What 'Third-Party Tested' Really Means for CBD

"Third-party tested" is one of the most common phrases printed on CBD packaging in the US, and it is not a certification. No federal rule defines the phrase, no agency issues it, and nothing stops a brand from putting it on a label. It can describe a rigorous, accredited, batch-specific analysis. It can also describe one potency test, run once, on a sample somebody else selected. The badge does not tell you which one you are holding. Four questions do: which laboratory, accredited by whom and for which methods, which batch, and who took the sample.

The short version, before the detail. Three separate things get collapsed into that one phrase: independence (who owns and pays the laboratory), accreditation (whether an outside body has assessed its technical competence against ISO/IEC 17025:2017), and scope (which tests were actually run on your batch). A lab can be accredited and owned by the manufacturer. A lab can be independent and never assessed by anyone. And a report from a genuinely independent, accredited lab can still cover potency alone. You can check all three from the report itself in about five minutes, and the last step ends in a public accreditation directory rather than in a brand's PDF.

First, second, third party: what the phrase literally means

The vocabulary comes from contract law, not from chemistry. The first party is the maker: the brand, the processor, the company whose revenue depends on the result. The second party is the other side of the transaction, the buyer or the retailer. A third party is anyone with no interest in either side. So "third-party tested" is a statement about relationships, not about quality. It says the analysis did not come from the people selling you the bottle. It does not say the laboratory was competent, that the testing was thorough, or that the report describes the batch in your hand.

Federally, the gap here is more specific than the usual "CBD is unregulated" line. Testing rules do exist, but they are aimed at the field rather than the shelf. Under 7 CFR 990.3, a hemp crop is sampled within 30 days before the anticipated harvest and tested for total delta-9 THC, and since the end of 2022 that testing has to be done by a DEA-registered laboratory. 7 CFR 990.25 sets performance standards for that work and requires a measurement uncertainty to be reported with the result. None of it touches the finished tincture. The FDA, separately, has approved one CBD medication (Epidiolex) for specific seizure conditions and has not approved CBD as a dietary supplement. Testing a finished CBD product is, at federal level, voluntary, and "voluntary" is exactly why the details of who tested it matter.

Some states have filled the gap, and at least one has written the test into statute. Under Fla. Stat. 581.217 (2025), an "independent testing laboratory" has to clear three separate bars:

• No interest in the company being tested: the lab must have no direct or indirect interest in the entity whose product it is testing.
• No interest in the industry at all: no direct or indirect interest in any facility that cultivates, processes, distributes, dispenses or sells hemp, hemp extract or marijuana, in any jurisdiction.
• Accreditation by an outside body: the lab must be accredited as a competent testing laboratory pursuant to ISO/IEC 17025 by a third-party accrediting body.

Florida is one state, not a national rule, and state hemp law is moving fast enough that the current text is worth checking before you lean on it. Read it as a definition rather than as a requirement you can expect everywhere: it turns a feeling into a checklist. Most "third-party tested" badges gesture at the first bar and quietly skip the other two. Florida also requires the container itself to carry the batch number, an expiration date, the milligrams of each marketed cannabinoid per serving, and a scannable code linking to that batch's certificate of analysis. For the wider legal picture, including the 0.3% federal limit and how states diverge, we cover that separately.

Accreditation is not independence

This is the sentence almost every page on this topic gets wrong. "ISO 17025 accredited" and "independent" are two different claims, and neither implies the other. Accreditation is an assessment of a laboratory's management system and technical competence for specific tests: it says the lab knows how to run the method, controls its instruments, validates its results and gets reassessed on a schedule. It says nothing at all about who owns the lab or who pays its invoices.

You do not have to take our word for that. NIST runs its own laboratory accreditation program, NVLAP, which assesses laboratories against ISO/IEC 17025:2017, and its published description of who may apply is explicit: the services are available to "commercial laboratories, manufacturers' in-house laboratories, university laboratories, and federal, state, and local government laboratories". A manufacturer's own bench can hold accreditation to the same standard as an outside lab. That is not a loophole, it is how laboratory accreditation is designed to work. It does mean that an accreditation logo on a lab report answers the competence question and leaves the ownership question completely open.

So how do you check independence, when no registry of it exists? You look for the tells. Does the laboratory have a corporate identity of its own: its own name, its own street address, its own website, its own state license number? Do the lab and the brand share an address, a parent company, or an obviously shared design language on the report? Does the brand's own site describe the lab as "our lab" or "our in-house lab" anywhere? No single one of those is proof. Taken together they are usually enough to tell an outside laboratory from an in-house one wearing a badge.

