so it's set BEFORE the // app-embed klaviyo.js (injected via content_for_header) reads it. // Klaviyo checks the __kla_off cookie on load; "true" disables tracking. // - Returning visitor who declined marketing -> set __kla_off=true. // - Returning visitor who accepted -> clear it. // - First visit (no saved choice): US opt-out default is "granted", so // we leave Klaviyo enabled and let the banner set the switch once the // visitor chooses. If your model is opt-IN, set __kla_off=true here. if (saved && !saved.marketing) { document.cookie = "__kla_off=true; path=/; max-age=31536000; SameSite=Lax"; } else if (saved && saved.marketing) { document.cookie = "__kla_off=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/"; } } catch (e) {} })(); CBD Buying Red Flags: COA, Testing, Labeling Checklist - FABCBD Skip to content
Unlock UNBEATABLE Member Prices — Details
Free Shipping On Qualifying Orders

Red Flags When Buying CBD: What to Avoid

The biggest red flags when buying CBD are missing or incomplete batch-specific COAs (Certificates of Analysis), mislabeled spectrum/THC claims, and unclear sourcing so your safest move is to verify testing panels, potency ranges, and batch numbers before you buy.

Labels say Full Spectrum, THC-free, “2400mg”… but it can be hard to know what’s real and what’s just packaging. We’ll show you the exact red flags when buying CBD and a simple COA checklist you can use in 2 minutes. No hype, no confusing jargon just clear steps you can actually follow.

What are the biggest red flags when buying CBD?

There are 9 major CBD buying red flags that show up in COAs, labels, and seller transparency. Use this as a quick checklist before you spend your money.

Is there a COA (certificate of analysis) for the exact batch you’re buying?

A missing COA is a “do not buy” signal because you can’t verify potency or contaminants. A real COA is a third-party lab report that matches the exact product batch you’re holding. Look for the batch number on the bottle or box, then check that the same batch number appears on the COA. If the seller only shows a random PDF with no batch info, or the batch numbers don’t match, you’re guessing.

Does the CBD amount on the COA match the label within a reasonable range?

A big potency mismatch means poor manufacturing control or mislabeling. If a label says “2400mg,” the COA should land close to that, like 2350–2450mg. If the result is way off (much lower or much higher), that’s not a small mistake. It means you can’t trust what the label says.

Is the product “full spectrum,” but the COA shows only CBD and “ND” for everything else?

A “Full Spectrum” label is misleading if minor cannabinoids and trace THC are not present on the COA. Here’s the simple way to think about it:

  • Full Spectrum = CBD plus other cannabinoids, plus trace THC (under 0.3%)
  • Broad Spectrum = CBD plus other cannabinoids, with THC removed to “not detectable”
  • CBD Isolate = basically pure CBD (no other cannabinoids listed)

If a product claims Full Spectrum but the COA lists only CBD and shows ND for everything else, the label doesn’t match the report.

Are safety panels missing?

A COA without contaminant panels is incomplete because potency-only testing doesn’t prove safety. A complete COA should include more than just CBD amount. It should also show results for:

  • Pesticides (often shown as Pass or ND)
  • Heavy Metals (like lead, arsenic, mercury, cadmium shown as Pass or ND)
  • Residual Solvents (shows whether solvents remain after extraction Pass or ND)
  • Microbials (like mold/yeast, E. coli, salmonella Pass or ND)

If those panels are missing, you’re only seeing part of the story.

Do you understand “ND,” “LOD,” and “LOQ”?

“ND” is the cleanest result; a number means the substance is present, even if it’s below LOQ. Here’s the quick translation:

  • ND (Not Detected): The lab didn’t detect it above its detection limit.
  • LOD (Limit of Detection): The smallest amount the test can detect.
  • LOQ (Limit of Quantification): The smallest amount the lab can measure accurately.

If the result shows a number (even a tiny one), that substance is present. ND is the clearest “not found” signal on that report.

Does the COA look recycled, outdated, or mismatched?

