In March of this year, a California distributor found out the hard way how fast a license can unravel. Investigators discovered an employee had been logging into the state’s track-and-trace system using the credentials of someone who no longer worked there. More than 1,000 transactions were filed under a login that should not have existed anymore.
Delivery manifests made things worse — the timestamps did not match when deliveries actually happened. The state moved to suspend the license before the case even reached a full hearing. The whole thing started with something that probably felt harmless: someone needed system access, an old login still worked, and nobody thought to ask why.
Nobody at that company set out to lose their license. That is what makes this list worth actually reading instead of skimming: almost none of the mistakes below look dangerous in the moment. They look like a shortcut, a skipped step, a “we will fix it later.” Here are seven of the ones that show up most often in real enforcement cases and what each one actually costs.
1. Letting employees share login credentials. Every person who touches your track-and-trace system needs their own login, full stop. Using a departed employee’s credentials — even out of convenience, even for a week — is exactly the violation that triggered the suspension case above, and it is trivially easy for an auditor to spot.
2. Selling or distributing to an unlicensed business. It does not have to be intentional. A buyer’s license can lapse without you noticing, and “we did not know” is not a defense the DCC accepts. Verify license status before every transaction, not just the first one.
3. Manifests that do not match reality. If your paperwork says a delivery happened at 2:00 PM and the truck actually left at 4:30, that gap is a regulatory violation. It does not matter that every gram of product is accounted for — track-and-trace exists to prove the paperwork matches the inventory. Small timestamp drift is one of the easiest things for an inspector to catch.
4. Treating customer data casually. A breach last year exposed more than 420,000 customer records at a major California retailer. Medical customer information is sensitive personal data under state law. A lax point-of-sale or marketing database is a compliance failure waiting for a headline.
5. Marketing that skips the age gate. Advertising rules exist specifically to keep cannabis marketing away from minors. A website or social campaign without a real, functioning age-verification step isn’t a gray area — it’s one of the more straightforward violations to prove after the fact.
6. Assuming state compliance is the whole picture. Passing every DCC requirement doesn’t protect you from your own city or county. Local conditional use permits carry their own rules. A local revocation can shut you down even while your state license is in good standing.
7. Not being able to produce records on demand. An inspector who asks for a document you can’t locate in the moment doesn’t wait for you to find it later. Outdated policies, missing logs, and “we have that somewhere” are their own category of citation, separate from whatever the paperwork would have shown.
The Pattern Underneath All Seven
None of these are dramatic. That is exactly the point — license risk rarely announces itself as a crisis. It shows up as a login that got reused, a timestamp nobody double-checked, and a policy that has not been reviewed since renewal.
The businesses that stay compliant are not the ones with no mistakes in their history. They are the ones that catch the small ones before an inspector does, on a schedule, instead of scrambling to explain them after the fact.
If more than one of these sounds like something happening at your business right now, that is not a reason to panic — it is a reason to fix it this week instead of finding out about it during an audit.
Find the Gaps Before an Inspector Does
Review your security program before small oversights become costly.
Massive Security helps cannabis businesses build security programs that support regulatory compliance while protecting employees and valuable inventory.