CBD derived from low-THC hemp is now legal in every state. (Hemp-derived CBD is not derived from high-THC cannabis plants.) The catch: Because CBD was approved as the active ingredient in the anti-seizure medicine Epidiolex, the FDA considers it a drug, making it illegal to sell as an OTC supplement. How that prohibition might be enforced isn't known. The situation should become clearer over the next year or two, as a regulatory framework is better established.