A practical operator brief covering the two staff ID checks, real-time sales reporting to the state Inventory Tracking System, point-of-sale camera coverage, customer data limits, and the Cannabis Control Board sources behind each one.
Reviewed November 12, 2026. License counts come from the Cannabis Control Board’s Active Licenses Report, downloaded November 12, 2026 (file last modified November 6). Licensed doesn’t always mean open: the Board’s dashboard counted 107 retailers with reported sales in August 2026.
Retailer rows in the Board’s Active Licenses Report, downloaded November 12, 2026. Two integrated licenses are listed separately.
View source520active licenses, all typesAll rows in the same Active Licenses Report, including cultivators, manufacturers, wholesalers, propagators, labs, and retailers.
View source79towns opted in for retailThe Board’s June to August 2026 data dashboard shows 79 of 253 towns opted in to retail cannabis.
View sourceRegulatory note: The Board’s October 2026 consumer data privacy guidance is open for comment until its November 18 meeting, and the Board has authorized staff to propose Rule 2 updates. Recheck both before you lock a rollout.
Rule 2.8.3 puts an ID check at the door for anyone who looks 35 or younger. Then, before a purchase is completed, a person holding a Board-issued identification card must inspect the customer’s ID and determine their age. A kiosk can take the order, but the lane has to end at a staffed handoff.
CCB Rule 2.8.3(a) and (c)Rule 2.8.2(b) requires point-of-sale systems to report sales in real time to the Inventory Tracking System API. Older systems can stay until obsolete only if they report at least every 24 hours. Confirm that every order placed at a kiosk closes out through the POS that carries that reporting.
CCB Rule 2.8.2(b)Video surveillance must include point-of-sale areas, all entrances, exits, and ATMs. Footage must be kept at least 30 days, and devices must record continuously. Check camera views and the camera map before you add or move a kiosk or register.
CCB Rule 2.8.2(c) and (e)A retailer can’t record personal information beyond what a retail transaction typically requires without the visitor’s permission. The Board’s October 2026 guidance counts digital kiosks and ordering sites as places where a “visitor” is covered. Review what a kiosk’s ID scan, loyalty prompt, or order profile keeps.
CCB consumer data privacy guidance, Rule 2.8.3(d) and (e)Official updates for customer data rules, retail siting, staff ID cards, and Inventory Tracking System access. Last checked November 12, 2026.
Vermont CCB
At its October 28 meeting the Board voted to begin rulemaking on a proposed Retail Siting Rule and authorized staff to propose updates to Rule 2. A public hearing on the siting rule will follow.
Why it matters: If you’re planning a new store or a relocation, watch for the hearing notice before you commit to a site.
Read official sourceVermont CCB
The guidance says informed consent is required before a retailer retains additional personal information, and it names websites and digital kiosks in its definition of a visitor. Comments are open until the November 18 Board meeting.
Why it matters: Audit what your ordering site, kiosk, and loyalty tools collect, and write a standard permission text if you keep customer data.
Read official sourceVermont CCB
The Board adopted a policy that holders of a principal or controller card must hold a valid Employee Identification Card when they work for another cannabis establishment. It takes effect November 18, 2026.
Why it matters: Check that every owner who covers shifts at a sister store holds an Employee Identification Card before November 18.
Read official sourceVermont CCB
The Board previewed a dashboard on sales, retailer counts, and product trends, to be refreshed about quarterly. It also reminded licensees that CCB Portal login credentials may not be shared with third-party vendors or contractors.
Why it matters: Confirm that no vendor is logging in to the CCB Portal with your credentials.
Read official sourceHas the town voted to allow retail, and does it have a local cannabis control commission that issues a local control license?
Where does a card-holding employee check ID at the door, and where is the second check before the purchase is completed?
Which POS reports each sale to the Inventory Tracking System in real time, and what’s the written fallback if the POS or API connection fails?
Do cameras cover every kiosk and register, with continuous recording and 30 days of footage?
What customer information would the kiosk or ordering site keep, and do you have a standard permission text for anything beyond the transaction?
The cash recycler is optional. Cash acceptance, change return, and reconciliation depend on the selected hardware and software configuration. Confirm those options and the staff handoff before finalizing a rollout.
Rule 2 and the retailer statute (7 V.S.A. § 907) don’t mention ordering kiosks or vending machines. The Board’s October 2026 privacy guidance does mention digital kiosks as a place where customers order, so its customer data limits apply there. What the rules do require is staff: a person holding a Board-issued identification card must inspect the customer’s ID and determine their age before the purchase is completed. Plan the kiosk as an ordering step that ends at a staffed handoff.
Dispensify plans and deploys the physical checkout layer. The licensee is responsible for Inventory Tracking System reporting, which runs through its selected POS, inventory platform, or third-party integrator.
An individual holding a Board-issued identification card. That person watches the entrance and asks for ID from anyone who looks 35 or younger, and a cardholder inspects ID again before a purchase is completed. The ID must be a current, valid, government-issued photo ID. An ID scan at a kiosk can assist, but it doesn’t take the place of either check.
State law lets a retailer provide two ounces of cannabis, or the equivalent in cannabis products, in a single transaction to a person 21 or older. Retailers with a medical-use endorsement can sell larger amounts to registered patients, up to the patient possession limit.
Delivery to customers is prohibited, except that a retailer with a medical-use endorsement can deliver to registered patients and caregivers. Those endorsed retailers can also offer drive-through transactions under Rule 2.8.11, which requires written municipal authorization, a surveilled lane, and an ID check by a card-holding employee.
The Department of Taxes says the 14% cannabis excise tax must be stated separately from the 6% sales and use tax on the customer’s receipt. Local option tax is collected where it applies. Confirm that receipts printed from every register and kiosk order show those lines.
Last reviewed . This guide summarizes publicly available sources, and rules and figures can change after that date. Dispensify provides technology planning and deployment support, not legal or licensing advice. Confirm current requirements with the Vermont Cannabis Control Board, your advisors, and the applicable local authority.
Tell us what you’re opening, replacing, or standardizing. We’ll map the kiosk, POS hardware, cash, installation, and support path around your operating environment.
