived or synthetic cannabinoids — including those converted from CBD — do not qualify at all.

Roughly 50 shops have registered. Lance Alyas, who owns four hemp dispensaries on O’ahu, has sued in federal court, arguing the scheme violates the Supremacy Clause, the Dormant Commerce Clause, and the Due Process Clause. Other operators are seeking a preliminary injunction. State officials are defending the crackdown.

The constitutional fight will take its course. The operational point is separate and immediate: Hawaii has made being registered the compliance perimeter, and registration regimes generate a specific and underexamined set of data risks.

Registration Regimes Create Three Data Problems

1. The register itself is a target list.

A state list of every entity legally selling a product category is, by design, an enumeration of that industry. Whether or not a given registry is published, it exists, it is subject to public records requests in many states, and it consolidates business names, addresses, license numbers, and responsible-party contact details in one place.

For attackers, that is a curated prospect list for business email compromise and vendor-impersonation phishing. Cannabis and hemp operators are already disproportionately targeted by social-engineering attacks that impersonate regulators — “your registration is under review, click here to verify” lands very differently on an operator who genuinely just registered and is genuinely worried about a $10,000 penalty. Expect registration-themed phishing in every state that stands up a new regime, within weeks of the deadline.

The defensive move is unglamorous: establish, now, how your state actually communicates. Which email domain, which portal, whether they ever send links, who at your company is authorized to act on a regulatory notice. Then train to it.

2. Registration data is compliance evidence you must be able to produce.

Act 269 conditions legal sale on registration and on products meeting testing standards. That means two evidentiary chains: your registration status, and a defensible COA plus batch record for every SKU on the shelf. Product destruction by law enforcement is a remedy that arrives fast and is effectively unappealable in the moment — the operators who fare best are the ones who can produce lot-level test documentation immediately, not after a week of searching email.

If your COAs live as PDF attachments in a shared inbox, you do not have a records system, you have a search problem with a $10,000 clock on it. Build the lookup keyed to lot number. This is the same discipline the hemp records wind-down requires, and the same one that product labeling and QR-code systems should be feeding.

3. Out-of-state registration means out-of-state data obligations.

This is the provision with the longest reach. An online seller in Colorado shipping hemp beverages to a Honolulu customer is now, per Hawaii, required to register with the Hawaii Department of Health. Set aside whether that survives the Dormant Commerce Clause challenge — plan for it, because more states are heading the same way.

Registering in a jurisdiction is a data-law event, not just a licensing one. You are now a business with a documented presence in that state, shipping to identified residents, holding their names, addresses, and purchase histories. That strengthens the argument that the state’s consumer privacy and health-data statutes apply to you, and it makes you findable by that state’s regulators and its plaintiffs’ bar. Multi-state e-commerce hemp sellers who have been operating on a “we just ship it” model are about to discover they have a multi-jurisdictional privacy compliance problem inside the United States.

The Registration Gap Is Its Own Risk Signal

About 50 registered shops in a market that plainly has more than 50 sellers tells you most of the channel is either unregistered, exiting, or waiting on the litigation.

For registered operators, that’s a competitive fact and a security one. Unregistered competitors selling non-compliant product — synthetics, vapes, smokable hemp — will drive the enforcement narrative, and enforcement narratives produce broad rules. The registered minority carries the reputational weight of the unregistered majority.

For operators deciding whether to register: understand that “wait and see” is not a neutral position. Selling while unregistered accumulates per-offense exposure during the wait, and if the injunction fails, that exposure crystallizes retroactively. That’s a legal call, not a security one — but the data consequence is that operators in limbo tend to stop documenting, and undocumented periods are exactly what regulators pull on later.

What to Do This Month

If you sell manufactured hemp products into Hawaii:

  • Confirm your registration status in writing and keep the confirmation somewhere retrievable that isn’t one person’s inbox.
  • Audit your SKU list against the category exclusions. Vapes, smokable hemp, and any converted or synthetic cannabinoid are out regardless of registration — that is a product decision, not a paperwork one.
  • Build a lot-number-indexed COA lookup. Test it by asking someone to produce a COA for a random lot in under two minutes.
  • Confirm your child-resistant packaging and labeling claims are documented by supplier, not assumed.

If you’re an out-of-state or online seller:

  • Map every state you ship into and the registration status of each. This is now a standing compliance obligation, not a one-time check.
  • Treat each registration as triggering that state’s privacy law analysis. Data minimization travels well: the fewer customer fields you hold, the fewer statutes matter.
  • Do not retain ID images from age verification anywhere, in any state. Verify, don’t store is the whole control.

Everyone:

  • Expect regulator-impersonation phishing tied to registration deadlines. Brief the team on the real communication channel before the fake one arrives.
  • Watch the November 12 and December 11 federal deadlines alongside this. Hawaii’s synthetic exclusions already anticipate the federal direction; state and federal timelines are converging on the same product categories from different angles.

Bottom Line

Hawaii’s approach is worth studying because it is a template other states will copy: define a narrow legal product category, require everyone touching it to register — including sellers who have never set foot in the state — and enforce with fines and physical destruction of inventory.

Registration regimes look like licensing. They behave like data regimes. They produce lists that attract attackers, they create documentary burdens that only good records systems survive, and they extend a state’s regulatory and privacy reach to businesses that thought geography protected them.

The operators who come through this well won’t be the ones with the best legal argument. They’ll be the ones who can produce the right document in ninety seconds and who never kept a customer’s passport scan in the first place.

Act 269 requirements, enforcement terms, and litigation details from Marijuana Moment’s coverage of the Hawaii hemp lawsuit and contemporaneous Hawaii reporting on Department of Health registration enforcement.