North Carolina legalized smokable hemp in 2018. Smokable hemp and illegal cannabis are, to a human nose, the same plant. That fact has been driving Fourth Amendment litigation in the state ever since, and on August 15, 2026, the North Carolina Supreme Court declined to resolve it — again.

In State v. Schiene, the court upheld a Mecklenburg County conviction arising from a warrantless vehicle search triggered by cannabis odor. Justice Phil Berger Jr. wrote that “the odor of cannabis is one factor that may be considered” inside a totality-of-the-circumstances probable cause analysis, and the court held discretionary review “improvidently allowed” because it had already answered the question in State v. Dobson and State v. Rowdy, both decided May 22, 2026. Three unanimous rulings in four months, all pointing the same direction.

Defense counsel Benjamin Kull’s argument was the one the industry has been making since 2018: if the legislature legalized a product that is sensorily identical to an illegal one, smell alone cannot separate them, and treating it as evidence imposes what he called “a tax people will be forced to pay with their constitutional rights.”

The court’s answer, in effect: odor isn’t the whole case, it’s one input among many. Which raises the operational question nobody in the industry is asking loudly enough.

If smell is only one factor, what are the others?

Increasingly, the answer is documents. And a growing share of those documents live in retail systems.

Indistinguishability Pushes the Burden onto Paper

When a product category can’t be identified by inspection, legality gets established by provenance. The certificate of analysis. The invoice. The label. The receipt. The purchase record. The chain of custody from a licensed grower to a licensed processor to a shelf.

This is already how hemp enforcement works at the roadside in practice: the officer can’t tell, the field test can’t reliably tell either, and the question becomes whether the person can produce documentation — and whether that documentation checks out against a retailer’s records.

Which means retailer records are now potential evidence in two opposite directions at once. They can exonerate a customer who bought a compliant product from a licensed store. They can also, in a different case, place a specific person at a specific counter buying a specific SKU on a specific date.

Cannabis and hemp retailers have spent two years thinking about their data as a breach liability. In an indistinguishability regime, it is also a discovery target.

The Records That Actually Get Requested

From what we see in operator incident logs and counsel conversations, requests cluster around a predictable set:

Purchase history and receipts. The single most requested item. What was bought, when, by whom, at what THC level. In a jurisdiction where a product’s legality turns on total THC per container, the receipt is a chemistry claim.

Certificates of analysis and batch records. Increasingly requested not to prosecute the customer but to test the retailer — did this batch actually comply? A COA you can’t produce for a batch you sold is an enforcement problem independent of any criminal case.

Loyalty and CRM profiles. The richest file you hold, and the one least likely to be legally necessary. A loyalty profile turns a single transaction into a pattern: frequency, product preference, spend, sometimes address and phone. We’ve written about why loyalty programs are a privacy lawsuit waiting to happen; they are also a prosecutor’s summary exhibit.

ID scan records and retained images. North Carolina’s July 15 hemp age gate under HB 328 pushed thousands of hemp retailers into ID checking with almost no guidance on retention. Stores that retained images now hold a searchable archive linking identity documents to cannabinoid purchases. That archive did not exist eight weeks ago.

Surveillance footage. Required by license in the cannabis channel, voluntary in the hemp channel, and routinely requested. Retention length is the whole game — footage you no longer have cannot be requested.

Delivery and curbside manifests. Address plus product plus timestamp, which is the most identifying combination in the business.

What Operators Should Do About It

None of this is a reason to obstruct legitimate legal process. It is a reason to hold less, and to know your own procedure before someone else sets the pace.

1. Shorten retention on everything that isn’t legally mandated. Your state requires certain sales records for a certain period. That is a floor for those records and a ceiling for everything else. Loyalty history from 2023, ID images from any date, delivery manifests past the dispute window, marketing analytics keyed to individual customers — these produce no compliance value and unlimited discovery surface. The failure patterns behind the year’s biggest cannabis breaches are largely a story about data nobody needed still being there.

2. Stop retaining identity documents entirely. Verify, record the result, discard the image. This is the single highest-value control in cannabis retail and it is free.

3. Get your COA and batch records genuinely airtight. This is the one place to retain more, not less. In an indistinguishability regime, your ability to produce a compliant COA for any batch you sold, quickly, is your legal defense and your customer’s. Build it as a lookup keyed to lot number, not a folder of PDFs someone has to search. The QR-code and labeling data risks are the flip side of the same system — make provenance verifiable without making consumers trackable.

4. Write the law-enforcement request policy now. Who receives a request. Who reviews it for legal sufficiency. Whether you require a warrant or subpoena rather than an informal ask. Whether you notify the customer where permitted. What you log about every disclosure, including the ones you decline. Stores without this hand over more than they must, under pressure, at the counter. Bolt it to your incident response plan.

5. Train staff on what they say, not just what they hand over. “He comes in every week for the strong stuff” is an unrecorded disclosure with real consequences. Staff should route all requests to a named person and volunteer nothing.

6. Tell customers the environment they’re in. Not legal advice — a factual notice. Our records may be subject to legal process. Here is what we keep and for how long. Here is what we don’t keep. Combined with the plate-reader exposure in your parking lot, that disclosure is increasingly the honest version of a privacy policy.

The Broader Pattern

North Carolina is not unusual — it’s early. Every jurisdiction that legalized hemp while criminalizing cannabis has the same sensory problem, and courts are resolving it the same way: odor stays in the totality analysis, and the real work shifts to documents. New Mexico’s supreme court has been working through parallel questions. Texas just criminalized a hemp category outright, guaranteeing the same fights there.

For operators, the strategic read is simple. As the legal system leans harder on paperwork to distinguish legal from illegal product, the paperwork becomes more valuable to everyone — regulators, prosecutors, plaintiffs’ lawyers, and attackers. Records that used to be a filing obligation are now an asset with a threat model.

Bottom Line

The North Carolina Supreme Court has now said three times that it isn’t going to fix hemp indistinguishability through the Fourth Amendment. Whatever you think of that as law, it settles something practical: in states like this one, smell opens the door and documents decide what happens next.

Make sure the documents that prove your products were legal are impeccable and instantly retrievable. Make sure the documents that map your customers’ lives barely exist. That’s the whole strategy, and it’s the same strategy that protects you from a breach, a BIPA-style suit, and a regulator — which is why it’s worth doing regardless of how the next case comes out.

Ruling details from Marijuana Moment’s coverage of State v. Schiene and reporting on the May 22, 2026 decisions in State v. Dobson and State v. Rowdy.