CR Packaging Requirements for Cannabis Brands

Child-resistant (CR) packaging has been required for cannabis products in every legal North American jurisdiction since the first dispensaries opened. The federal standard, 16 CFR 1700.20, was originally written for pharmaceuticals in 1970. Cannabis brands now operate under that same protocol, plus state-specific overlay rules that vary by market.

After 30 years in this industry, I've seen too many brands learn the hard way that "certified" and "compliant" don't always mean the same thing coming from a packaging supplier. So let's get specific about what the regulations actually require and how to verify your packaging is legitimately certified.

What Is Child-Resistant Packaging?

Child-resistant packaging is designed so that children under 5 years old cannot open it within a reasonable time, but adults can. The concept was introduced by the Poison Prevention Packaging Act of 1970, which gave the Consumer Product Safety Commission (CPSC) authority to set standards for household substances and medications.

The goal is simple: delay access. A child-resistant package isn't impenetrable. It's engineered so that a young child can't figure out the opening mechanism within 5 minutes. That window gives parents time to intervene before a child ingests something they shouldn't.

For cannabis, CR requirements apply to flower, edibles, concentrates, tinctures, topicals, and any product that could cause harm if a child consumed it. That's basically everything a dispensary sells.

The 16 CFR 1700.20 Testing Protocol

16 CFR 1700.20 is the federal standard that defines how packaging gets certified as child-resistant. The CPSC protocol is specific and unforgiving.

How the test works

The test involves 200 children between the ages of 42 and 51 months (roughly 3.5 to 4.25 years old). Here's what happens:

• Each child gets 5 minutes to open the package using their hands only, no instructions.
• If they fail, a tester demonstrates the opening method once, then gives them another 5 minutes.
• To pass, at least 85% of children must fail to open the package after the demonstration. Before demonstration, at least 90% must fail.
• A separate panel of 100 adults aged 50 to 70 must be able to open and properly close the package. 90% of adults must succeed.

If the packaging fails the protocol, it cannot be sold as child-resistant. Period.

What ASTM D3475 adds

ASTM D3475 is the standard classification system for child-resistant packaging. It categorizes packages by their opening mechanism type, giving regulators and manufacturers a shared vocabulary. When a cannabis state refers to "ASTM D3475 certified," they're asking for packaging that has been tested and classified under this system. You can learn more about how these standards apply to cannabis on our child-resistant certification category page.

What "Certified" Actually Means vs. "Claimed"

This is where most cannabis brands get burned. A supplier says their bags are "child-resistant" or "meets 16 CFR 1700.20." That sounds official. But there's a big difference between a supplier that has actual CPSC-certified test data and one that's repeating what their factory in Shenzhen told them.

Here's what to ask any supplier before you buy:

• Can you provide the actual CPSC test certificate with a lab name and date?
• Was the test performed on the exact package model you're selling me, or a similar one?
• Has the packaging been re-tested since any design change?

Design changes matter. If a manufacturer changes the zipper, the material thickness, the seal width, or even the ink formulation on a CR package, the certification from the previous version may not carry over. The CPSC requires re-testing when a "significant change" is made to the packaging. Many suppliers don't re-test because it costs money. Their bags still say "certified" because the old version was. Yours isn't.

At CropPak, every child-resistant mylar bag we sell comes with documentation that ties the certification to the exact SKU. Same for our child-resistant pop-top bottles. If a supplier can't produce that paper, walk away.

Which Products Require Child-Resistant Packaging?

Under the Poison Prevention Packaging Act, CR packaging is required for most prescription medications, certain over-the-counter drugs (like aspirin and iron supplements), and household substances that are toxic if ingested. Cannabis products fall under state-level requirements, but the federal CR standard (16 CFR 1700.20) is the testing benchmark every state references.

For cannabis specifically, the general rule across legal states: if a consumer product contains THC and is sold to the public, it needs CR packaging. Edibles are the highest-priority category because they look like food. But flower, pre-rolls, concentrates, and tinctures all require it too.

What doesn't need CR packaging?

