Court Orders California DCC to Fix Its Track-and-Trace System

An Orange County judge has found that California’s cannabis track-and-trace system does not do something the law says it must: automatically flag irregular transactions for investigation. For every licensee that has spent years tagging inventory and reconciling manifests in METRC, the ruling is worth understanding.

What the track-and-trace system ruling decided

On August 4, 2026, the Orange County Superior Court entered a final judgment in HNHPC, Inc. v. Department of Cannabis Control, ordering the Department of Cannabis Control (DCC) to bring the state’s track-and-trace program into compliance with California law. The case was brought by HNHPC, the parent company of the retailer Catalyst, and it centers on a specific statutory command rather than a general complaint about regulation.

According to reporting on the judgment, the court found that the state’s California Cannabis Track-and-Trace (CCTT) program, operated through the platform commonly known as METRC, collects large volumes of transaction data but does not automatically identify potentially irregular activity using objective criteria. Instead, DCC analysts have been reviewing data manually, without established definitions of what counts as an irregular transaction. The court reportedly gave the DCC six months to establish objective criteria that would allow the system to detect and flag suspicious transactions on its own. Notably, the order does not appear to require California to replace METRC or to change what operators must enter into it; it is directed at the department’s oversight architecture. (See coverage in the Cannabis Industry Journal.)

The statute at the center of the case

The dispute turns on Business and Professions Code section 26067, part of the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA). Subdivision (a) requires the DCC to establish a track-and-trace program that captures core information about the movement of cannabis through the supply chain: the originating and receiving licensees, transaction dates, unique identifiers, retail sale details, and product destruction. Subdivision (b) requires an electronic system built around electronic shipping manifests.

The operative language for this case sits in subdivision (b)(2): “The electronic system shall be designed to flag irregularities for the department to investigate.” That single sentence is the hook. The plaintiff’s argument was not that METRC fails to record data, but that recording data is not the same as flagging irregularities, and the statute requires both.

How the case got here

This judgment did not come out of nowhere. In 2023, the California Fourth District Court of Appeal revived the case after a trial court had dismissed it on demurrer. In HNHPC, Inc. v. Department of Cannabis Control (2023) (G061298), the appellate court held that the DCC’s duty to design a database that flags irregularities is ministerial, not merely discretionary, because the statute uses the word “shall.” As the court put it, “The Department did not have discretion to disregard the express flagging mandate.”

Equally important, the appellate court rejected the idea that the existence of contracts and budget requests proved compliance. The DCC had pointed to agreements with the developer of the CCTT system and to funding it had requested, and the trial court had treated those documents as conclusive. The Court of Appeal disagreed, reasoning that the department’s duty “was not to enter into a contract but to establish an electronic database that actually flags irregularities.” Whether the flagging functionality was ever actually built and deployed, the court found, remained a live factual dispute. That framing set up the trial that produced the 2026 judgment.

The “burner distributor” problem the case is about

The practical concern driving the litigation is diversion. HNHPC alleged that intermediary distribution businesses, sometimes called “burner distributors,” were being used to move licensed cannabis into the illicit market, evading taxes and undercutting operators who follow the rules. The theory is that a system designed to flag statistical anomalies could help surface that activity, while a system that merely stores manifests cannot.

The scale of California’s illicit market gives the argument weight. A state-commissioned study by ERA Economics for the DCC estimated that unregulated channels supply roughly 2.4 million of the 3.8 million pounds of cannabis consumed in California, meaning the licensed market captures only about 40 percent of total consumption. For licensees carrying the full compliance burden, the gap between what the legal market pays in and what it captures is not academic. It is the competitive environment they operate in every day.

What this means for operators

For now, very little changes at the operational level, and that distinction matters. METRC remains the state-required compliance platform. Annual and provisional licensees must continue to tag inventory and record shipments, transfers, and sales in the CCTT-METRC system exactly as before. The judgment is aimed at how the DCC monitors and enforces, not at your reporting obligations. Reading the headlines as permission to relax data entry would be a mistake.

Looking further out, the ruling is a reminder that track-and-trace data has a second life. The same records operators enter for compliance are the records the state will use, now under a court mandate, to build objective criteria for identifying irregular transactions. Clean, accurate, timely entries protect a licensee not only from routine audit exposure but also from being swept up when automated flagging arrives. Reconciliation discrepancies, late manifests, and METRC-tagging errors that once drew a notice of violation could, under a rules-based flagging system, generate an investigative flag instead.

Finally, expect uncertainty about timing. Counsel for the plaintiff has publicly suggested the DCC may appeal and resist implementation, which could extend the dispute well beyond the six-month window. Operators should also watch the DCC’s pending track-and-trace rulemaking and any guidance defining “irregularities,” because those definitions will shape which patterns in your data attract attention. This is a good moment to run an internal compliance self-audit of your track-and-trace practices rather than wait for the criteria to be announced.

Talk to counsel before the criteria arrive

The line between a routine reconciliation issue and a flagged irregularity may soon be drawn by objective, automated rules. If you want to understand how a compliant flagging regime could affect your operation, or you simply want a fresh review of your track-and-trace practices, Baghoomian Law advises cannabis operators and prospective licensees across California on licensing and compliance. Contact us at dcclicensing.com to discuss your situation.

This post is for informational purposes only and does not constitute legal advice. Consult licensed counsel for advice on your specific situation. Attorney advertising. This article is provided for general informational purposes only, does not constitute legal advice, and does not create an attorney-client relationship. For advice regarding a specific matter, please consult qualified counsel.