What ISO/IEC 17025 actually certifies

ISO/IEC 17025:2017 is the international standard for the competence of testing and calibration laboratories. A lab does not certify itself against it. An accreditation body assesses the lab (methods, equipment, staff competence, quality system, results) and, if the lab passes, issues a certificate of accreditation together with a scope of accreditation. In NIST's wording, that scope "details the specific test methods, calibration parameters, or services for which a laboratory has been accredited". The scope is the document nobody talks about, and it is the one that carries the information.

• The accreditation body: the organization that did the assessing (A2LA, ANAB, PJLA and NVLAP are common US examples), never the lab itself.
• The standard, written out in full, for example "ISO/IEC 17025:2017". A certificate that names no standard is not an accreditation certificate.
• A certificate or accreditation number: the string you type into the accrediting body's public directory.
• Dates: an initial accreditation date, a current issue date and an expiry date. Accreditation lapses. A logo does not.
• The scope supplement: the list of methods, analytes and matrices the accreditation actually covers. Without it, "accredited" is an unfinished sentence.

To make that concrete with a real document: the laboratory that analyzes the batches behind our own lab reports, Infinite Chemical Analysis Labs in San Diego, was listed in Perry Johnson Laboratory Accreditation's public directory when we checked in July 2026, under accreditation number 95560, accredited to ISO/IEC 17025:2017 in chemical, non-destructive and biological testing, initially accredited in July 2018, with the current certificate issued in March 2025 and expiring 30 April 2027. That certificate document runs 16 pages, and 15 of them are the scope. Keep that ratio in your head. One page is letterhead; the useful part is the appendix listing accredited method codes analyte by analyte, from cannabinoid potency by UPLC to heavy metals by ICP-MS to pesticides, residual solvents, terpenes, mycotoxins and microbial analysis. Accreditation is also a rolling status that can be suspended or withdrawn between assessments, so check the directory yourself rather than trusting a number printed on a label or, for that matter, in this article.

Scope: "third-party tested" can mean a single test

A certificate of analysis is not a fixed document with a fixed set of panels. It contains whatever panels were ordered and paid for. A brand can commission cannabinoid potency alone, publish the resulting one-page report and describe the product as third-party tested with total accuracy. Every word of that is true, and the report still says nothing about heavy metals, pesticides, solvents or microbes. So when you open a lab report, count the panels before you read a single number.

Two practical rules fall out of that table. First, a potency-only report is a partial answer rather than a dishonest one: it is answering the label question, not the safety question, and the difference is worth knowing before you treat it as both. Second, which panels a product genuinely needs depends on how it was made. A solvent-extracted concentrate carries a residual-solvent question that a mechanically pressed product does not, and anything grown in soil carries a heavy-metals question. The potency panel is also where a spectrum claim gets checked, since what full spectrum, broad spectrum and isolate are supposed to mean is at bottom a statement about which cannabinoids should and should not appear. For reading the numbers inside each panel, including what "ND" means and how detection limits work, our section-by-section walkthrough of a certificate of analysis does that job properly.

Why two labs can give two answers

If cannabinoid testing were a solved problem, the identity of the laboratory would be a detail. NIST ran the experiment to find out. In the first exercise of its Cannabis Laboratory Quality Assurance Program, published in 2021 as NISTIR 8385, 116 laboratories signed up and were sent the same hemp oils to analyze. On the first hemp oil, 31 of the 68 labs reporting CBD (46%) landed outside NIST's range of tolerance, and 37 of the 65 reporting delta-9 THC (57%) did the same. The second oil was tighter on CBD, at 15 of 79 labs, or 19%.

Read those numbers carefully, because they are easy to misuse. CannaQAP is explicitly educational: participants are anonymized, NIST assigns no pass or fail, and "outside the range of tolerance" is a strict metrological yardstick rather than a finding of incompetence or bad faith. Measured against the looser community-consensus band, only 11% to 15% of labs fell outside. The honest conclusion is not that half the industry is wrong. It is that two competent laboratories can hand you two different numbers for the same oil, which is why "a lab tested it" is not a complete sentence.

The same effect turns up at market scale. A 2018 analysis in Scientific Reports of Washington State's cannabis traceability data, corrected in 2020 on a dataset of 215,285 test results, found median reported THC for the same product category ranged from 17.7% to 23.2% depending on which laboratory ran the test, and that the differences persisted after controlling for plausible confounds. A 2023 PLOS ONE study bought 23 flower samples from 10 Colorado dispensaries and measured them by HPLC: about 70% came in more than 15% below the potency printed on the package, which the authors attribute partly to financial incentives to market high THC. Both studies looked at state-legal marijuana flower, not hemp CBD and not tinctures, one of them on only 23 samples, and neither says anything about any CBD brand or product. What they document is what happens when the party who benefits from a number also gets to choose who reports it.

