Inside a head shop in the Southern California city of Oxnard, the glass display cases are lined with delta-8 THC edibles and vape cartridges encased in vibrant, colorful packaging, most of them bearing QR codes. It’s a sight common in head shops, vape outlets, and tobacco stores across the country these days.
We walked out of the shop with three delta-8 products. Two of them turned out to be fake.
But where do these products come from? Who makes them? How do consumers know they’re not filled with harmful contaminants, heavy metals, or even a potentially deadly additive like vitamin E oil?
The answer: They don’t.
Here’s why. As medical and recreational cannabis was legalized, each state included a regulatory system that determines what, how, where, and by whom all the various cannabis products are produced and sold. In California, special labels appear on products grown or manufactured by state-licensed companies, which adhere to strict safety and potency rules.
That’s not the case with any unlicensed store selling delta-8 products.
No rules, not right
There are no rules around how or where these shops get their products. That allows sketchy brand-less products, with no safety testing or traceability, to be sold.
There can be legitimate delta-8 products at these stores, of course. But it’s not clear exactly how state regulators would or could stop contaminated delta-8 products from being sold at random retail stores in strip malls.
Some heavy metals and contaminants have already been found in delta-8 products tested by the U.S. Cannabis Council, an industry trade group. A recent Leafly investigation into the safety of delta-8 products found a number of reasons to take care before purchasing.
At the shop in Oxnard, we purchased three delta-8 products: one that looked relatively legit just on the surface and another two that, well, didn’t.
Here’s what we found.
EightySix delta-8 infused gummies: Real
EightySix brand delta-8 THC gummies, apple jade flavor
A quick scan of the QR code leads to a link showing a Certificate of Analysis, or COA, for each strain. This document breaks down potency and contaminant levels shown by testing from a third-party lab.
The lab tests were actually done for the EightySix gummies, which was a good sign.
The COA for this pack of gummies states that it was completed for EightySix, the same brand listed on the product itself. This is a good sign. Often, when COAs are altered or forged, the client or customer name is changed, according to several industry experts we spoke with.
“Last year I started seeing more and more of my COAs—for products I had made—changed,” recalled Russell Lombard, CEO of Denver, Colo.-based wholesaler Canna Redux Hemp Extracts. “My company name [had been] removed.”
“I’ve seen one COA, in particular, which was 99% delta-8,” Lombard added. “It showed up for six months on forums from different resellers, reprinted representing different products … and I didn’t even know these people.”
Double-checking with the lab
The lab listed on the COA for the EightySix gummies was PharmLabs San Diego, a licensed cannabis testing facility.
When we called, Elijah Leach, a sample intake specialist at the lab, confirmed that PharmLabs works with EightySix, which is a well-respected brand in California’s delta-8 space.
If the lab test on the label looks suspicious, call the lab directly. They’re happy to verify.
Leach also said the facility had received calls about COAs from other brands bearing the lab’s logo, which turned out to be forged.
“You can tell that it’s wrong usually because it’s formatted wrong,” Leach explained. There are little imperfections, he said, like odd text and line spacing on the documents. Calling the lab is a sure way to find out if the COA you’re looking at is really for the product you’re buying.
The COA for EightySix’s gummies revealed test results for heavy metals such as arsenic and lead, and other contaminants. Those results were all in compliance with California’s safety standards for legal cannabis. The product also met the federal legal standard of less than 0.3% delta-9 THC.
“We take it very seriously when it comes down to our testing,” said Connor Magallames, an operations manager at EightySix.
Cake delta-8 vape cartridge: Fake
Cake brand disposable vape cartridge, Birthday Cake strain
The packaging design for this Cake product looked suspiciously similar to the illegal vape cartridges that spread vape lung injuries across America in 2019. The “C” on the box mimicked the logo of the well-known licensed brand Cookies, which was widely copied two years ago by makers of illegal vape carts.
Another red flag: The overall look and feel of the product has a much less sophisticated design than the sleek packaging of the EightySix gummies.
But there is a QR code. So we scanned it.
It led to a Certificate of Analysis that was completed by Encore Labs in Pasadena, CA. The testing results showed the product was about 78.7% delta-8 THC. But no levels for contaminants or heavy metals were listed.
That’s not great news, but it wasn’t our biggest concern.
On the COA, the client’s name was listed as SD Distro—not Cake, the brand shown on the packaging.
Let’s check with the lab
When we called Encore Labs, the company’s operations manager Jessica Burnham told us that the COA the facility has on file lists the client’s name as Cake Distribution. But that didn’t match with the COA we were shown online.
And that wasn’t the only discrepancy.
We checked the address listed below the client’s name on the COA. The COA on file at Encore Labs does not include that same address. And it’s not an address for the company’s headquarters or storefront, but rather for a luxury apartment building in Santa Ana, CA.
A ghost address
Neither that address, nor anything else, led us to an actual company or brand.
Delta-8 vape carts in this same Cake packaging are being sold by tons of random retailers online, but they can’t be found on the website of any single reputable brand.
Phony lab test, phony product. Do not inhale this mystery vape oil.
Basically, there’s no way to tell where the product came from. That’s a huge red flag.
We filled out a contact form on the website that the QR code links to, but never heard back. There was no phone number or email listed.
The COA appears to be forged.
Burnham, of Encore Labs, agreed. She said it’s not the first time that’s happened. “Purchase products from a reliable retailer,” she advised.
Delta-8 infused ‘Flamin’ Hot Cheetos’: Fake
Runtz hot cheese snacks
These edibles are a lot different from the gummies manufactured by EightySix.
First, there’s no brand or company even listed on the package. That’s a huge red flag that should stop your purchase right there.
No reputable brand would risk the legal blowback by selling a product that mimics Hot Cheetos. Buyer beware.
Second, their packaging design mimics a well-known national non-cannabis brand (Cheetos, by Frito-Lay) and its popular Flamin’ Hot Cheetos product. No established reputable company would so flagrantly rip off a Frito-Lay product. The Frito-Lay legal department would be all over them in a hot minute.
This is a common theme among delta-8 products that echoes the vaping crisis of 2019-2020: Products packaged to look like either a popular, legal weed brand like Cookies, or a popular food or candy brand like Cheetos.
At the head shop, the Runtz ‘hot cheese snacks’ were placed alongside other edibles that looked like Chips Ahoy! and Doritos. In fact, the bag of infused fake Doritos didn’t even have a different name — it was literally just a red bag of Nacho Cheese Flavor Doritos.
The only thing distinguishing it from a real bag of Doritos was a sticker that says “Delta 8 THC 21+” and another small logo with a weed leaf, exclamation point, and “CA” — the same marking placed on legal, regulated weed products. If it wasn’t sold from a glass case at a head shop, you’d probably assume it was normal Doritos.*
This was the way all the edible snacks, including the fake Flamin’ Hot Cheetos, were labeled.
Always look for the QR code
The proving factor with the cheese snacks and other edibles? No QR code.
None of them had a QR code, so there’s absolutely no way of knowing what’s inside. In fact, the cheese snacks didn’t even bother to tell consumers how many milligrams of THC were in the bag.
If there’s no way of knowing what’s in a product, there’s simply no way of telling how safe or effective it really is.
* Editor’s note: Officials with Delta 8 Oils, a state-licensed Arizona medical marijuana product manufacturer, have notified Leafly that the “Delta 8” logo on the bag of Runtz Flamin’ Hot is a pirated version of their company logo. Leafly is investigating the situation and will publish a follow-up report soon.