A few products are exempt from CR requirements under federal law. Oral contraceptives in blister packs, powder medications in small quantities, and certain sublingual products like nitroglycerin are exempt because the risk of delayed access outweighs the risk of child access. No cannabis product currently falls into a federal exemption category. If you're selling cannabis, assume CR is required.

State-Specific Child-Resistant Requirements

Every legal cannabis state requires CR packaging, but the specifics differ. Here's what changes by market.

California

California requires all cannabis packaging to be child-resistant per 16 CFR 1700.20 and re-closable if the product isn't single-use. The state also requires the CA Universal Symbol on all packaging. If you sell edibles, the packaging must be opaque so the product isn't visible from outside.

New York

New York's Office of Cannabis Management (OCM) requires CR packaging that meets 16 CFR 1700.20 standards. The state also mandates QR codes on all packaging that link to certificate of analysis (COA) data, and has pushed sustainability requirements for packaging materials. OCM has been stricter than most states about enforcing these rules post-sale, with recalls for non-compliant packaging.

Michigan

Michigan requires CR packaging and tracks all products through METRC (Marijuana Enforcement Tracking Reporting Compliance). Your packaging has to be CR-certified, and the METRC tag has to be affixed and scannable. Michigan's Marijuana Regulatory Agency (MRA) audits packaging compliance regularly, and non-compliant packaging is one of the most common reasons for license violations.

Common Child-Resistant Packaging Types for Cannabis

Not all CR packaging works the same way. Here are the most common types used in cannabis and how they differ:

• CR zipper mylar bags: A two-step zipper that requires push-and-slide motion to open. The most popular option for flower and edibles because it's resealable and works on standard mylar bag formats.
• Pop-top bottles: Squeeze-and-pop mechanism. Common for flower, pre-rolls, and edibles. Single-use CR that's easy for adults but stops young children.
• Exit bags: Large CR bags used at point of sale for products that aren't individually CR-packaged. Required in states like Michigan where the retail package itself may not be CR but the consumer leaves with a CR bag.
• Slider boxes: A two-step sliding mechanism on rigid boxes. Used for premium flower and concentrate packaging where brands want a more tactile unboxing experience.

The type you choose depends on your product format, your state's rules on resealability, and your brand's retail experience. For most flower brands, CR zipper mylar bags are the standard. For concentrates and pre-rolls, pre-roll tubes, pop-tops are more common.

What Happens If Your Packaging Isn't Actually Certified

The consequences of non-compliant packaging aren't theoretical. State regulators have issued product recalls, fines, and license suspensions for CR packaging violations. In Michigan, packaging non-compliance is among the top three reasons for MRA citations. New York has pulled products from dispensary shelves for lacking QR codes and proper CR certification.

For multi-state operators, a packaging compliance failure in one state can trigger audits in others. And if a child accesses your product because the packaging wasn't actually child-resistant, you're looking at product liability exposure that insurance may not cover if your supplier's certification was fraudulent.

The cost of verifying certification is negligible. The cost of not verifying can end your business.

How to Verify Your Packaging Is Actually Certified

Here's the checklist I use and recommend to every brand that asks:

• Request the full CPSC certification document, not a summary. It should name the testing lab, the date, and the exact package model.
• Confirm the package model number matches what you're buying. Suppliers sometimes show a certificate for one bag and ship another.
• Ask when the last design change was made and whether re-testing followed. If they can't answer, the certification is suspect.
• Check that the certification covers the closure mechanism you're using. A CR zipper certification doesn't cover a CR pop-top on the same bag.
• If you're selling in multiple states, check each state's overlay requirements. Some states require re-closable CR. Others accept single-use CR.

This isn't expensive to verify. It's expensive to skip. A recall because your bags weren't actually certified will cost you more than the packaging itself.

If you need CR packaging that comes with real documentation, we ship certified child-resistant mylar bags and CR pop-top bottles with full test certificates. Same-day turnaround, factory-direct pricing, and we don't sell blanks. Everything is custom-printed to your brand.