Traceability: the report has to be about your bottle

A lab report is a statement about one sample, from one production run, on one date. That makes the batch number the hinge of the entire exercise. If the code on your bottle does not appear on the report, the report describes somebody else's oil and every other check you ran on it was wasted. The batch code is usually inkjet-printed on the glass or the carton flap rather than being part of the printed label art, which is one of the things our guide to where the batch number lives on a bottle covers. Here is what else on a report has to line up.

• Batch or lot number: the single field that has to match your bottle exactly. Everything else on the report is context around it.
• Sample ID: the lab's own identifier for the vial it received. On a Planntz report it looks like ICC-260327-37-001 and ties the results to one specific submission.
• Three dates, not one: reports carry a collected date, a received date and a report date. On Planntz batch 260320 all three sit inside a week (collected and received 27 March 2026, reported 1 April 2026). Large gaps are worth a question.
• Measurement uncertainty: a serious report states how precise the number is. On batch 260320 the CBD result reads 28.8% with an uncertainty of plus or minus 0.285%. Federal crop-testing rules require an uncertainty too (7 CFR 990.25).
• Who took the sample: read the small print under the potency panel. It often says the sample was supplied by the client, which changes what the report can honestly certify.
• The client field: it names whoever submitted the sample, which in contract manufacturing is frequently the processor rather than the brand on the bottle. Match the batch number, not the company name.

Those last two deserve more than a bullet, because they are the honest limits of all send-a-sample testing. The footnote under our own potency panel states that out-of-state samples are sampled by the client. The laboratory analyzed what arrived in its vial: it did not walk the production floor, did not pull a container off the line itself, and cannot certify that the vial was representative of the batch. Collection by the laboratory is a stronger control, and it exists, but it is generally tied to state compliance programs rather than to voluntary testing. Any brand presenting a send-a-sample report as an audit of its manufacturing is overselling the document, and that would include us. The "client" line is a related trap: in contract manufacturing the submitter is often the processor, so a client name that is not the brand is normal rather than suspicious. Build the rule around the batch number instead, since that is the field that ties a document to a bottle. A report far older than the oil in your hand raises a different question, one our note on how CBD oil ages and what a best-by date means takes on directly.

Where the report lives, and how to check the lab is real

A PDF hosted on a brand's own server is a file that brand controls. That does not make it false, but nothing about the document is independent of the company it flatters. The stronger version is a report you can open on the laboratory's own domain, inside the lab's information system, where the brand cannot edit it. The reports we publish print a verification link into the laboratory's own system, and they are signed by name: on the batch used as the example below, David Marelius PhD, Chief Science Officer, and Erik Paulson PhD, Lab Director. That means the document does not depend on us to exist, and the people who stand behind it are identifiable. A live lab-side link proves the report is real. It does not prove the bottle in your hand came from that batch, and that part is still yours to check.

Then confirm the laboratory itself is what the report says it is. Accreditation bodies publish free, searchable directories of every lab they accredit, and the lookup takes under a minute.

• A2LA publishes a public search at portal.a2la.org, including suspended and withdrawn certificates and a "false claims of accreditation" tab.
• ANAB publishes its accredited-organization directory at search.anab.org.
• PJLA publishes its accredited organizations at pjlabs.com.
• ILAC lists the recognized accreditation bodies worldwide, which is where to go when the body named on a certificate is one you have never heard of.
• Compare four fields: organization name and city, certificate or accreditation number, the standard (ISO/IEC 17025:2017), and the expiry date. A matching name with a lapsed expiry is not a pass.

One caveat saves you from a false negative: there is more than one accreditation body, and a lab accredited by one will not appear in another's directory. The lab behind our own reports is listed by PJLA and, when we searched in July 2026, was not in ANAB's directory, which is exactly what you would expect and not a red flag. Search more than one before you conclude anything. A laboratory that appears in none of them, under any spelling of its name, has answered your question.

The five-minute verification, step by step

Here is the whole thing as a procedure. Run it on any brand, including this one. It works outward from the report and it finishes somewhere the seller does not control.