A COA dated years ago or with mismatched batch info can indicate recycled or fraudulent documentation. A fresh batch should have a relevant test date and a matching batch number. Also watch for red flags like: the same exact results copied across different products, broken COA links, or a QR code that goes to a generic page instead of a specific COA.

Are THC claims unclear?

THC language is a red-flag zone because vague claims increase drug-test and compliance risk. If a label says THC-free, you want that backed by a COA showing THC as ND. And if you’re choosing THC-free for work, sports, or personal reasons, remember this: however it is not guaranteed that you will pass a drug test after consuming this product. That’s why the COA matters more than the front label.

Do warnings contradict the product positioning?

Contradictory warnings undermine trust and require clear clarification so you know what you’re buying. If a product is sold as CBD Isolate or THC-free, but the page shows a THC warning, don’t ignore it.

What to do: check the batch-specific COA first. If the COA shows THC as ND, the warning may be a template issue or a broad site-wide notice. If the COA shows THC present, then the product positioning is the problem not you.

How do you check a CBD product in 2 minutes before you buy?

Use a 5-step COA and label checklist to confirm potency, safety, and truthful spectrum claims.

  1. Check for a batch-specific COA (not a generic PDF).
  2. Match the batch number on your product to the batch number on the COA.
  3. Confirm the CBD amount matches the label within a reasonable range (example: 2350–2450mg vs a “2400mg” claim).
  4. Verify the safety panels exist: pesticides, heavy metals, residual solvents, microbials.
  5. Avoid label confusion by checking spectrum and THC language against the COA (look for ND where it matters).

What should a “good” COA include for CBD oil, gummies, and topicals?

A complete COA includes potency, cannabinoid profile, and contaminant panels, plus clear lab and batch identifiers. For CBD oil (tinctures), you’ll often see a carrier like MCT oil listed on the product label MCT oil is a neutral carrier oil that CBD is mixed into so it’s easy to measure and use. For gummies and topicals, the format changes, but the COA expectations stay the same: batch match, potency check, and full safety panels.

Why do labeling problems happen in CBD products?

Labeling issues happen because oversight varies and some sellers cut corners on testing and documentation. Some brands test only potency, some reuse old COAs, and some use “buzzword labels” without proving them. That’s why your best defense is the same every time: a batch-specific COA with the right panels.

What should you do if you already bought a CBD product and now you’re unsure?

Stop and verify the COA, batch match, and THC language before you keep using it. Here’s a simple action list:

  • Locate the batch-specific COA for your product
  • Match the batch number
  • Compare label potency vs COA potency
  • Check safety panels (pesticides, heavy metals, residual solvents, microbials)
  • If anything looks off, contact the seller for the correct COA and review the return policy

FAQs

What are the red flags when buying CBD?

The biggest red flags are missing batch-specific COAs, incomplete safety panels, and unclear spectrum/THC claims. If you can’t match a batch number to a complete COA, you don’t have proof of what’s in the product.

What is a CBD COA (certificate of analysis)?

A CBD COA is a third-party lab report that shows what’s in a CBD product for a specific batch. It usually includes potency (how much CBD) and safety results (like pesticides and heavy metals), plus a test date and batch identifier.

What does “ND” mean on a CBD lab report?

ND means “Not Detected,” which is the cleanest result on a COA for that compound. It means the lab didn’t detect the substance above the test’s detection limit.

What should a CBD product be tested for besides potency?

A CBD product should also be tested for contaminants, not just CBD amount. The key panels are pesticides, heavy metals, residual solvents, and microbials.

What’s the difference between full spectrum, broad spectrum, and isolate?

Full Spectrum contains CBD plus other cannabinoids and trace THC, Broad Spectrum contains CBD plus other cannabinoids with THC removed to “not detectable,” and CBD Isolate is essentially pure CBD. The label claim should match what the COA actually shows.

*This statement has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease

FABCBD

Check your email

Dont worry we will help you to recover your password

Email is required

Verify OTP

Please enter the OTP you recevied in your email.

