How an online prescription works
On the platforms, you fill in a questionnaire about your symptoms, sometimes followed by a short video call. A doctor then issues a prescription, usually a private prescription, and a mail-order pharmacy sends the flowers to your home. You pay the costs yourself: since 30 July 2026, statutory health insurers no longer pay for dried flowers.
What is allowed today
Medical cannabis is a prescription-only medicine. It is governed by the Medical Cannabis Act (MedCanG), prescribed on an ordinary prescription and only dispensed in pharmacies. So far, the Act does not say explicitly whether personal contact is needed before the first prescription.
The Federal Government wants to change this: flowers are to be prescribed only after personal contact in the doctor’s practice or on a home visit, and no longer sent by post (draft law, printed paper 21/3061). On 15 September 2026, Federal Health Minister Carsten Linnemann said: “Consumer cannabis at the push of a button by mail order, that no longer has anything to do with healthcare.” The ban on mail order is disputed within the coalition, and the draft has not yet been passed (as of 20 October 2026).
What courts have ruled on advertising
Prescription-only medicines may only be advertised to professionals, not to consumers (§ 10 para. 1 HWG, the German Healthcare Advertising Act). Treatments without the doctor examining you themselves, in other words remote treatment, may also only be advertised within narrow limits (§ 9 HWG).
- On 26 March 2026, the Bundesgerichtshof (Federal Court of Justice) ruled that an online referral platform had breached the advertising ban. The judgment is final (case no. I ZR 74/25).
- The Landgericht München I (Munich Regional Court I) prohibited a platform from advertising cannabis prescriptions via remote treatment (2 June 2025, case no. 4 HK O 11377/24, not final), and the Landgericht Hamburg (Hamburg Regional Court) found that another platform had breached both provisions (11 March 2025, case no. 406 HKO 68/24, appeal lodged).
- According to a judgment of the Landgericht Düsseldorf (Düsseldorf Regional Court), a mail-order pharmacy that works with such a platform is also liable and may not fill the platform’s prescriptions without personal contact with a doctor (23 April 2026, case no. 37 O 55/25, not final).
In January 2026, the German Medical Association (Bundesärztekammer) criticised that, “despite the advertising bans in §§ 9 and 10 of the Healthcare Advertising Act, advertising is in many cases carried out in an obviously impermissible manner”.
What happens to your data
A prescription reveals medical treatment. The General Data Protection Regulation gives health data like this special protection (Art. 9 GDPR). At one large provider, prescriptions showing name, address, date of birth and health insurer could be found via search engines in May 2024; the Hamburg data protection authority recorded the case in its activity report. In early 2026, according to heise online, logged-in users there were able to access around 1.7 million prescriptions from about 500,000 customers; the company itself spoke of up to 330,000 people affected.
Data leaks do not only happen at platforms: in 2024, data on more than 1,000 members was exposed in administration software for cultivation associations. So wherever you provide sensitive data, ask who stores it and for how long.
How much goes through online prescriptions
Imports of medical cannabis have risen sharply since April 2024: according to the Federal Institute for Drugs and Medical Devices (BfArM), they came to around 73 tonnes in 2024 and around 205 tonnes in 2025. In the second half of 2024, imports were 170% higher than in the first, while prescriptions via the health insurers were only 9% higher. The Federal Government, the German Medical Association and the scientific evaluation of the Consumer Cannabis Act assume that a considerable share also goes, via online private prescriptions, to people with no medical need. There is no official figure for this.
How to recognise careful treatment
- You talk to a doctor, not just to a form.
- You are asked about previous illnesses, other medicines and past treatments.
- You are informed about risks, dosage and driving.
- Before a diagnosis, there is no advertising with strains, THC content and prices, no discounts and no rewards for referrals.
- You find out who stores your data, where the company is based and which supervisory authority is responsible.
On the road
The THC limit does not apply if the THC comes from taking a medicine prescribed for you as intended. You must still be fit to drive, otherwise you commit a criminal offence. More on this in the module Road traffic and the law.
Without a medical reason
For adults without a medical reason, home growing and cultivation associations are the only legal options. The page What is a cannabis social club? explains what a cultivation association is and what it may do. The anonymous self-test shows whether your use is harming you.
Sources
- Medical Cannabis Act (MedCanG), §§ 3 and 4
- Social Code Book V (SGB V), § 31 para. 6
- Healthcare Advertising Act (HWG), §§ 9 and 10
- Road Traffic Act (StVG), § 24a
- German Criminal Code (StGB), § 316
- Deutscher Bundestag, printed paper 21/3061 (2025): draft First Act amending the Medical Cannabis Act
- Bundesgerichtshof (2026): judgment of 26 March 2026, I ZR 74/25, press release 55/2026
- Pharmazeutische Zeitung (2025): Landgericht München I, judgment of 2 June 2025, 4 HK O 11377/24
- Deutsche Apotheker Zeitung (2025): Landgericht Hamburg, judgment of 11 March 2025, 406 HKO 68/24
- Apothekerkammer Nordrhein (2026): Landgericht Düsseldorf, judgment of 23 April 2026, 37 O 55/25
- Bundesärztekammer (2026): statement of 12 January 2026 on the draft law
- Deutsches Ärzteblatt (2026): Linnemann pushes for stricter rules on medical cannabis, 15 September 2026
- Pharmazeutische Zeitung (2026): between the duty to provide care and the debate about misuse, 24 September 2026
- Hamburgische Beauftragte für Datenschutz und Informationsfreiheit: 33rd data protection activity report 2024
- heise online (2024): cannabis prescriptions viewable online, 15 May 2024
- heise online (2026): security vulnerability allowed access to 1.7 million prescriptions, 8 January 2026
- apotheke adhoc (2026): another data breach, information from the company, 9 January 2026
- heise online (2024): data leak in administration software for cannabis clubs, 6 April 2024
- Bundesinstitut für Arzneimittel und Medizinprodukte: import of medical cannabis
- EKOCAN (2026): second interim report on the evaluation of the Consumer Cannabis Act