1. 1Find the lab. Open the report and locate the laboratory's name, address and license number. If no laboratory is named anywhere, stop: there is nothing to verify.
2. 2Look the lab up. Search that name in the A2LA, ANAB and PJLA directories. Compare the certificate number, the standard and the expiry date with whatever the report or the lab's site claims.
3. 3Test independence separately. Check that the lab has its own name, address, website and license. Shared addresses, shared ownership or "our lab" phrasing means in-house, accredited or not.
4. 4Count the panels. Note which panels are actually on the report: potency, THC, heavy metals, pesticides, residual solvents, microbials. "Tested" only covers what is printed there.
5. 5Match the batch. Compare the batch or lot code on your bottle with the batch on the report, character for character. This is the step that makes the document about you.
6. 6Check the dates. Collected, received and reported should sit close together and near your bottle's production. A report years older than the product describes a different run.
7. 7Open it from the lab's side. Use the lab-hosted link or QR code if one exists, not only the brand's PDF, then read the small print for who took the sample.

Red flags on a testing claim

• "Third-party tested" with no laboratory named anywhere on the product, the site or the report.
• A report with no batch or lot number on it, so it cannot be tied to any particular bottle.
• A laboratory that appears in no accreditation directory at all, under any spelling of its name.
• A "certificate" that is a screenshot or a flattened image rather than a document you can search and read in full.
• A QR code that lands on a homepage, a shop page, or one undated generic PDF reused for every product.
• A report dated well outside the product's own shelf life, or with no dates on it at all.
• Potency-only testing described as "fully tested", "tested for purity" or "comprehensively tested".
• Every measured value landing exactly on the label claim. Real measurements carry uncertainty and rarely hit the round number.
• "FDA approved", "FDA registered" or "lab certified" anywhere near the testing claim. None of those describe a CBD tincture.
• A broad-spectrum product sold as THC-free with no THC line on a batch report to support it.

What our own reports do and do not cover

It would be cheap to hand you a checklist and never run it on ourselves, so here is our own worked example with the gaps included. Take the Broad Spectrum Mango and Peach report on our public lab results page, batch 260320. The laboratory is Infinite Chemical Analysis Labs in San Diego, California license C8-0000047-LIC, accredited to ISO/IEC 17025:2017 by PJLA under accreditation number 95560, on a certificate expiring 30 April 2027 (check the directory yourself, because that status can change). The report is signed by two named scientists. The sample was collected and received on 27 March 2026 and reported on 1 April 2026. The label claims 15,000 mg of CBD; the laboratory measured 16,300 mg in the container, roughly 9% above the claim, comfortably inside the plus or minus 10% window that label-accuracy studies use as their threshold. The report states that as 28.8% CBD by weight, or 269 mg/mL, calculated on a container the lab actually weighed (56.7 g) rather than on a nominal 60 mL. The report is the measurement; the label is the claim. Total THC came back non-detected on this batch's COA, which is not the same thing as a guarantee about a drug test, for reasons our piece on why the THC line still carries residual risk explains. Minor cannabinoids were quantified individually: 145 mg CBG, 65.2 mg CBDV, 31.0 mg CBN and 17.7 mg THCV in the container. The potency method code printed on the report (POT-INST-005) and the heavy-metals code (HM-INST-003) both appear verbatim in that lab's accreditation scope supplement, which closes the verification chain on a real document.

Now the part a marketing page leaves out. That report carries three panels: potency, heavy metals and microbials. It does not carry a pesticide panel, and it does not carry a residual-solvents panel. The laboratory is accredited for both of those methods; they were not ordered on this batch. So by the standard this article just set, our own COA is not a full-panel report, and describing it as one would be exactly the kind of scope inflation the article is about. If pesticide or solvent data matters to your decision, ask for it rather than assuming a badge covers it. The sample was also supplied by the client, as in nearly all send-a-sample testing. Those are the honest edges of our document. Knowing where the edges are is worth more to you than a sticker that pretends there are none.

What third-party testing can never tell you

A verified lab report is strong evidence about a narrow question. It tells you what a competent laboratory measured in one sample, from one batch, on one date. It does not promise the next batch. It does not describe how the product was manufactured or stored. And it is not a regulatory review: the FDA has approved one CBD medication for specific seizure conditions and has not approved CBD as a dietary supplement, so nobody vetted the bottle before it reached the shelf. Testing is what partially fills that space, not what closes it.

It also says nothing about effects. A clean potency panel is a composition statement, not a health claim, and according to the NIH's National Center for Complementary and Integrative Health, human evidence for most consumer CBD uses is limited or preliminary. A perfect COA does not move that. As market context, one figure is worth keeping: in a 2024 analysis of 202 US CBD products bought online in 2021, 149 of them (74%) measured more than 10% away from the CBD stated on the label, and about a quarter did not meet the definition of the spectrum type printed on the package. That study was sponsored by Jazz Pharmaceuticals, tested a single unit per product, and is not a verdict on any particular brand. It is simply the reason five minutes of verification is worth spending. Testing is one input into a purchase; our seven-check guide to choosing a CBD oil covers the rest of the decision.

Frequently asked questions