Do You Need a COA to Sell CBD on Shopify?

In practice, yes: you need a COA to sell CBD on Shopify, even though no federal agency runs a storefront approval queue. The federal hemp definition sets a floor, not a permission slip, and there is no single national rule that forces every CBD listing to carry a Certificate of Analysis. What actually gates your business is the chain of parties between you and a paid order: your payment processor, the marketplaces and wholesale buyers you want to reach, the states you ship into, and the customers deciding whether to trust you. Each one asks for a COA, and any one of them can shut you down without it.

So the honest answer is not "the law requires it." The honest answer is "the people who let you stay online and get paid require it." That distinction matters, because overstating a national mandate makes you look uninformed to a processor's underwriting team, and understating the practical pressure gets your account frozen. Treat the COA as the cost of doing CBD on Shopify.

Who actually requires a COA

The COA requirement comes from four directions, and they stack.

Payment processors. CBD is classified as high-risk. The processors and gateways willing to touch it, the CBD-friendly underwriters, build COA review into onboarding and ongoing monitoring. They will ask for a current batch COA, and they will re-ask. Lose the ability to produce one on demand and you risk a held balance or a closed account, which is the single most expensive thing that can happen to a hemp brand. This is the gate that bites first and hardest.

Marketplaces and wholesale buyers. If you want to sell into a marketplace, a distributor, or a retailer's shelf, the COA is the entry ticket. Buyers will not place a purchase order for a lot they cannot verify, and most have a compliance contact who reviews COAs before money moves. No COA, no PO.

State rules. Several states require batch testing, accredited labs, and consumer-accessible results for hemp and CBD products, and the specifics vary widely by state and by product type (ingestible, topical, inhalable). Some require a scannable link on the label. Do not assume your home-state rule travels with the package; you are subject to the rules where you ship. The federal definition is the baseline, and your states layer on top of it.

Customers. A meaningful share of CBD buyers will not purchase without seeing test results, and the savvier ones know to check the batch number against the COA. A visible, current COA is a conversion asset, not just a compliance artifact. Hiding it costs you sales and invites the support ticket that asks for it anyway.

For the Shopify-specific platform rules and how they interact with your processor agreement, the deeper walkthrough is in our guide to CBD compliance for Shopify stores.

Legally mandated versus practically required

It is worth being precise here, because precision is what separates a brand that survives underwriting from one that does not.

The pattern is clear. The legal column is patchy and state-dependent. The operational column is solid. You can build a CBD business that is technically compliant with the bare federal floor and still cannot process a single order, because your processor declined you for lack of a COA. Plan for the operational column.

What the COA has to be to count

Not every document labeled "COA" satisfies the parties above. A potency-only sheet from an unaccredited lab, or last year's COA from a different lot, will fail a serious review. Four things make a COA useful in this context.

• Full panel, not potency only. A full-panel COA covers cannabinoid potency plus heavy metals (lead, arsenic, cadmium, mercury), pesticides, microbials (yeast and mold, E. coli, Salmonella), residual solvents, mycotoxins, and moisture or water activity. Hemp is a hyperaccumulator that pulls metals out of the soil, so heavy-metal results are not optional. A short walkthrough of every section lives in what a hemp COA tests for.
• ISO/IEC 17025 accredited lab. Accreditation is the signal that the lab's methods and instruments are validated. A reputable COA shows the methods used, the limits of detection and quantitation (LOD/LOQ), and a pass or fail per analyte.
• The current batch. The COA must tie to the specific lot you are selling right now. Batch numbers change, and so do results. When you rotate stock, you rotate the published COA.
• Total-THC aware. This is the part most brands have not caught up on. H.R. 5371, enacted November 12, 2025, redefines hemp using total THC (delta-9 plus other THC isomers) at no more than 0.3% on a dry-weight basis, and it excludes finished products carrying more than 0.4 mg of total THC per container. It takes effect November 12, 2026. Your COAs should already report total THC so you are not scrambling when the rule is in force. The full breakdown is in our explainer on the 2026 total-THC rule and what it changes for COAs.

A useful COA, then, is a full-panel report from an accredited lab, tied to the batch on the shelf, that reports total THC. Anything less invites a question you cannot answer.

How to actually do it on Shopify with LabLinks

Having the right COA on your hard drive does nothing for your processor or your customer. It has to be published, tied to the product and batch, and easy to find. That is the gap LabLinks closes, and it maps directly onto the four parties that gate you.

The workflow is short:

1. Upload the COA. Drop in the PDF or image and enter the batch or lot number, test date, lab name, and pass or fail status, plus any custom fields your industry needs.
2. Link it to the product and batch. Connect the COA to the specific Shopify product and the lot it belongs to, so the right document is always tied to the right listing.
3. Show a product-page badge and on-page viewer. A theme app block adds a lab-tested badge to the product page. Customers click it and the COA opens in an on-page popup viewer, no download required, no leaving the page. That visible proof is what answers the customer and trims support tickets.
4. Give buyers and auditors a searchable portal. Every store gets a searchable portal where anyone can look up a COA by product, batch, or lot. When a processor or wholesale buyer asks for results, you send one link instead of digging through email.
5. Print QR codes for packaging. Generate a QR code per batch that points to the right COA, so the code on the container resolves to the current lot. This is how you meet the scannable-link expectation some states and labels demand.

When you sell through a lot and publish the next batch, the storefront updates on its own, so the page never shows a stale COA against new inventory. That batch-to-batch freshness is the whole point, and it is hard to maintain by hand.

If you want the click-by-click version, see how to add COAs to Shopify product pages, and the app itself is on the LabLinks listing in the Shopify App Store. The first five reports are free, which is enough to wire up your top sellers before you commit. For the full landscape of testing obligations this sits inside, the hemp and CBD lab testing compliance guide is the pillar to start from.

What you need in place before you list

A short checklist to know you are ready to sell:

• A full-panel COA from an ISO/IEC 17025 accredited lab for each batch you are selling.
• Total-THC reporting on those COAs, ahead of the November 12, 2026 effective date.
• The current batch COA tied to the matching product and lot, not a generic file.
• A CBD-friendly payment processor that has seen and accepted your COAs.
• A visible path to the COA on the storefront: a product-page badge and viewer, a searchable portal, and a QR code on the packaging.