How to Read a CBD Certificate of Analysis: A Buyer’s Guide

A real Lovewell Farms full-panel COA — potency, pesticides, heavy metals, and microbials all on one report.

A real Lovewell Farms full-panel COA — potency, pesticides, heavy metals, and microbials all on one report.

The CBD industry has a well-documented trust problem. A widely cited 2017 study published in JAMA tested 84 CBD products sold online and found nearly 70% were mislabeled — containing significantly more or less CBD than advertised, with some containing undisclosed THC (summary via ScienceDaily). The tool that separates a brand willing to be checked from one that isn’t is the Certificate of Analysis, or COA. Here’s how to actually read one.

What a COA is

A COA is a lab report from an independent, state-licensed testing facility — not the brand’s own in-house lab — that verifies what’s actually in a specific batch of product. The FDA’s own guidance on CBD products points to accurate, verifiable testing as a baseline consumer protection the agency expects to see. A legitimate COA is tied to a specific lot or batch number, not just the product line in general, because potency and purity can vary batch to batch even within the same product.

The four things worth checking

• Cannabinoid potency panel: confirms the actual CBD (and THC) content matches what’s on the label. This is the section that catches mislabeled potency.
• Pesticide screen: checks for the specific pesticide compounds regulators test for — especially important given how readily hemp absorbs whatever’s in its growing environment.
• Heavy metals screen: checks for lead, arsenic, cadmium, and mercury, again tied to hemp’s tendency to pull contaminants up from soil.
• Microbial and residual solvent testing: checks for mold and bacteria, and, for extracted products like vapes or concentrates, leftover solvent from the extraction process.

How to match a COA to the product in your hand

Scan the QR code on the label to pull up that batch’s lab report.

Scan the QR code on the label to pull up that batch’s lab report.

Look for a batch or lot number on the product packaging, then confirm that same number appears on the COA you’re looking at. Several of our own products — including our CBD+ Focus Gummies and “The Balm” relief salve — carry a QR code directly on the packaging that links to that batch’s specific lab report. If a brand only posts one general COA for an entire product line with no batch-specific numbers, there’s no way to confirm the item in your hand was actually the batch that got tested.

Red flags

• No COA available at all, or one that’s only provided “upon request” rather than posted openly.
• A COA with no batch/lot number tying it to the specific product you bought.
• A COA that only shows potency and skips pesticides, heavy metals, and microbials.
• A testing lab that isn’t independently, state-licensed — or isn’t named at all.

What we do

Every batch of Lovewell Farms flower and CBD product is tested by a state-licensed, independent lab for potency, pesticides, and heavy metals. You can look up results for any product — from our organic hemp flower to our tinctures and gummies — on our Certificates of Analysis page. If you’re new to dosing once you’ve confirmed a product’s potency, our beginner’s dosing guide is a good next stop. For general background on evaluating hemp product safety, Project CBD’s consumer guidance is also a solid independent resource.

Frequently Asked Questions

What is a Certificate of Analysis (COA)?
A lab report from an independent, state-licensed testing facility confirming what’s actually in a specific batch of a hemp or CBD product, covering cannabinoid potency and contaminant screens.

How do I find the COA for my specific product?
Look for a batch or lot number on the packaging, then match it to the corresponding report — either posted on the brand’s site or, increasingly, via a QR code printed directly on the package.

What should a CBD COA include?
At minimum: a cannabinoid potency panel, pesticide screen, heavy metals screen, and microbial/residual solvent testing, performed by a named, state-licensed independent lab.

Why do so many CBD products fail lab testing?
A widely cited 2017 JAMA study found nearly 70% of CBD products sold online were mislabeled for potency, and the market remains loosely regulated at the federal level, which is why third-party COAs matter.

Is third-party lab testing required by law?
Requirements vary by state; it isn’t uniformly mandated at the federal level. Because of that gap, COAs function as a voluntary trust signal — a brand publishing thorough, batch-specific COAs is choosing a higher bar than the law strictly requires.

References & Further Reading

• Bonn-Miller et al., “Labeling Accuracy of Cannabidiol Extracts Sold Online,” JAMA (2017) — full text via PMC
• ScienceDaily — “Nearly 70 percent of cannabidiol extracts sold online are mislabeled, study shows”
• FDA — Regulation of Cannabis and Cannabis-Derived Products, Including CBD
• Project CBD — CBD Safety and Beginner’s Guidance

These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease. Always check your state and local regulations, as well as your employer’s policies, before purchasing or using hemp products.