OTP is required

Enter New Password

Password is required
Confirm Password is required
Logo

Your Elite Membership is expiring soon

Renew now for $30 $15/yr

Limited Time Offer

Logo

Unlock UNBELIEVABLE Savings

Access ELITE Prices, Free Shipping & VIP perks at top
CBD & smoking accessory sites for only $30/yr

ELITE Members Get Birthday
Rewards!

Share your birthday below

Invalid date format. Please enter a valid date.

Your ELITE Membership Has Been
Added to Cart!

You can now shop at ELITE price!
Continue shopping & complete checkout to unlock
UNBELIEVABLE savings, free shipping & VIP perks!

, before GTM loads. // This pushes 'update' calls so GTM/GA4 reflect the visitor's actual choice // on this pageview and on every later change. Self-heals window.gtag in // case the head snippet hasn't been added yet, so nothing throws. function pushConsentUpdate(consent){ window.dataLayer = window.dataLayer || []; if (typeof window.gtag !== 'function') { window.gtag = function(){ window.dataLayer.push(arguments); }; } window.gtag('consent', 'update', { 'ad_storage': consent.marketing ? 'granted' : 'denied', 'ad_user_data': consent.marketing ? 'granted' : 'denied', 'ad_personalization': consent.marketing ? 'granted' : 'denied', 'analytics_storage': consent.analytics ? 'granted' : 'denied', 'functionality_storage': consent.performance ? 'granted' : 'denied', 'personalization_storage': consent.performance ? 'granted' : 'denied' }); } // --- Script gating function activateScriptsForCategory(cat){ // Manually-marked static tags (data-ccai-category written by hand — // needed for vendors hardcoded as ). if (window.CCAI && typeof window.CCAI.releaseVendorCategory === 'function') { window.CCAI.releaseVendorCategory(cat); } } function runConsent(consent){ // performance -> functional/loyalty/chat scripts if (consent.performance) activateScriptsForCategory('performance'); // analytics if (consent.analytics) activateScriptsForCategory('analytics'); // marketing if (consent.marketing) activateScriptsForCategory('marketing'); } function deleteCookie(name){ const host = location.hostname; const parts = host.split('.'); const baseDomains = []; const paths = ['/', '/checkout', '/cart', location.pathname]; // Add current path // Generate domains: "store.com", ".store.com", "www.store.com" for (let i = 0; i < parts.length; i++) { const domain = parts.slice(i).join('.'); baseDomains.push(domain); baseDomains.push('.' + domain); } baseDomains.forEach(function(domain){ paths.forEach(function(path){ // Try standard deletion document.cookie = name + '=; Max-Age=0; path=' + path + '; domain=' + domain + ';'; document.cookie = name + '=; Max-Age=0; path=' + path + '; domain=' + domain + '; Secure; SameSite=Lax'; document.cookie = name + '=; Max-Age=0; path=' + path + '; domain=' + domain + '; Secure; SameSite=None'; }); }); // Fallbacks for host-only cookies paths.forEach(function(path){ document.cookie = name + '=; Max-Age=0; path=' + path + ';'; document.cookie = name + '=; Max-Age=0; path=' + path + '; Secure; SameSite=Lax'; }); } // --- Vendor -> category map (per the Dec 2025 review, F1/R1). // This is the single source of truth other theme code should reference // when deciding what category a tag belongs to. GA4/Google Ads is already // gated via Consent Mode. The vendors below still need their actual // snippet, so pushConsentUpdate is not called here — it fires // only on explicit user action (Accept All / Necessary Only / Save). openBanner(); } } else { // Returning visitor: the snippet already re-applied their choice // to the dataLayer before GTM loaded, so no extra push needed here. applyTogglesFrom(saved); loadShopifyCustomerPrivacy(function(){ syncToShopifyAPI(saved); }); runConsent(saved); purgeCookies(saved); closeBanner(); } })();